loki-mode 11.74.2 → 11.75.2

package/docs/v10/BOARD.md

@@ -1,1403 +0,0 @@
-# Board
-
-Written only by the Product Owner and the Release Captain. One row per
-slice. See `docs/v10/SWARM.md`.
-
-## Status format (normalized for `scripts/v10-pulse.sh`)
-
-Every row's `Status` cell is exactly one token, an `@`, and a UTC timestamp
-(`<token>@YYYY-MM-DDTHH:MMZ`) -- the time the status last changed. Prose,
-history, and caveats move to `Notes`; `Status` itself must stay
-machine-parseable with no free text. Tokens, in the lifecycle order the pulse
-script expects:
-
-`ready` -> `building` -> `review` -> `review-blocked` (returns to `building`)
--> `approved` -> `merged` -> `released`. Side states: `blocked` (needs a
-Captain/PO decision), `rejected` (sent back, will be re-cut), `parked`
-(deliberately shelved).
-
-`merged` here means "the Captain landed it on main" -- a slice sits at
-`merged` until the Captain flips it to `released` on the next version bump
-that ships it. The pulse script does NOT trust this field for its own
-"merged-but-unreleased age" computation: it derives that directly from git
-(`git log` on main after the last release tag) since a table cell can go
-stale between edits. This field still matters for humans and for the
-ready/building/review/blocked counts, which git cannot derive.
-
-## Grandfathered slices (in flight before the swarm existed)
-
-These were built and reviewed under the cycle process, not cut by the PO.
-They enter the Captain's merge queue as-is, each reviewed at HIGH tier before
-merge (all touch trust-core or security-relevant surfaces), oldest first.
-
-| ID | Owner | Branch @ SHA | File set (summary) | Tier | Status | Notes |
-|---|---|---|---|---|---|---|
-| GF-1 | cycle-4 (main) | main @ 779c50e5 (v9.54.1) | cycle 4 + verdict fix + XSS fix + pkill-scoping fix (D15/D16/D17, RELEASED) + D8-D17 | HIGH | parked@2026-10-03T12:01Z | PF-2 (P7 scanner gap fix) finished at ecfd9578, ready for review. Full council re-run required once merged (D12). PF-1 shipped separately as v9.54.1, ahead of GF-1. Drift audit 12:01Z: no live owner for 5+ days; parked per D68 drop-red. |
-| GF-2 | P5 slice | main @ c7b2d8b4 | providers/loader.sh, autonomy/loki, bin/loki, docs/air-gapped.md, docs/enterprise/*, README.md, tests/moat/p5-*.sh, tests/test-doctor-json-sentrux.sh | HIGH | released@2026-09-27T15:00Z | Rebased onto current main (past S-11), 4 conflicts resolved (cloud-tag detection + OLLAMA_HOST override are complementary, merged with cloud-tag checked first). HIGH review APPROVE. P5 PROVEN (9/9), pushed. Moat is now 3 of 9 (P5, P6, P7). CORRECTION: the `.loki/state/provider` issue found during verification was NOT a local-only false alarm -- it is a real CI-breaking cross-test contamination bug (test-iteration-grace.sh writes it, poisoning every later test in the same CI shard's shared checkout, including test-airgap-ollama-host.sh); it genuinely broke `Tests` (shard 3/4) on `ba6610dc`. See BACKLOG 126 for the corrected root cause and the fix (shipped, see PROGRESS.md/BACKLOG 126). Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| GF-3 | P9 slice | main @ 4c15ef5b | .github/workflows/*.yml, .github/actions/issue-to-pr, autonomy/run.sh (github_token wrap), loki-ts/src/runner/github_token.ts, autonomy/lib/proof-check.sh, action.yml, docs/environment-variables.md, tests/moat/p9-rule-of-two.sh, tests/test-issue-to-pr-action.sh, loki-ts/tests/runner/github_token_withheld.test.ts, loki-ts/dist/loki.js | HIGH | released@2026-09-27T15:00Z | Rebased cleanly (0 conflicts) onto current main; 4/4 P9 moat cases re-verified fresh at every step, never trusted from a stale note. Full 4-reviewer HIGH-tier quorum, effectively unanimous: 2/4 clean APPROVE, 1/4 APPROVE-with-precondition (found and live-reproduced a real TOCTOU gap via a planted git hook, correctly bucket-(b) per D21, filed BACKLOG 138/139), 1/4 CONCERN citing the same dist-staleness gap independently via commit-timestamp comparison. Fixed by rebuilding loki-ts/dist (confirmed new env-var literals present in the built artifact) and re-verifying: P9 genuinely PROVEN, 4 of 9 moat properties overall (a clean superset of main, zero regressions once `npm ci` corrected an environment gap in review worktrees), 6/6 Bun tests, clean tsc. BACKLOG 140/141 filed for two more non-blocking follow-ups. Per D22, ships alone (release.yml touched: 3 no-cache additions, verified minimal through every review round) -- pushed, its own triggered CI run being watched to green before anything else merges. S-18 and S-37 (duplicate) now unblocked to re-cut once this CI run is confirmed green. Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| GF-4 | P4 slice | main @ 0f214c3f | providers/model_catalog.json, loki-ts/src/commands/start.ts, loki-ts/src/runner/providers.ts, tests/moat/pending.txt | MEDIUM | released@2026-09-27T15:00Z | Both reviewers landed APPROVE (reviewer 2 conditional on the commit-message fix, already applied at cd07adb2; reviewer 1 independently traced bash/Bun parity end to end and found the same commit-message defect). Re-rebased onto main post-S-41, re-verified moat clean (P4.catalog-has-top-model promoted, P7 PROVEN, 4/9) on the real checkout with deps installed. Merged. Correction: this row was left at `review@` after the actual merge -- caught by the pulse's REVIEW_STALE violation, a repeat of the same status-tracking-lag class as S-30/S-32. Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| GF-5 | verdict/security fix | worktree-agent-a9b8124e8cfc6809a @ 399e1f3a | web-app/src/components/EvidenceReceiptPanel.tsx, legacy-ui/components/loki-audit-viewer.js, dashboard/audit.py, dashboard/server.py (get_proof), dashboard/auth.py | HIGH | released@2026-09-27T15:00Z | Cherry-picked onto main as 3a139d81 (GF-1 now includes it). This row is historical; do not re-review separately. Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-
-## Priority out-of-band fix (severity: kills unrelated user sessions)
-
-| ID | Owner | Branch @ SHA | File set | Tier | Status | Notes |
-|---|---|---|---|---|---|---|
-| PF-1 | pkill-scoping fix | main @ 9cd51d1a | autonomy/run.sh (kill_provider_child), tests/test-kill-provider-child-scoping.sh, docs/v10/DECISIONS.md (D15) | HIGH | released@2026-09-27T01:33Z | Founder-reported: every loki-mode session ending via signal (supervisor signal, double Ctrl+C, Ctrl+C in perpetual mode) ran an unscoped `pkill -f` matching ANY process on the machine by command-line substring, terminating unrelated Claude Code sessions. Fixed to scope by process group. Shipped as v9.54.1, ahead of the swarm queue. |
-| PF-2 | P7 scanner gap fix | main @ fa5de15f | tests/moat/p7-no-fabricated-data.sh | HIGH | released@2026-09-27T15:00Z | Round 5, unanimous 4/4 APPROVE under a corrected scoping rule (only a regression/false-positive/weakening introduced by the diff blocks; a pre-existing gap the diff doesn't worsen is a new slice, not a veto). Rebased onto current main, merged fa5de15f, pushed. 10 candidate follow-up slices recorded below (B-1..B-8 plus 2 more from the review). Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| P12-17 | Slack thread steer | main @ 2d333d158 | loki-ts/src/contrib/slack_inbound.ts + test | MEDIUM | released@2026-10-16T17:19Z | reviewed and merged; v11.16.0 was never published, shipped in v11.17.0 |
-| P12-12 | stall watchdog | main @ 4c0ee6dbf | engine10 session, runner watchdog + tests | MEDIUM | released@2026-10-16T17:19Z | reviewed and merged; v11.16.0 was never published, shipped in v11.17.0 |
-| P12-16 | chat commands | main @ 6d6f69f73 | autonomy/lib/chat.sh, tests/test-doctor-ux.sh | MEDIUM | released@2026-10-16T17:19Z | reviewed and merged; v11.16.0 was never published, shipped in v11.17.0 |
-| P12-24 | doctor min claude version | main @ e6754c961 | doctor, compat manifest | LOW | released@2026-10-16T17:19Z | reviewed and merged; v11.16.0 was never published, shipped in v11.17.0 |
-| P12-21 | per-stage cost | main @ 44c0810f2 | cost breakdown | MEDIUM | released@2026-10-16T17:19Z | reviewed and merged; v11.16.0 was never published, shipped in v11.17.0 |
-| P12-31 | active human minutes | main @ 9e2604b95 | trust, proof | MEDIUM | released@2026-10-16T17:19Z | reviewed and merged; v11.16.0 was never published, shipped in v11.17.0 |
-| P12-25 | provider isolation matrix | main @ 8c256963b | tests/providers, guard revert | MEDIUM | released@2026-10-16T17:19Z | reviewed and merged; v11.16.0 was never published, shipped in v11.17.0 |
-| P12-03 | merge pinned to proven head | main @ b3ff4bb1d | merge, proofs | HIGH | released@2026-10-16T17:19Z | reviewed and merged; v11.16.0 was never published, shipped in v11.17.0 |
-| P12-06 | council file:line anchors | main @ 40ee4c1a9 | council | MEDIUM | released@2026-10-16T17:19Z | reviewed and merged; v11.16.0 was never published, shipped in v11.17.0 |
-| P12-04 | respond refuses moved head | main @ 6da9172e6 | verify-pr respond | HIGH | released@2026-10-16T17:19Z | reviewed and merged; v11.16.0 was never published, shipped in v11.17.0 |
-| P12-07 | per-stage resume (07b-07g) | main @ f5c54cbb7 | engine10 resume, autonomy/loki start | HIGH | released@2026-10-16T17:19Z | v11.17.0, reviewed and merged |
-| P12-01 | Seal drift and receipt tamper checks (01b, 01c) | main @ f5c54cbb7 | loki verify, proofs | HIGH | released@2026-10-16T17:19Z | v11.17.0, reviewed and merged |
-| P12-26 | compiled Claude permission policy (26b, 26c) | main @ f5c54cbb7 | src/policies, launch sites | HIGH | released@2026-10-16T17:19Z | v11.17.0, reviewed and merged |
-| P12-09 | quota wait-then-rerun (09b) | main @ f5c54cbb7 | runner retry_class | MEDIUM | released@2026-10-16T17:19Z | v11.17.0, reviewed and merged |
-| P12-08 | work-item ids and lifecycle states (08b, 08c) | main @ f5c54cbb7 | engine10 state, loki status | MEDIUM | released@2026-10-16T17:19Z | v11.17.0, reviewed and merged |
-| P12-02 | post-Wall steer blocks Seal (02b, 02c) | main @ f5c54cbb7 | steer, seal | HIGH | released@2026-10-16T17:19Z | v11.17.0, reviewed and merged |
-| P12-03b | dirty-tree proof fails closed (03c, 03d) | main @ f5c54cbb7 | proofs | HIGH | released@2026-10-16T17:19Z | v11.17.0, reviewed and merged |
-| P12-05 | Wall holdout, off by default | main @ f5c54cbb7 | engine10 wall | HIGH | released@2026-10-16T17:19Z | v11.17.0, reviewed and merged |
-| P12-16b | chat /run reports only a live run | main @ f5c54cbb7 | autonomy/lib/chat.sh | MEDIUM | released@2026-10-16T17:19Z | v11.17.0, reviewed and merged |
-| P12-17b | Slack echo redaction | main @ f5c54cbb7 | contrib/slack | MEDIUM | released@2026-10-16T17:19Z | v11.17.0, reviewed and merged |
-| P12-23 | start flag parsing (23b) | main @ f5c54cbb7 | autonomy/loki | LOW | released@2026-10-16T17:19Z | v11.17.0, reviewed and merged |
-| P12-29 | configured Claude Code eval arm | main @ f5c54cbb7 | eval/loki10 | MEDIUM | released@2026-10-16T17:19Z | v11.17.0, reviewed and merged |
-| P12-30 | eval task families with hidden tests | main @ f5c54cbb7 | eval/loki10 | MEDIUM | released@2026-10-16T17:19Z | v11.17.0, reviewed and merged |
-| P12-40 | uncited-claim guard (40b) | main @ f5c54cbb7 | structural checks | LOW | released@2026-10-16T17:19Z | v11.17.0, reviewed and merged |
-| P12-CAP | engine10 core line cap | main @ f5c54cbb7 | tests | LOW | released@2026-10-16T17:19Z | v11.17.0, reviewed and merged |
-
-## Fixed on main already (not slices; recorded for PO context)
-
-- BACKLOG 95, 97: fixed (cycle 4 + P7 sweep).
-- BACKLOG 96, 98: partly fixed by the P7 sweep (0afb6e2c); remaining pieces
-  are BACKLOG 112, 118.
-- BACKLOG 113, 119: fixed (3a139d81, in GF-1).
-- XSS in receipt/learnings panels: fixed (f6050ef1, in GF-1).
-
-## Ready queue (PO-cut)
-
-Cut against BACKLOG items not already owned by an in-flight slice (PF-1, PF-2,
-GF-2 P5, GF-3 P9, GF-4 P4, the repo-wide kill-scan agent). Each slice's file
-set is declared to avoid overlap with those and with each other.
-
-| ID | Owner | File set | Tier | Acceptance checks (Wall) | Status | Notes |
-|---|---|---|---|---|---|---|
-| S-45 | BACKLOG 111: pytest "1 passed, 1 error" parses as failed_count 0 and passes | autonomy/run.sh (bd39d359's summary parser only), its test | MEDIUM | red: a pytest run with 1 passed + 1 error exits 0 from the parser's perspective; green: the error count is counted, gate does not pass | released@2026-09-27T15:00Z | Isolated to the pytest summary regex; does not touch any GH-token/withhold code the in-flight security rework owns. Merged 52179cf4 (auto-merged cleanly onto S-44's run.sh diff, different region), 44/44 reconfirmed on main. Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| S-46 | BACKLOG 115: status inference presents a guess as a state | web-app/server.py (`_infer_session_status` only), cockpit/useCockpitState.ts (completed fallback + checklist scoping) | MEDIUM | red: a paused/failed run older than 5 min reads "completed"; green: an explicit unknown/stale status is possible and surfaced | released@2026-09-27T15:00Z | File set disjoint from any moat scanner or run.sh trust-core path. Merged 18013159, 11/11 reconfirmed on main. Terminal statuses trusted regardless of file age; a stale active-looking status or a bare source file now falls through to an honest 'unknown' instead of guessed 'completed'. Also fixed the checklist-scoping bug (a historical session no longer shows the globally-running project's live checklist). Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| S-47 | BACKLOG 116: key misreads hide or zero real data (GitHubPRsPanel statusCheckRollup/state case, EvidenceReceiptPanel cost_usd/files_changed keys, memory-browser camelCase mismatch) | web-app/src/components/GitHubPRsPanel.tsx, web-app/src/components/EvidenceReceiptPanel.tsx, legacy-ui/components/loki-memory-browser.js, legacy-ui/components/loki-overview.js | MEDIUM | red: each named field misreads and shows a false empty/zero; green: each reads the real emitted key, one test per site | released@2026-09-27T15:00Z | EvidenceReceiptPanel.tsx already touched by GF-5 (merged) for a different concern (classify()); this slice is the cost_usd/files_changed key-path only, disjoint lines. Merged 11a3e7fb (auto-merged onto loki-overview.js cleanly, different function), 34/34 reconfirmed on main; builder verified every key against the real writer/API source, not the backlog description alone. Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| S-48 | BACKLOG 128: stale docs assert a `{"runner":"none","pass":true}` writer shape that does not exist (D20 already corrected the real shape) | references/core-workflow.md, docs/VERIFIED-COMPLETION-PLAN.md, tests/test-council-devils-advocate.sh, tests/test-da-veto.sh, tests/test-council-convergence-floor.sh | LOW | docs describe the real writer shape (`pass:"inconclusive"` string); the 3 named test fixtures use the real shape instead of a synthetic `pass:true` | released@2026-09-27T10:58Z | STALE DUPLICATE, already fixed: builder found all 5 target locations already correct (commit c06b50ee, "S-33"), verified directly against `enforce_test_coverage` in run.sh and re-ran all 3 test suites clean (6/6, 9/9, 40/40). No new commit needed. Marking released since the underlying fix already shipped in main. One non-blocking follow-up noted: `test-council-convergence-floor.sh` NEGATIVE-B passes even without the `runner!='none'` guard, since `pass:"inconclusive"` alone already fails `pass===True` -- candidate for a future assertion-hardening slice, not filed as a new backlog item yet. |
-| S-49 | BACKLOG 134: completion-council.sh's 3 test-result readers use bare PATH python3 -E -c with no -I/-S/fixed-path resolution (same bypass class BACKLOG 129 already closed for run.sh) | autonomy/completion-council.sh (council_heuristic_review, council_evaluate_member, council_devils_advocate_review only), new moat case planting a user-site .pth | HIGH | red: a planted .pth flips a genuinely-failing test-results.json to CONFIRMED_COMPLETE; green: routed through a resolved-interpreter helper matching `_loki_snapshot_py_tool`'s pattern, .pth has no effect | released@2026-09-27T16:40Z | Disjoint from S-18/BACKLOG 149's run.sh GH-token work and from S-17's vote-text assertions (already merged, different lines in the same file -- verify no line-range collision before editing). Dispatched 15:00 (workflow wf_29a75a9c-652, slice-card brief). Built 6b276aaf (wf_29a75a9c-652-1): 3 readers via _loki_snapshot_py_tool -I -S, new P2 case red pre-fix and green after, mutation red. 2 HIGH reviewers dispatched 15:16. Reviewer B APPROVE; reviewer A CONCERN (reproduced): queue readers at ~3769/~4050 still use bare python3 -E, so a .pth flips the verdict. Rework sent 15:28. Rework 17eeb940+8ce7f1b1: queue and convergence readers isolated and fail closed, no-interpreter veto, byte-identity test. Re-review (HIGH) dispatched 15:40. Round 2: HIGH reviewer A APPROVE (the .pth attack fails on every reader in the 3 functions; 7 of 8 mutations red; M3b checklist leg is a test gap, fix holds on a direct probe). Reviewer B approved round 1. Train 4. Follow-up: council readers outside the 3 functions (~1425, ~1564, ~4215-4245). Cherry-picked onto main for train 4 (3 commits); D27 checks green except tests/test-select-tests.sh, which hit the 60s cap (rc=124; CI runs it in full; reviewer ran 38/38). Train 4 release commit 08d64f4e (v9.59.0) pushed 16:07:02Z, ls-remote verified. Released in v9.59.0 (Release run 36332036567 publish-npm success; v9.58.0 itself never published, superseded). |
-| S-50 | BACKLOG 137: S-02's dynamic-repo-root fix breaks P7's own sed-workaround for the same bug | tests/moat/p7-no-fabricated-data.sh (lines 477-501, the client-route helper invocation only) | MEDIUM | red: P7.webapp-client-routes-exist fails post-S-02 because the sed target no longer exists; green: helpers run in place or receive the root explicitly, case passes again | released@2026-09-27T19:42Z | NARROW SCOPE WARNING: this file is the most contended file this session (S-27/S-29/S-30/S-31/S-32 lineage). Builder must rebase onto main AFTER the S-29 merge-pass lands and touch ONLY the named 477-501 invocation block, nothing else in the file. Coordinate with Captain before starting if S-29's merge is still in flight. Batch 5 build (wf_38d4e17c-211). Review APPROVE found the fix already on main from S-39 bf9776fb (tests/moat/p7-no-fabricated-data.sh:477-497 runs helpers from $REPO_ROOT/tests, no sed); no new commit. Published: `npm view loki-mode version` = 9.71.0; npm time lists 9.70.0. |
-| S-51 | BACKLOG 117: stale or false static copy (version numbers, license, Gemini support, gate counts, invented testimonial) | web-app/src/components/WhatsNew.tsx (actual path, not pages/ as originally listed), web-app/src/components/Footer.tsx, web-app/src/pages/SettingsPage.tsx, web-app/src/pages/ComparePage.tsx, web-app/src/components/BenefitCards.tsx, web-app/src/components/TrustedBy.tsx | LOW | grep confirms each named false claim is gone (version bumped to current, MIT replaced with BUSL-1.1, Gemini removed, gate count corrected to 8, invented testimonial line removed) | released@2026-09-27T15:00Z | Merged 7ad546a7, clean cherry-pick, direct Captain review (LOW tier, pure copy diff, verified against VERSION/LICENSE/CLAUDE.md source of truth). TrustedBy.tsx reviewed and left unchanged (no fabricated content found). BenefitCards.tsx's Gemini removal also dropped it from Multi-AI copy (not just the gate count). Follow-ups flagged, not filed as new backlog yet: SettingsPage.tsx build date still hardcoded (2026-03-24, out of scope for a copy-only slice since deriving it live is a logic change); PROVIDERS array still lists Gemini as active (behavior, not copy); DocsSidebar.tsx/ContextualHelp.tsx/CostEstimator.tsx/ProjectWorkspace.tsx/SystemSettingsPage.tsx also reference Gemini or stale gate counts, out of this slice's file set; WhatsNew.tsx/Footer.tsx versions are not in CLAUDE.md's release version-bump checklist so will drift stale again next release. Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| S-52 | BACKLOG 122: receipt field `first_result_verified_patch` is True for any first code change, naming a verification that did not run | autonomy/lib/proof-generator.py (the named field only) | LOW | field is renamed additively (`first_result_kind` already exists) or set only from an actually-verified result, with a test; no consumer of the old field silently breaks | released@2026-09-27T15:00Z | Direct fix chosen over additive rename (advisor-caught: a new field would duplicate first_result_kind byte-for-byte, since no producer anywhere ever sets this field True). Full consumer survey done; found and fixed a real bug the fix would otherwise have caused (loki-overview.js's "Plan only" label, repointed at first_result_kind). Merged 0380ad6f, 21/21 + 11/11 reconfirmed on main. Direct Captain review (LOW tier). Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| S-53 | BACKLOG 138 fix direction: trusted git push/PR calls should ignore agent-controlled hooks/config (planted pre-push hook, credential.helper, core.fsmonitor, core.sshCommand can see GH_TOKEN during Loki's own trusted push) | autonomy/run.sh (create_session_pr / the trusted push call sites only, not the withhold function itself which S-18/BACKLOG-149's rework owns) | HIGH | red: a planted `.git/hooks/pre-push` sees GH_TOKEN during Loki's trusted push (reproduce reviewer 3's GF-3 finding); green: the trusted push explicitly neutralizes hooksPath/credential.helper/sshCommand for that one invocation, hook sees nothing | parked@2026-09-27T17:14Z | Sequencing note: wait for S-18/BACKLOG 149's rework to land first (touches nearby withhold/re-grant code in the same file); rebase onto that before starting to avoid a conflict. Do not touch the withhold function itself, only the push-call invocation. Delivered by S-18 round 5 (trusted push from a fresh temp repo; the agent repo config is never loaded with credentials). |
-| S-54 | BACKLOG 139: shipped composite GitHub Actions put GH_TOKEN in the SAME step as the agent invocation (issue-to-pr) | .github/actions/issue-to-pr/action.yml, root action.yml | HIGH | the issue content is fetched in an earlier, separate step that does not hold the token; the agent-invoking step receives only a file, never a step with GH_TOKEN in its env | released@2026-09-28T01:11Z | NOTE: S-41 (merged 8a714c73) may have already partially addressed this exact split for .github/actions/issue-to-pr/action.yml -- builder must read S-41's actual merged diff first via `git show 8a714c73` and confirm what remains before starting, to avoid redundant or conflicting work. If S-41 already fully closed this, report back as a stale duplicate rather than editing. Dispatched 15:00 (workflow wf_29a75a9c-652, slice-card brief). Built 9c64533b: the fix was already in S-41 (8a714c73), so it adds only a step-level test (17 failures on pre-S-41 files, 0 now, 2 mutations red). HIGH reviewer dispatched 15:16. CONCERN: hand-listed action files; detection misses npx loki-mode@ver, path or variable calls and scripts. Rework sent 15:28. Rework 2b81483d: globbed actions, wider detector; it blanked tokens in 3 production steps (incl. Run Quality Review). HIGH re-review is checking whether that breaks PR commenting. Re-review CONCERN: the narrowed separator lost if/while/timeout/env/pipe/subshell detection (reproduced). The token blanking is fine (the 3 steps never used a token; no CEO decision needed). Rework sent 15:59. Train 6 (release 64676dce, v9.61.0, pushed 16:24:32Z, ls-remote verified), round 3 not re-reviewed (founder instruction). Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| S-55 | Found by S-44's reviewer 1: `.github/workflows/test.yml`'s `Tests` workflow has no `paths-ignore`, so every docs-only `docs/v10/**` push (BOARD.md/BACKLOG.md/PROGRESS.md status bookkeeping) retriggers the full sharded suite and cancels any in-flight run via `cancel-in-progress` -- confirmed as the majority cause of this session's own repeated shard-2 "hangs" (self-inflicted, not a product bug) | .github/workflows/test.yml (paths-ignore only) | LOW | red: a docs/v10/BOARD.md-only push currently retriggers Tests and can cancel an in-flight run; green: a docs/v10/**-only push (and ideally other pure-doc paths) does not trigger Tests, verified by pushing a real docs-only commit and confirming no new Tests run starts | parked@2026-09-27T14:21Z | High value, low risk: directly stops the self-cancellation pattern this session hit repeatedly (including twice from the Captain's own BOARD.md bookkeeping pushes this turn). Do not broaden paths-ignore beyond doc-only globs -- must not accidentally skip Tests on a real code change that happens to touch a doc in the same commit (paths-ignore is all-or-nothing per push: verify no historical commit mixed docs/v10/** with code changes in the same push before landing, or scope the exclusion pattern more conservatively if any did). Built 0ec9c251, never merged. Parked: superseded by S-80 (main runs no longer cancel) and it conflicts with verdict reuse (S-84): a docs-only commit with no Tests run leaves a later release nothing to reuse. |
-| S-56 | BACKLOG 119 follow-through / BACKLOG 33: `cleanup_expired_rotating_keys` has no caller (the fix in cycle 4 correctly rejects an expired rotating key at validate_token time, but the cleanup function that would purge them from storage is dead code) | dashboard/api_keys.py (add a caller only, e.g. a periodic sweep or an on-validate-failure purge; do not touch dashboard/auth.py's already-fixed validate_token), its test | LOW | red: an expired rotating key stays in storage indefinitely (confirmed via a test that seeds one, advances time past rotation_expires_at, and checks it is still listed); green: cleanup_expired_rotating_keys is actually invoked on some real trigger and the key is purged | released@2026-09-27T15:53Z | Read the BACKLOG 119 fix (dashboard/auth.py validate_token) first to avoid duplicating or conflicting with it -- this slice only wires up the already-written cleanup function, does not touch the security-relevant rejection logic. Also found and fixed a latent crash (bare datetime.fromisoformat instead of the fail-closed _deadline_passed helper validate_token already uses -- would have 500'd on any bad timestamp once wired live). Merged e3c27c6d, 32/32 reconfirmed on main. Correction: this row was stale at building@. Merged as e3c27c6d (ancestor of main, verified with git merge-base --is-ancestor), shipped in v9.56.0. Correction: e3c27c6d is an ancestor of v9.56.0 (git log v9.56.0 shows it at 07:45), so it shipped in v9.56.0, not train 2. |
-| S-57 | BACKLOG 120: two legacy-ui test files do not test the shipped code (`ui-components.test.js` asserts hand-copied stale logic and is never run by any test runner; `loki-overview-issue-journey.node.test.mjs` fails 0/5 and is registered nowhere) | legacy-ui/tests/ui-components.test.js, legacy-ui/tests/loki-overview-issue-journey.node.test.mjs, tests/run-all-tests.sh (registration only, coordinate: S-44 also touched this file -- rebase onto post-S-44-merge main first) | MEDIUM | ui-components.test.js imports and asserts against the REAL shipped functions (formatGateTime, summarizeGates, formatRunDuration), not hand-copied logic; the journey test is fixed (sets `_data.connected` per the known cause) and passes 5/5; both are registered in a real runner and actually execute in CI | released@2026-09-27T15:00Z | Merged 21a539df, 23/23 + 6/6 reconfirmed on main. Found the real drift: shipped formatGateTime/summarizeGates/formatRunDuration had all changed behavior since the hand-copied test was written; rewrote to dynamically import the real functions after a DOM stub (needed since the components extend LokiElement at class-definition time). Journey test's 6 (not 5) failing cases all traced to one root cause (_data.connected never set), fixed once in the shared mounted() helper. Both registered in run-all-tests.sh, additive alongside S-44's timeout wrapping. Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| S-58 | BACKLOG 114 (scoped subset): false-empty-on-failed-fetch in the cockpit -- `cockpit/useCockpitState.ts` swallows git-status and checkpoint failures, so ChangeReview.tsx says "The working tree is clean" and RiskPanel.tsx says "No checkpoints were recorded" on a FAILED fetch, not a real empty result | cockpit/useCockpitState.ts (the git status / checkpoint fetch error handling only), web-app/src/components/ChangeReview.tsx, web-app/src/components/RiskPanel.tsx | MEDIUM | red: a failed git-status/checkpoint fetch (simulate a 500 or network error) renders the same copy as a genuine empty result; green: a failed fetch renders "Could not load..." distinctly from a genuine empty state, one test per component | released@2026-09-27T15:00Z | Merged 14d80a54, 22/22 (11 pre-existing S-46 + 11 new) reconfirmed on main, no conflict with S-46's earlier changes to the same file. Verified against the real server responses first (a genuine empty case returns HTTP 200, never a rejection) before implementing, confirming the fix's premise; a `settle()` helper now distinguishes resolved-empty from rejected. Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| S-59 | BACKLOG 71: `evidence-gate-details` `tests.ok` stays true for an inconclusive test axis -- `surface_evidence_gate_details` prints `tests_ok=True` next to `tests_inconclusive` | autonomy/lib/proof-generator.py or wherever surface_evidence_gate_details lives (grep first), its test | LOW | red: an inconclusive test axis (zero-test or no-runner) still shows tests_ok=True in evidence-gate-details.json; green: tests_ok is false or absent when the axis is inconclusive, with a test | released@2026-09-27T15:00Z | Real bug, correctly located: `surface_evidence_gate_details` lives in autonomy/run.sh:13966 (not proof-generator.py, which is a different already-correct consumer). Reused the existing 'inconclusive dominates ok' convention already established in proof-generator.py's _classify_func_axis rather than inventing a new pattern. Merged 72afa3e9, 15/15 reconfirmed on main. Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| S-60 | BACKLOG 92: receipt path bases mix under a subdirectory TARGET_DIR -- tracked entries are repo-top-relative, untracked and preexisting_modified entries are cwd-relative, so a receipt read from a subdirectory build shows inconsistent path bases | autonomy/lib/proof-generator.py (path normalization only), its test | MEDIUM | red: a receipt generated with TARGET_DIR set to a subdirectory has tracked-entry paths repo-relative and untracked-entry paths cwd-relative in the same receipt; green: both use a single consistent base (repo-relative preferred, matching the tracked-entry convention), with a test | released@2026-09-27T15:00Z | Merged 6148446f, 76/76 reconfirmed on main. Root cause: git itself reports --numstat repo-relative but ls-files --others TARGET_DIR-relative; fixed by reusing the already-computed prefix/key at one shared point. Builder honestly flagged that a pre-fix receipt from a subdirectory build will now fail hash_ok on re-verify (expected: the old receipts were internally inconsistent). Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| S-61 | BACKLOG 21 (D5): the seatbelt test `tests/dashboard/test_build_supervisor.py::BuildSupervisorTests::test_host_seatbelt_blocks_docker_ports_and_sibling_reads` fails deterministically on this host/macOS version (exit 32, not 0) -- confirmed pre-existing (reproduces identically at v9.55.0), used twice this session as a documented pre-push skip (D24) rather than investigated | tests/dashboard/test_build_supervisor.py (investigation + fix, or documented host-scoping if it's genuinely unfixable on this platform), the seatbelt-invoking code it exercises if the bug turns out to be there instead of the test | MEDIUM | red: the test fails with exit 32 on this host as it does today; green: either the test passes (root cause found and fixed) or it is correctly skipped/xfailed ONLY on the specific unsupported platform/macOS-version combination, with the skip reason documented and never silently masking a real regression on a supported platform | released@2026-09-27T15:00Z | ROOT CAUSE FOUND: on macOS 27.0, sandbox-exec's `(deny network-bind (local tcp "*:PORT"))` silently never matches an actual bind -- `tcp4` denies it correctly. A genuine bug in the generated seatbelt profile, not a test bug or an unfixable platform gap. Verified via direct sandbox-exec reproduction, ruled out rule ordering, self-caught and corrected an initial misdiagnosis (advisor-caught via a positive control), bisected across filter keyword forms. Confirmed the real production gate (smoke_probe_host_seatbelt) already failed CLOSED before this fix (refused to advertise confinement rather than silently exposing it) -- an availability bug, not a live exposure. IPv6 (tcp6/ip6) has the same underlying gap, pre-existing, out of scope, documented in-code (no IPv6 usage today). Merged 46bd86a1, 37/37 reconfirmed on main -- the test that failed identically 5+ times this session (D24's basis) now genuinely passes. This retires the D24 skip pattern going forward. Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| S-62 | BACKLOG 118 (scoped subset): council-state fallback `total_votes: 0` and a corrupt `notifications/active.json` read as a zero summary -- both server-side zero sentinels the dashboard cannot distinguish from a genuine zero | dashboard/server.py (the two named fallback sites only), its test | LOW | red: a council-state read error or a corrupt notifications file returns a zero/empty summary indistinguishable from a real zero; green: an error/corrupt-read case returns an explicit null/error marker instead, with a test | released@2026-09-27T15:00Z | Merged 1e708115, 7/7 reconfirmed on main. Genuinely-missing-file and corrupt-file cases correctly distinguished (only the latter returns the new error envelope); also fixed a small contained frontend consumer (loki-notification-center.js) that treated any HTTP 200 as success. Mutation-tested: reverted both except branches, confirmed exactly 3 tests went red. Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| S-63 | BACKLOG 78: leading-directory pathspec mismatch -- a pre-existing untracked file `a` also matches `a/b` in the literal reset, but `workspace_diff._covered` only treats `a/` (trailing-slash) entries as covering children, so the commit omits `a/b` while the receipt lists it (the receipt is the honest side, the commit behavior is the bug) | autonomy/lib/workspace_diff.py (`_covered` or equivalent) or wherever the literal reset happens (grep first), its test | MEDIUM | red: an untracked file `a` (no trailing slash) does not cover `a/b` in the reset, so `a/b` stays committed although the receipt says it's the user's; green: a bare-file snapshot entry `a` correctly covers `a/b` the same way a directory entry `a/` does, matching the receipt | released@2026-09-27T15:00Z | Merged 5f53a1fc, 78/78 reconfirmed on main, confirmed no interaction with S-60's earlier path-normalization change to the same file (different function). Root cause: `_covered`'s prefix check only tested the directory form (parent + "/"), never the bare-file form; fixed to check both, with a false-positive control (a vs ab) added alongside the real fix. Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| S-64 | BACKLOG 90: `LOKI_BRANCH_PROTECTION=false` on a leftover `loki/session-*` branch returns before any snapshot is taken, then `commit_session_changes` commits using the EARLIER session's stale snapshot, so a file the user made since is committed and lost from disk on checkout of the base | autonomy/run.sh (the branch-protection-off early-return path and commit_session_changes' snapshot-freshness check only), its test | HIGH | red: with LOKI_BRANCH_PROTECTION=false and a leftover loki/session-* branch, a file created by the user AFTER that branch was minted gets swept into the session commit and lost on a later base checkout; green: commit_session_changes refuses to commit (or re-snapshots) when no snapshot was taken THIS run | released@2026-09-27T13:18Z | STALE DUPLICATE, already fixed and released: commit d298ca60 (2026-09-26) already implements exactly this fix (the _LOKI_SNAPSHOT_THIS_RUN gate in commit_session_changes), confirmed an ancestor of origin/main. Builder verified thoroughly: ran the full 81/81 test-branch-lifecycle.sh suite (including the exact BACKLOG-90 regression test), mutation-tested the gate itself to confirm it's non-vacuous, swept for un-gated sibling commit sites (none found), and confirmed no Bun-route duplicate implementation exists. No code change needed. |
-| S-65 | BACKLOG 116 remainder: `dashboard/server.py`'s `gh pr view` (PR detail endpoint) doesn't request `statusCheckRollup` or several other fields S-47 already fixed the READER side for, so the detail-view status-checks section stays empty even after S-47's merge | dashboard/server.py (the gh pr view field-list only), its test | LOW | red: the PR detail endpoint's gh invocation omits statusCheckRollup from its --json field list, so the already-fixed frontend reader has nothing to read; green: the field list includes statusCheckRollup (and any other fields S-47's fix now expects), a real PR detail response includes it | released@2026-09-27T15:00Z | Merged 52b4dda0, reconfirmed on main. Builder correctly found the file set in the original ticket was wrong (dashboard/server.py has no PR routes; the real site is web-app/server.py's github_get_pr) and fixed there instead, disclosing the correction rather than silently working around it. Added statusCheckRollup + 4 other missing fields matching the sibling list endpoint's already-correct field set. Also flagged, not fixed (out of scope): 2 duplicate function definitions in web-app/server.py. Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| S-66 | BACKLOG 116 remainder: `dashboard/server.py`'s PR list endpoint likely has the same missing-field gap as the detail endpoint (S-65) -- verify and fix if so | dashboard/server.py (the gh pr list field-list only, if distinct from the view endpoint), its test | LOW | red: the PR list gh invocation also omits fields S-47's reader fix expects (if confirmed distinct from S-65's site); green: fixed, with a test | released@2026-09-27T13:14Z | Investigated thoroughly, no fix needed: the PR list endpoint (github_list_prs) is a genuinely separate call site from S-65's fix target, but its field list already includes all 13 fields the frontend list view actually reads (enumerated against PRCard and the GitHubPR TypeScript interface directly). This gap never existed on the list side. Marked released since no code change was needed; nothing new to ship. |
-| S-67 | BACKLOG 88: old git (< 2.18) receipt attribution -- a failed mint snapshot deletes the list, so the receipt names every user untracked file as the run's work | autonomy/lib/workspace_diff.py or wherever the mint-snapshot failure path lives (grep first), its test | LOW | red: on a git < 2.18 (or simulated failure of the mint snapshot), the receipt attributes every pre-existing untracked file to the session's own work; green: an `ls-files --others --exclude-standard` fallback list is kept for the receipt even when the primary snapshot mechanism fails, names and counts only (the commit path still fails closed) | released@2026-09-27T16:40Z | Check the git version floor already established elsewhere in this session's work (S-18's rework added a similar floor check for GIT_CONFIG_COUNT) for the established pattern to follow. Dispatched 15:00 (workflow wf_29a75a9c-652, slice-card brief). Built ae200f0c. Reviewer dispatched 15:16. 1/1 APPROVE: red to green confirmed; -z handles spaces and newlines, mutation red. Cherry-picked 8f2d58b0. In train 2 release commit 5332bfc3 (v9.57.0), pushed 15:50:12Z (ls-remote verified); becomes released when publish-npm succeeds (D27). Correction 15:54: I had marked this released too early. Released in v9.57.0 (Release run 36331009098 publish-npm success). |
-| S-68 | BACKLOG 102: `.loki/state/agent-committed-user-files.z` has no reader outside the lifecycle test and is never cleared by a later session with no hits | autonomy/run.sh (the file's write site and lifecycle only), its test | LOW | red: the file persists indefinitely across sessions even when a later session finds no agent-committed user files; green: it's read and correctly cleared/rotated when appropriate, with a test proving the lifecycle | released@2026-09-27T16:40Z | Low-risk housekeeping; read BACKLOG 108's reader requirement first (create_session_pr is supposed to read this file per that item) to confirm this isn't already partially addressed. Dispatched 15:00 (workflow wf_29a75a9c-652, slice-card brief). Built 963dcca5. Reviewer dispatched 15:16. 1/1 APPROVE. Cherry-picked f626cfb4. In train 2 release commit 5332bfc3 (v9.57.0), pushed 15:50:12Z (ls-remote verified); becomes released when publish-npm succeeds (D27). Correction 15:54: I had marked this released too early. Released in v9.57.0 (Release run 36331009098 publish-npm success). |
-| S-69 | Founder directive D25 part 3: `.github/workflows/test.yml`'s `cancel-in-progress` must apply ONLY to pull_request events, never to a push to main -- this is the direct fix for the 10-of-12-cancelled-runs pattern this session repeatedly hit and disclosed piecemeal | .github/workflows/test.yml (the concurrency block only) | MEDIUM | red: a push to main while a prior main-triggered Tests run is still in progress currently cancels it; green: a push to main never cancels an in-progress main-triggered run, while two PRs against the same branch still correctly cancel each other's stale run; verified with one real push per the founder's own instruction | parked@2026-09-27T14:13Z | Founder-specified fix shape: `cancel-in-progress: ${{ github.event_name == 'pull_request' }}`. Verify the exact syntax is valid GitHub Actions expression syntax before landing, and that the concurrency GROUP key doesn't also need adjusting (a shared group across push and PR could still cause unwanted interaction even with cancel-in-progress scoped). Superseded by S-80 (CEO Part C item 2: per-SHA group key in all 3 gating workflows, not just cancel-in-progress in test.yml). Commit 8cfa1eae not merged. |
-| S-70 | Founder directive D25 part 4: measure real per-shard Tests durations, then rebalance/increase sharding (4 to 8, or whatever balances best) so a Tests run completes in under 15 minutes; record before/after numbers in METRICS.md | .github/workflows/test.yml (shard count/matrix), tests/run-all-tests.sh (shard-assignment logic if it needs updating for a new shard count), METRICS.md (new before/after entry) | MEDIUM | red: current Tests run takes 26-34 minutes per the founder's own measurement; green: a real Tests run on the new shard count completes under 15 minutes, with the actual before/after wall-clock numbers recorded in METRICS.md, not estimated | parked@2026-09-27T14:13Z | This is what raises the release-train ceiling toward 60/day per the founder's own framing -- get real per-shard timing data first (do not guess a shard count), and confirm the shard-index partition still covers 100% of the suite (index-based, as documented elsewhere in this repo's release notes) after rebalancing. Superseded by S-81 (CEO Part C item 4: duration-balanced 8 shards). Its measured timing data (c6000cb9) feeds S-81. |
-| S-71 | Founder directive D25 part 5: `scripts/v10-pulse.sh` blind spots -- add CI_CANCELLED_STREAK (3+ consecutive cancelled Tests runs on main), MERGED_UNRELEASED (45+ min even when main CI reads UNKNOWN), and fix main-CI-UNKNOWN currently suppressing other violations that should fire independently | scripts/v10-pulse.sh, tests/test-v10-pulse.sh (fixture tests for each new violation) | LOW | red: 3+ consecutive cancelled runs, or a 45+ min unreleased-merge age, currently produce no violation when main CI reads UNKNOWN; green: both fire correctly, and a fixture test proves neither is suppressed by an UNKNOWN main-CI reading, nor does it suppress any OTHER already-existing violation | released@2026-09-27T16:40Z | Read scripts/v10-pulse.sh's current UNKNOWN-handling logic first to find exactly where/why it currently suppresses other checks before fixing -- this is likely one shared early-return or short-circuit, not three separate bugs. Built b8f43d08. 2 Tech Lead reviewers dispatched 14:09 (stacked with S-75). Reviewer 1/2 APPROVE (12 new tests fail pre-fix, 0 at 5c9a16f2). 2/2 APPROVE (both Tech Leads; mutation-tested). Merges alone at b8f43d08 in train 2; S-75 stacked on it is rejected separately. Train 2: cherry-picked onto main as 59118705. In train 2 release commit 5332bfc3 (v9.57.0), pushed 15:50:12Z (ls-remote verified); becomes released when publish-npm succeeds (D27). Correction 15:54: I had marked this released too early. Released in v9.57.0 (Release run 36331009098 publish-npm success). |
-| S-72 | Founder directive D25 part 6: `.claude/worktrees` holds 112 worktrees (~20GB) -- remove every worktree whose slice is merged/released/rejected/parked on BOARD.md after confirming its branch is fully merged (or its work is otherwise recorded), keep at most 10, and add a pulse violation for more than 15 worktrees | scripts/v10-pulse.sh (new violation only), a cleanup pass (not a code file -- direct git worktree operations, done carefully and verified per-worktree, not a blanket rm) | LOW | red: 112 worktrees exist today, no pulse violation fires above 15; green: worktree count is at or below 10 after a verified cleanup pass, and the new pulse violation fires correctly above 15 | released@2026-09-27T14:31Z | HIGH CARE REQUIRED: verify each worktree's branch tip is actually an ancestor of main (or its work is otherwise fully captured in a merged commit) via `git merge-base --is-ancestor` before removing it with `git worktree remove` -- never blanket-delete by directory listing alone, and never remove a worktree currently in active use by a running agent (cross-check against ListAgents' active subagents first). Cleanup done, no repo change: 64 worktrees removed with plain git worktree remove (no --force), 23G -> 11G (du -sh before/after), 30 merged branches deleted with branch -d. 71 remain; 10 not reachable safely: 27 hold commits not on main (git cherry + lines), 21 live or approved, 7 uncommitted edits, 4 created under 2h ago, 3 locked by this session. Pulse violation split to S-94. Classification: scratchpad/s72-classification.tsv. |
-| S-73 | Founder directive D26 guard 1: PreToolUse Bash guard hook (scripts/v10-guard.sh, wired via LOCAL-ONLY .claude/settings.local.json, never committed) blocking pkill/killall by name, git push --force/-f or reset --hard on main, git add -A/git add ., a BOARD.md commit dropping existing rows (the D18 incident), rm -rf outside safe roots, VERSION writes outside scripts/release.sh | scripts/v10-guard.sh (new), a fixture test file, .claude/settings.local.json (LOCAL ONLY -- must not be committed to the repo) | HIGH | red: each named dangerous pattern is currently allowed; green: each is blocked with exit 2 and a clear message, with one blocked-case and one allowed-case fixture per rule | released@2026-09-27T16:40Z | CRITICAL: .claude/settings.local.json is local machine config, never a repo file -- if it's gitignored confirm that; if not, add it to .gitignore as part of this slice, and never stage or commit it. The guard script itself (scripts/v10-guard.sh) IS a normal repo file and goes through review. Read the actual PreToolUse hook JSON contract (stdin format, exit-code semantics) from Claude Code's own hook documentation before implementing -- do not guess the interface. Built and committed 47179bb3 (25/25 fixtures). 2 opus HIGH reviewers dispatched 14:09. REJECT (HIGH reviewer 2): 6 reproduced gaps (git add -A never implemented; commit -am and git rm of BOARD.md pass rule 3; git -C checks the wrong repo; --force-with-lease=; xargs kill). Rework dispatched 14:17 from 47179bb3. Rework eb534e96: all 12 gaps from both HIGH reviews addressed (timeout/nice/sudo wrappers, shell keywords, RULE6 git add -A, -am, git rm/mv, git -C resolution, --force-with-lease=, xargs/bash -c unwrapping, VERSION by path, rm -rf of a root, heredoc false block, fail-closed on crash). 78/78, 14 mutations killed. Back with both original HIGH reviewers 14:51. Round 3 sent 14:57. Reviewer 1 REJECT (heredoc strip deletes the rest of the opener line: git commit -F - <<EOF && git push --force returns 0; rc was 2 at 47179bb3) and reviewer 2 CONCERN (kill redirect tokens read as PIDs; $(cat f)/xargs < f not source-checked; if/while/until missing from keywords). Round 3 fixes hold, but both HIGH reviewers REJECT: an unterminated heredoc marker (here-string <<<, a grep for "<<EOF", arithmetic with a space, # comments, CRLF, EOF-X) drops the rest of the command. Round 4 sent 15:16. Round 4 75bfa51d: 2/2 HIGH APPROVE (both reran every round-3 repro; about 190 commands diffed, 0 regressions, 0 false blocks). Cherry-picked db51311a..e9170698. Installed as a local PreToolUse hook in .claude/settings.local.json at 15:33; smoke test: pkill -f, push --force, git add -A and echo > VERSION rc=2; git status and kill PID 2>/dev/null rc=0. Follow-ups (non-blocking): quote state carried across lines; exact terminator whitespace. In train 2 release commit 5332bfc3 (v9.57.0), pushed 15:50:12Z (ls-remote verified); becomes released when publish-npm succeeds (D27). Correction 15:54: I had marked this released too early. Released in v9.57.0 (Release run 36331009098 publish-npm success). |
-| S-74 | Founder directive D26 guard 2: no subagents for trivial orchestration (commit messages, git status/clean checks, BOARD.md row updates, version/CI checks) -- these go through the orchestrator directly or a new scripts/v10-ops.sh, never a dispatched Agent call | scripts/v10-ops.sh (new, subcommands for the named trivial operations), docs/v10/CONTROL.md or SWARM.md (a short binding rule addition, if line budget allows) | MEDIUM | red: this session dispatched full subagents that spent 22 minutes/229k tokens writing a commit message and 16 minutes/182k tokens checking a clean tree (cited by the founder as observed incidents); green: the same operations are one-line orchestrator actions or v10-ops.sh subcommand calls, no Agent dispatch | released@2026-09-27T16:40Z | This is a PROCESS rule as much as a script -- the script gives the orchestrator a fast path, but the actual fix is behavioral (the Captain/PO/orchestrator role must stop dispatching subagents for these). Keep the script itself minimal: thin wrappers around git/gh one-liners, not a framework. Built and committed 94b8d3a6 (16/16 tests). 2 Tech Lead reviewers dispatched 14:09. CONCERN (reviewer 2): clean-check prints CLEAN and exits 0 when git status itself fails (reproduced). Rework dispatched 14:19 from 94b8d3a6. Round 2 d44a56d0: token allow-list, CRLF-preserving, atomic temp+replace, disk re-read with restore on mismatch (mutation-tested), clean-check exit 2 on git failure; 31/31. 2 re-reviewers dispatched 14:28. Re-review 1: all 6 prior blockers closed; 2 regressions from the atomic write (mode 644 -> 600, symlink replaced instead of written through). Round 3 sent 14:36. Round 3 e5dc3d28: re-reviewer 1 APPROVE; re-reviewer 2 CONCERN (fails closed): header-index lookup refuses the 30 real rows that have one fewer cell than their header. Round 4 sent 14:49 with a full-board sweep test. Round 4 9f8389b9: fallback cell locator for short or long rows, 79-row real-BOARD sweep, 48/48, mutation 34 red. Tech Lead re-review dispatched 14:56. Round 5 4ba139f6 (position rule). 1/1 APPROVE: independent 103-row sweep, 101 flips and 2 safe refusals (S-29, S-36), 0 wrong-cell writes; 52/52 under both shells. Cherry-picked 9ff5e41e..f1a26981. tests/test-v10-ops.sh 52/52 on main. In train 2 release commit 5332bfc3 (v9.57.0), pushed 15:50:12Z (ls-remote verified); becomes released when publish-npm succeeds (D27). Correction 15:54: I had marked this released too early. Released in v9.57.0 (Release run 36331009098 publish-npm success). |
-| S-75 | Founder directive D26 guard 3: per-role agent time budgets (LOW 15m, MEDIUM 30m, reviewer 30m, HIGH adversarial 60m, any shell command 10m under timeout, background long ones with a recorded PID) plus a new AGENT_OVER_BUDGET pulse violation | scripts/v10-pulse.sh (new violation), docs/v10/CONTROL.md or SWARM.md (the budget table itself, if line budget allows -- otherwise a new short reference doc), a fixture test | MEDIUM | red: an agent exceeding its tier's budget currently produces no violation and no automatic stop; green: AGENT_OVER_BUDGET fires when an agent's recorded runtime exceeds its tier's budget, with a fixture proving it (a synthetic over-budget record fires, an under-budget one does not) | released@2026-09-27T16:40Z | Coordinate file-set with S-71 (already merged locally, held for train 2) which also touches scripts/v10-pulse.sh -- rebase onto that commit first to avoid a conflict, since S-71 already restructured how violations are detected and named. Built 5c9a16f2, stacked on S-71 (must merge with or after it). 45/45 tests. HIGH-builder budget set to 60 min by symmetry, needs CEO confirmation. Reviewed together with S-71. Reviewer 1/2 APPROVE (S-75 delta isolated: 7 tests fail on S-71-only script). REJECT (reviewer 2): a malformed building@ timestamp (e.g. 2026-99-99T99:99Z) crashes the whole pulse (unguarded parse_time_value -> PULSE ERROR, no status block). Rework dispatched 14:21. Rework 339cd6aa: parse_time_value returns None on an impossible date; bad rows report UNKNOWN in both loops; 48/48 under 3 shells; T22/T23 go red without the guard. Re-reviewer dispatched 14:27. Re-review REJECT: guard only catches a bad month (calendar.timegm), so T24:61, day 99 and Feb 30 pass as parsed (false green or fabricated 300480-min violation). Round 2 sent to the same engineer 14:35. Round 2 f285c138: full-tuple datetime validation, T25-T28 (8 assertions) red on round 1, 56/56 under 3 shells. Back with the original re-reviewer 14:40. APPROVED: re-reviewer re-ran all 5 malformed-timestamp repros on f285c138, all UNKNOWN, no fabricated violation; 8 new assertions red on round 1; other callers fall back safely. Reviewer 1 approved the unchanged code. Merge the stack b8f43d08 (S-71) + 5c9a16f2 + 339cd6aa + f285c138 in train 2. HIGH-builder budget still assumed 60 min pending CEO. Train 2: cherry-picked as c16d875f/ceacd964/03c78213. Live in the main checkout pulse (flagged S-87/S-91 at 14:56). In train 2 release commit 5332bfc3 (v9.57.0), pushed 15:50:12Z (ls-remote verified); becomes released when publish-npm succeeds (D27). Correction 15:54: I had marked this released too early. Released in v9.57.0 (Release run 36331009098 publish-npm success). |
-| S-76 | Founder directive D26 guards 4-5: evidence-or-it-did-not-happen (a BOARD.md/PROGRESS.md/commit claim of verified/green/fixed/confirmed/no-fix-needed must cite the exact command and its exit code or output line) plus the new UNEVIDENCED_CLAIM pulse check over the last 20 doc changes, plus backfilling docs/v10/GUARDS.md with the 6 named incidents (D14/D15 pkill, D18 BOARD.md-emptied, CI self-cancellation/D25, pulse UNKNOWN-suppression/S-71, the hung worktree classifier, over-budget trivial agents) | docs/v10/GUARDS.md (new file), scripts/v10-pulse.sh (UNEVIDENCED_CLAIM check), a fixture test | MEDIUM | red: none of the 6 named incidents has a GUARDS.md entry today, and no pulse check flags an evidence-free claim; green: all 6 incidents have a 4-field GUARDS.md entry (incident, root cause with evidence, the guard, the test proving it fires) and each incident's guard+test genuinely already exists (cite them, do not invent new ones just to close the entry), plus UNEVIDENCED_CLAIM fires on a fixture claim with no cited command/exit-code | released@2026-09-28T01:11Z | For each of the 6 incidents, the guard it names must ALREADY EXIST (S-71's pulse fix, D25's cancel-in-progress fix once S-69 lands, this slice's own new evidence check, the worktree-classifier lesson likely just needs a documented timeout+batch-approach guard rather than new code) -- do not fabricate a guard reference that doesn't correspond to real code. Dispatched 15:00 (workflow wf_29a75a9c-652, slice-card brief). Built 30ed0f19 (GUARDS.md + UNEVIDENCED_CLAIM). Reviewer dispatched 15:16. REJECT: GUARDS.md claims the S-16 mode guard is merged (254c3c85 is only on a side branch); the regex counts a bare "exit" or a date as evidence. Rework sent 15:28. Rework 17bb5573: S-16 marked PENDING after merge-base checks; stricter evidence regex. Re-review dispatched 15:40. Re-review REJECT: stale PENDING for cherry-picked S-74/S-73; branch conflicts with the merged pulse changes. Rework sent 15:59: rebase, judge by patch-equivalence, add today's 5 incidents. Round 3 rebased, but it conflicts again with S-98 pulse changes; re-rebase dispatched 16:23. Rebased (60142fcf) and cherry-picked 69d2a81c..1040c082, pushed 16:29:53Z (ls-remote verified) without a version bump; ships with the next green release. Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| S-77 | Founder directive D26 guard 6: small, fresh subagent context -- a slice card of at most 60 lines (goal, file set, Wall checks, commands to run, budget) instead of full conversation history when dispatching a builder/reviewer | docs/v10/SWARM.md or CONTROL.md (the slice-card template and the binding rule that the orchestrator dispatches from it, not from raw history) | LOW | the swarm's own dispatch documentation names a concrete 60-line-max slice-card template and states the orchestrator keeps only CONTROL.md/pulse-block/BOARD.md in its own live view, deferring everything else to on-demand file reads | released@2026-09-27T16:40Z | This is primarily a documentation/process slice (the Agent tool's own dispatch prompts already tend toward focused briefs in this session's practice, per BOARD.md's own file-set-per-slice convention) -- codify the existing good practice into a named template rather than inventing new mechanics. Dispatched 15:00 (workflow wf_29a75a9c-652, slice-card brief). Built c437ea4a. Reviewer dispatched 15:16. CONCERN: test not registered in run-all-tests.sh. Rework sent 15:28. Rework 06648ac1: test registered. Re-review dispatched 15:40. 1/1 APPROVE. Train 4. Cherry-picked onto main for train 4 (2 commits); D27 checks green except tests/test-select-tests.sh, which hit the 60s cap (rc=124; CI runs it in full; reviewer ran 38/38). Train 4 release commit 08d64f4e (v9.59.0) pushed 16:07:02Z, ls-remote verified. Released in v9.59.0 (Release run 36332036567 publish-npm success; v9.58.0 itself never published, superseded). |
-| S-78 | CEO Part B: docs/v10/OPERATING-MODEL.md (verbatim), CLAUDE.md and AGENTS.md trimmed to <=150 lines with the @ import first, the rest moved to docs/dev/*.md with a removal ledger | docs/v10/OPERATING-MODEL.md, CLAUDE.md, AGENTS.md, docs/dev/*.md | LOW | wc -l limits met; cmp of OPERATING-MODEL.md against the CEO text is 0; every removed rule listed with where it moved or why it was deleted | released@2026-09-27T16:40Z | Engineer dispatched 14:09 (sonnet). Built 330bcafb: CLAUDE.md 756->150 lines, OPERATING-MODEL.md cmp-identical, 7 doc/regression suites pass. AGENTS.md is gitignored (local-only), so a 74-line draft waits for review before being applied to the main checkout; the live AGENTS.md still instructs pkill -f and rm -rf /tmp/loki-* (D14/D15 patterns). Reviewer dispatched 14:26. 1/1 on the commit: 45 MUST/NEVER rules traced to a home, 99 pointers resolve, no contradiction survives, cmp identical, 4 regression suites pass. The one blocker was in the uncommitted AGENTS.md draft (evidence rule relied on the @ import, unverified for non-Claude tools); fixed by adding it as literal text plus the harness invariants, then applied to the local-only AGENTS.md (542 -> 80 lines, live pkill -f and git add -A instructions gone; backup in TMPDIR). Commit 330bcafb ships in train 2. Train 2: e481bab5. CLAUDE.md conflict was only main's v9.56.0 version line; S-78 text taken (no test reads that line: grep of tests/, scripts/ and workflows found 0). In train 2 release commit 5332bfc3 (v9.57.0), pushed 15:50:12Z (ls-remote verified); becomes released when publish-npm succeeds (D27). Correction 15:54: I had marked this released too early. Released in v9.57.0 (Release run 36331009098 publish-npm success). |
-| S-79 | CEO Part C item 1: size the argmax fixture on Linux to max(4000, 2*131072/72) (MAX_ARG_STRLEN, not ARG_MAX), replace per-item subshells in autonomy/loki, drop the 2400s override, full-scale fixture to nightly | tests/test-ci-json-argmax.sh, autonomy/loki (two sites), tests/run-all-tests.sh (override only) | HIGH | at the parent of b842a332, on Linux, the smaller fixture still exits rc=126; passes on the fixed tree | released@2026-09-27T16:40Z | Engineer dispatched 14:09 (sonnet). Saves 17-23 min per Tests run. Built and committed 81c52fcb: Linux argmax suite 383 ms (was about 22 min); required Wall check reproduced (b842a332^ = ef218d74: small fixture still exits 126; fixed tree passes 3/3). Full scale weekly in integrity-audit.yml. Override removal is in the same commit. 2 opus HIGH reviewers dispatched 14:49 (incl. 64K-page arm64 MAX_ARG_STRLEN check). Merge before or with S-81. Reviewer 2 APPROVE, reviewer 1 CONCERN (hardcoded 4K-page ceiling; the weekly run behind continue-on-error). Round 2 sent 15:12: restore the full-scale fixture (4-9s now). Round 2 28e6b605: full fixture restored everywhere, knob and workflow change reverted, fork removal kept; docker arm64: pre-fix exit 126 (326s), post-fix 3/3 in 7.1s. Re-review by reviewer 1 dispatched 15:40. Round 2 28e6b605: reviewer 1 APPROVE (pre-fix exit 126 at 329s; post-fix 3/3 in 4.3s, and 8.9s at ARG_MAX 4 MiB; diff vs c31cb1e8 touches only loki and run-all-tests.sh). Reviewer 2 approved round 1 and recommended exactly this change. 2/2. Ships with S-81 in train 3. Train 3: caf4bc2f+469db2b4, release commit c2eccb21 (v9.58.0) pushed 15:53:26Z, ls-remote verified; released when publish-npm succeeds. Released in v9.59.0 (Release run 36332036567 publish-npm success; v9.58.0 itself never published, superseded). |
-| S-80 | CEO Part C item 2: per-SHA concurrency group on push, cancel only on PRs, in test.yml, bun-parity.yml, security-audit.yml | the three concurrency blocks | MEDIUM | a push to main never cancels or supersedes a main run; PRs still cancel their own stale runs; verified by one real push | released@2026-09-27T16:40Z | Built 3bd01787. 2 Tech Lead reviewers dispatched 14:12. Supersedes S-69. 2/2 APPROVE (Tech Leads). Follow-up, non-blocking: a weekly cron and a release push landing on the same SHA would queue, not cancel; strictly narrower than before. Ships in train 2; Release Manager verifies with one real push. Train 2: d5d6bfa7. The train 2 push is its one real-push verification. In train 2 release commit 5332bfc3 (v9.57.0), pushed 15:50:12Z (ls-remote verified); becomes released when publish-npm succeeds (D27). Correction 15:54: I had marked this released too early. Released in v9.57.0 (Release run 36331009098 publish-npm success). |
-| S-81 | CEO Part C item 4: 8 shards balanced by measured duration, checked-in duration table, 5 heavy suites in distinct shards | test.yml shell-tests matrix, run-all-tests.sh shard selection, tests/shard-durations table, tests/test-shard-coverage.sh, docs/v10/METRICS.md | MEDIUM | test-shard-coverage.sh proves every suite runs exactly once at n=8; projected max shard reported | released@2026-09-27T16:40Z | Engineer dispatched 14:09 (sonnet). Supersedes S-70. Built dd08f821: duration table for all 496 suites (one CI run), greedy longest-first packing, LOKI_TEST_LIST mode, 17/17 coverage tests incl. n=8. Projected max shard 197s vs 451s today. Reviewers told to recompute the "all 8 exactly 197s" claim themselves. 2 dispatched 14:33. 2/2 APPROVE. Reviewer 1 recomputed the 8 shard totals from the table: 197s each, true; exactly-once at n=4 and n=8; deterministic across bash 5, bash 3.2 and mawk. The 197s assumes S-79 shrinks argmax (real today 1186s, which would sit alone in one shard at about 19.8 min); a second CI sample moves the max shard to 240s. MERGE ORDER: S-79 and S-81 in the same train, S-79 first. Follow-ups: no drift detector for the duration table; T4 recomputes a static count instead of driving the runner. Train 3: 46fdd376, release commit c2eccb21 (v9.58.0) pushed 15:53:26Z, ls-remote verified; released when publish-npm succeeds. Released in v9.59.0 (Release run 36332036567 publish-npm success; v9.58.0 itself never published, superseded). |
-| S-82 | CEO Part C item 6: timeout-minutes 10 on shell, python, node, bun jobs in test.yml | test.yml job-level timeout-minutes only | LOW | every listed job has timeout-minutes 10 | released@2026-09-27T16:40Z | Built 22e1bd4d. Reviewer dispatched 14:12. MERGE HELD until S-79 and S-81 land and a real run shows every shell shard under 10 min. 1/1 APPROVE. Data: shards 0 and 2 run up to 30 min today; python/bun/node max 5m21s. MERGE HELD until S-79 and S-81 land and a real run shows every shell shard under 10 min. Train 3: babfd814 (conflict with S-81 comments resolved by keeping both), release commit c2eccb21 (v9.58.0) pushed 15:53:26Z, ls-remote verified; released when publish-npm succeeds. Released in v9.59.0 (Release run 36332036567 publish-npm success; v9.58.0 itself never published, superseded). |
-| S-83 | CEO Part C item 7: update-homebrew needs only [release] | release.yml update-homebrew needs line | LOW | job reads only needs.release outputs | released@2026-09-27T16:40Z | Built 53251c1b in 40s. Reviewer dispatched 14:11. release.yml change ships in its own train (D22). 1/1 APPROVE (Tech Lead): only needs.release outputs used; Homebrew asset is the hash-verified GitHub Release tarball, so npm/Docker failures cannot break it. Advisory: channels may now differ in version briefly. Ships in its own train (D22). Train 3: 754d0d99, release commit c2eccb21 (v9.58.0) pushed 15:53:26Z, ls-remote verified; released when publish-npm succeeds. Released in v9.59.0 (Release run 36332036567 publish-npm success; v9.58.0 itself never published, superseded). |
-| S-84 | CEO Part C items 3+5: release verdict reuse (required-ci accepts the parent's success when parent..release touches only version-bump files; select the completed successful run, not head -1 at :143; update the promise comment at :89-93) and drop needs: gate from required-ci plus gate's duplicate pytest | release.yml required-ci and gate jobs only | HIGH | a VERSION-only bump on a verified parent releases without a new Tests run; any non-allowlisted file in parent..release forces a full verdict; loki-ts/dist changes qualify only if the diff is version-string-only | released@2026-09-28T01:11Z | Loki-approved. release.yml: ships in its own train (D22). Built 6f71e7d1 (harness drove the real required-ci script: 5/5 cases; builder caught its own debugId substring bug). Only 2 of the last 8 release commits would qualify (the rest also touched docs/wiki/docs-v10; v9.56.0 dist had stale-build rename noise). Release process must therefore make the bump commit pure, on a dist-fresh verified parent. 2 opus HIGH reviewers dispatched 14:47. Own train (D22). HIGH reviewer 2 REJECT: only dist/loki.js is content-checked; package.json files[] drop, import-time code in mcp/__init__.py and a Dockerfile RUN line all released on the parent verdict even with the release SHA Tests red. Goal case (0.33s) and all 13 error paths fail closed are verified. Round 2 sent 14:53: version-only compare on every allowlisted file, and a red run at the release SHA always fails. HIGH reviewer 1 also REJECT with the same 2 findings plus loki.js.map; addendum sent with their 18-scenario harness. Round 2 c22503dd: every allowlisted file content-checked (CHANGELOG exempt), red run at release SHA fails, .map dropped, 4 wiki/docs files added; 18-scenario harness matches. Builder claims reuse rarely fires (non-deterministic loki.js); contradicts my earlier determinism check, so reviewers must measure it. 2 HIGH re-reviewers dispatched 15:12. Round 2: reviewer A REJECT (line splitting hides \r/U+2028 swaps; a Dockerfile USER line dropped, the image runs as root, confirmed by docker build), reviewer B CONCERN (cancelled counted as failure). Both measured the build as deterministic; reuse fails because of the map debugId plus a stale parent dist. Round 3 sent 15:14. Round 3 55abbebd+f14b2f6e: raw-byte compare, fixed decision order, map JSON compare, semver, --raw modes, CHANGELOG insert-only; 25/25; real b651b98d replay ELIGIBLE with a fresh parent dist. 2 HIGH re-reviewers dispatched 15:34. Round 3 verified by both HIGH reviewers (code), but the tests never drive the real poll loop: reordering branches keeps 25/25 green (reproduced). Round 4 (tests only, plus a leading-zero semver fix) sent 15:43. Round 4 fdf36a33: tests drive the real poll loop (6 scenarios); both reviewer mutants now go red; one test each for map, --raw, NUL and trailer; semver rejects leading zeros; 28/28; b651b98d replay still ELIGIBLE. Train 5 (1cde81a7), round 4 not re-reviewed (founder instruction). Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| S-85 | CEO Part C item 8: Docker arm64 on a native ubuntu-24.04-arm runner instead of QEMU (release.yml:665-687); no gha cache in publish jobs (:54-56) | release.yml publish-docker job and cache config | MEDIUM | multi-arch image still published for amd64 and arm64; publish jobs restore no cache | released@2026-09-27T16:40Z | release.yml: own train (D22). Different region from S-84 and S-83. Built and committed d8f98328 (native amd64/arm64 by digest plus manifest merge job, qemu removed, cache-binary false; provenance 11/11, SBOM 9/9, P9 4/4). 2 reviewers dispatched 14:29. Own train (D22). 2/2 APPROVE. Manifest-digest technique checked against a real multi-arch index (alpine:latest): sha256 of imagetools --raw equals the registry index digest. Missing arch fails closed (needs + count guard). Non-blocking: stale comment in publish-npm names publish-docker for the dist assert (now in publish-docker-build). Only a real release proves the arm64 runner and timing. Train 3: 3a372c8e, release commit c2eccb21 (v9.58.0) pushed 15:53:26Z, ls-remote verified; released when publish-npm succeeds. Released in v9.59.0 (Release run 36332036567 publish-npm success; v9.58.0 itself never published, superseded). |
-| S-86 | CEO Part C item 9: pytest -n auto (test.yml:73), all 4 Python versions still required; fix any order-dependent tests it exposes | test.yml python job, the tests it exposes | MEDIUM | python job wall time drops; 4 versions still required; no test skipped to get green | released@2026-09-27T16:40Z |  Built 0b82b63e: python suite 261.9s serial -> 79-82s with -n auto (14 cores, 3 runs, identical counts 3469/22); one racy test given a private TMPDIR, assertion unchanged. 2 reviewers dispatched 14:37 (asked to verify at -n 4, the CI core count). 2/2 APPROVE: assertion mutation-tested (still red when the tool leaks a scratch dir); no other shared-tempdir hazards; -n 4 x3 deterministic (109-121s on 14 cores). Follow-ups: local-ci/pre-push still serial; pytest-xdist unpinned (matches file convention). Train 2: 6c35aac0. In train 2 release commit 5332bfc3 (v9.57.0), pushed 15:50:12Z (ls-remote verified); becomes released when publish-npm succeeds (D27). Correction 15:54: I had marked this released too early. Released in v9.57.0 (Release run 36331009098 publish-npm success). |
-| S-87 | CEO Part C item 10a: remove built-in waits (review-tail stub blocks on a FIFO and drop the 4x scale at :388-390; mock vectors setup in test-e2e-features.sh:344; go-gate stub sleep 60 to 2s; test-dashboard-multiproject.sh:160 poll instead of sleep 25; pytest-gate fixture sleep 10 to 1) | the named test files only | MEDIUM | each named suite is faster, measured before and after; none weakened (mutation check per change) | released@2026-09-27T16:40Z | OVER BUDGET 14:56 (33.5 min vs 30): told to stop and commit; the rest gets re-sliced. Committed 7935ed68 (worktree-agent-a6e52768add598d70) at 38 min, over budget: 4 of 5 waits cut (go-cargo 24.9s to 12.9s, pytest-gate 13.3s to 2.0s, multiproject 27.3s to 16.9s, e2e 26.6s to 22.2s; each mutation-checked). Remainder re-sliced as S-95. MEDIUM review (with a load-flake check) dispatched 15:05. 1/1 APPROVE: 4 mutations red; 12 runs under 4-way CPU load, 0 flakes. Cherry-picked 11c9df0c. In train 2 release commit 5332bfc3 (v9.57.0), pushed 15:50:12Z (ls-remote verified); becomes released when publish-npm succeeds (D27). Correction 15:54: I had marked this released too early. Released in v9.57.0 (Release run 36331009098 publish-npm success). |
-| S-88 | CEO Part C item 10b: parallelize moat P6, P9 and P5 internally | tests/moat/p6-*.sh, p9-rule-of-two.sh, p5-*.sh | MEDIUM | moat suite wall time drops; same cases, same verdicts | released@2026-09-27T18:12Z | SEQUENCING: p9-rule-of-two.sh is in S-18's file set; start only after S-18 merges. Batch 1 (build then review), dispatched 17:06. Train 5, pushed 51ae52fe at 17:52:16Z (ls-remote verified); approved by review. S-88: P9 4/4 in 43s (was about 90s). S-130: web-app dist rebuilt. S-111: pytest -n auto back on after S-102. Released in v9.66.0 (release commit 0a69d19b, pushed 18:03:32Z). |
-| S-89 | CEO Part C item 11: pip and bun install caches on read-only test jobs | test.yml cache steps only | LOW | cache hits on a second run; never on a job holding a write token or publish secret (P9) | released@2026-09-27T16:40Z | Dispatched 15:00 (workflow wf_29a75a9c-652, slice-card brief). Built e85a23d4. Reviewer dispatched 15:16. CONCERN: the fixed -A5 permissions window misses a late contents: write. Rework sent 15:28 (parse the YAML). Rework ab32c540: YAML-parsed permissions, 15/15. Re-review dispatched 15:40. 1/1 APPROVE. Train 4. Cherry-picked onto main for train 4 (2 commits); D27 checks green except tests/test-select-tests.sh, which hit the 60s cap (rc=124; CI runs it in full; reviewer ran 38/38). Train 4 release commit 08d64f4e (v9.59.0) pushed 16:07:02Z, ls-remote verified. Released in v9.59.0 (Release run 36332036567 publish-npm success; v9.58.0 itself never published, superseded). |
-| S-90 | CEO Part C item 12: move bun=latest, macOS bun and hyperfine to nightly (test.yml:303-312, 390-400) | test.yml those jobs, a nightly workflow | LOW | those jobs no longer run on push; they run on a nightly schedule | released@2026-09-27T16:40Z |  Built 93482497 (bun matrix 4->1 on push; nightly.yml runs the other 3 plus hyperfine). Reviewer dispatched 14:24. 1/1 APPROVE. Non-blocking: release gate now requires only the pinned bun combo (intended); hyperfine no longer runs for the pinned combo anywhere; macOS-only branches in a few test files now run nightly only. Train 2: 329882d7. In train 2 release commit 5332bfc3 (v9.57.0), pushed 15:50:12Z (ls-remote verified); becomes released when publish-npm succeeds (D27). Correction 15:54: I had marked this released too early. Released in v9.57.0 (Release run 36331009098 publish-npm success). |
-| S-91 | CEO Part C item 13: Tier A diff-selected tests with selection rules R0-R7; anything touching tests/lib, run-all-tests.sh, package.json, requirements*, loki-ts/dist, VERSION or .github/workflows runs everything | a selection script, a Tier A workflow or job | MEDIUM | Tier A finishes in 2 min or less on a typical change; the run-everything triggers are honored; Tier A never replaces Tier B | released@2026-09-27T16:40Z | OVER BUDGET 14:56 (33.5 min vs 30): told to stop and commit; the rest gets re-sliced. Committed cb8ddb07 at 39 min (over budget): R0-R7 done, 29/29, P9 4/4 on tier-a.yml, real-commit runs 25s/86s/5s. Remainder re-sliced as S-96. Tech Lead review dispatched 15:08. REJECT: the .py-suffixed grep misses Python imports (workspace_diff.py, fast_verify.py moat miss); R5 targets tests/dashboard only; no legacy-ui rule. Round 2 sent 15:23. Round 2 52a58e86: import needles, legacy-ui rule, node match kind; 38/38. Re-review dispatched 15:46. Round 2: 1/1 APPROVE (all 4 misses reproduced as fixed, 38/38, shellcheck clean). Advisory: generic stems (base.py) over-select (bloat, not a miss). Train 4. Cherry-picked onto main for train 4 (3ee19595+10090cd3); D27 checks green except tests/test-select-tests.sh, which hit the 60s cap (rc=124; CI runs it in full; reviewer ran 38/38). Train 4 release commit 08d64f4e (v9.59.0) pushed 16:07:02Z, ls-remote verified. Released in v9.59.0 (Release run 36332036567 publish-npm success; v9.58.0 itself never published, superseded). |
-| S-92 | CEO Part C item 14: tests/quarantine.txt (suite, owner, expiry max 7 days, issue); quarantined suites still run but do not block; moat and review suites can never be quarantined; no retry loops | tests/quarantine.txt, tests/run-all-tests.sh (quarantine handling) | LOW | a listed suite's failure is reported but non-blocking; an expired or moat entry is rejected | released@2026-09-28T01:11Z | SEQUENCING: after S-79 and S-81 merge (same runner file). Dispatched 15:49 on top of S-79+S-81. Train 7 (release 9218ea04, v9.62.0, pushed 16:29:17Z, ls-remote and tag ^{} verified), unreviewed (founder "release everything"). The v9.62.0 Release run was cancelled at 16:30 (the tree carries the S-18 P9 regression). Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| S-93 | CEO Part C item 15: the 38 unregistered test files: register each or delete it with a reason | tests/run-all-tests.sh registrations, the files | LOW | zero unregistered test files; each deletion has a stated reason | released@2026-09-28T01:11Z | SEQUENCING: after S-79 and S-81 merge (same runner file). Dispatched 15:49 on top of S-79+S-81. Train 7 (release 9218ea04, v9.62.0, pushed 16:29:17Z, ls-remote and tag ^{} verified), unreviewed (founder "release everything"). The v9.62.0 Release run was cancelled at 16:30 (the tree carries the S-18 P9 regression). Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| S-94 | Worktree follow-up: triage the 27 worktrees whose branches hold commits not on main (merge, record in BOARD, or discard with a reason), check the 3 with an uncommitted edit to tests/moat/p7-no-fabricated-data.sh, and add a pulse violation for more than 15 worktrees | scripts/v10-pulse.sh, tests/test-v10-pulse.sh (violation only); triage is a Captain decision per branch | LOW | worktree count at or below 10 with no unmerged work lost; the new violation fires above 15 with a fixture | released@2026-09-27T17:53Z | SEQUENCING: the pulse change waits for S-75 (same file). Triage list: scratchpad/s72-classification.tsv. Dispatched 15:00 (workflow wf_29a75a9c-652, slice-card brief). Built ad60e018 (WORKTREE_COUNT violation). Reviewer dispatched 15:16; worktree triage still pending (orchestrator). CONCERN: git merge-tree with S-76 (30ed0f19) conflicts in both files (adjacent inserts). Rebase onto S-76 after its rework lands. Back to ready: ad60e018 must be rebuilt on main after S-109 lands (both edit v10-pulse.sh); fold WORKTREE_COUNT in then. Batch 1 (build then review), dispatched 17:06. In v9.65.0 (release commit 0103adfa, pushed 17:45:33Z; required-ci success). |
-| S-95 | S-87 remainder (CEO Part C item 10): tests/test-review-assurance-tail.sh, which did not finish in 120s on its own (rc=124). Replace the DA-block poll with a FIFO wake, check for orphaned sleep 30/120 children, and drop the 4x LOKI_TEST_SHARD scale only if it is proven safe under 4-way contention | tests/test-review-assurance-tail.sh only | MEDIUM | the suite finishes under 60s alone and under 4-way load 3 times in a row; mutating the code under test still turns it red | released@2026-09-28T01:11Z | Known load-flaky (memory: review-assurance-tail). Measure before optimizing. Dispatched 15:49. Train 7 (release 9218ea04, v9.62.0, pushed 16:29:17Z, ls-remote and tag ^{} verified), unreviewed (founder "release everything"). The v9.62.0 Release run was cancelled at 16:30 (the tree carries the S-18 P9 regression). Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| S-96 | S-91 remainder: re-collect the last-10-main-code-commits Tier A selection report (time and selected tests per commit), add bun/pip/npm install caches to tier-a.yml, and set an explicit timeout-minutes on its R0 full-suite path | .github/workflows/tier-a.yml, docs/v10/METRICS.md | LOW | the METRICS.md table shows 10 real commits each under 120s or labeled R0; caches never on a job with write permissions or secrets (P9) | released@2026-09-27T18:55Z | After S-91 merges. Batch 1 (build then review), dispatched 17:06. Review CONCERN/REJECT; rework plus re-review dispatched 17:49 (workflow wf_b1414df6-a66) with the reviewer findings. Rework re-review APPROVE (workflow wf_b1414df6-a66); train 6 pushed 0bd45144 at 18:10:14Z (ls-remote verified). Released in v9.67.0 (release commit 7f470727; publish-npm success). |
-| S-97 | D27 item 2: .githooks/pre-push becomes identity check + bash -n + red-main warning only; remove the pytest run; target under 5s; update docs/dev/release-checklist.md to retire the local-CI mandate | .githooks/pre-push, its test, docs/dev/release-checklist.md | LOW | the hook finishes under 5s on this repo (timed 3x); a wrong identity and a bash -n error still block; no pytest invocation remains | released@2026-09-28T01:11Z | Train 3. Built b72e9ab7: hook runs in 0.78-0.89s (3 runs), 7/7, 4 mutations red. Review dispatched 16:07. Train 5 (1cde81a7), unreviewed (founder instruction). Live: the tag push at 16:25 ran only the identity and bash -n checks. Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| S-98 | D27 items 3 and 6: TRAIN_LATE pulse violation (more than 25 min since the last train push while merged-unreleased commits exist) and a push helper in scripts/v10-ops.sh that pushes without a pipe and succeeds only when git ls-remote equals HEAD | scripts/v10-pulse.sh, scripts/v10-ops.sh, their tests | LOW | fixtures: TRAIN_LATE fires at 26 min with an unreleased merge and not at 24 min or with none; the push helper returns non-zero when the remote does not match | released@2026-09-28T01:11Z | Train 3. Last train push time comes from git reflog or the push log, not the release tag. Built b44571ba: pulse 61/61, ops 60/60, mutations red. Review dispatched 16:07. Train 5 (1cde81a7), unreviewed (founder instruction). Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| S-99 | S-73 follow-ups (non-blocking review findings): carry quote state across lines in strip_heredocs; exact terminator whitespace; a quoted ">" must not hide an rm target; sed -i, cp, tee, perl -pi or python open() writes to BOARD.md chained before a commit set the pending flag | scripts/v10-guard.sh, tests/test-v10-guard.sh | MEDIUM | each reviewer repro becomes a blocked fixture; no everyday command becomes blocked | released@2026-09-27T18:55Z | Repros in the S-73 round 3 and 4 reviews. Batch 1 (build then review), dispatched 17:06. Review CONCERN/REJECT; rework plus re-review dispatched 17:49 (workflow wf_b1414df6-a66) with the reviewer findings. Rework re-review APPROVE (workflow wf_b1414df6-a66); train 6 pushed 0bd45144 at 18:10:14Z (ls-remote verified). Released in v9.67.0 (release commit 7f470727; publish-npm success). |
-| S-100 | S-18 follow-up (reviewer A F1): record the origin URL before the first agent iteration and refuse the trusted push if it changed; also refuse the repo default branch, not just main and master | autonomy/run.sh (trusted push only), a test | HIGH | an agent that repoints origin to another github.com repo gets a refused push with a visible warning | released@2026-09-27T18:55Z | After S-18 merges. Batch 1 (build then review), dispatched 17:06. Review CONCERN/REJECT; rework plus re-review dispatched 17:49 (workflow wf_b1414df6-a66) with the reviewer findings. Rework re-review APPROVE (workflow wf_b1414df6-a66); train 6 pushed 0bd45144 at 18:10:14Z (ls-remote verified). Released in v9.67.0 (release commit 7f470727; publish-npm success). |
-| S-101 | D27 follow-up: scripts/release.sh --bump-only (no prompt, no commit, no push) that bumps every checklist file and rebuilds loki-ts/dist, so the Release Manager no longer edits VERSION with the editor tool | scripts/release.sh, tests/test-release-sh.sh | LOW | --bump-only bumps all 13 files and the dist version and exits without git side effects (asserted via git status and git log in a temp repo) | parked@2026-09-27T16:35Z | Ends the D27 VERSION exception. Superseded by S-108. |
-| S-102 | P0 fix-forward: tests/dashboard/test_build_supervisor.py fails intermittently under pytest -n auto (S-86) with "provider attempt lineage marker is unavailable" (rc 127), raised at autonomy/lib/deadline.py:415. Hit Python 3.11+3.12 on 89e350bd and 3.10+3.11 on c2eccb21 (train 3 Tests run 36331204715, so required-ci failed); identical code passed on 5332bfc3 | autonomy/lib/deadline.py and/or tests/dashboard/test_build_supervisor.py | HIGH | reproduced in Linux docker with -n 4 before the fix; 0 failures over at least 3x the runs after; no assertion loosened, no retry | released@2026-09-28T01:11Z | Dispatched 16:06 (opus). Train 3 failed jobs rerun at 16:05:48Z. Still running; its container s102-repro-a167 was capped at 16:30 (--cpus 2, 4g, restart=no). pytest -n auto reverted on main (b01bd36c) meanwhile. Real product race: spawn_tracked read /proc/<pid>/environ before exec finished (empty environ on a live child: 4/2000 idle, 22/2000 loaded). Fix 157dc713 (a ready byte after exec, 30s cap, fail closed). Linux, -n 4, 2x load: 20/20 runs failed before, 0/30 after; direct launches 54/1000 failed before, 0/3000 after. Cherry-picked onto main 16:57. Item 9 (-n auto) can return. Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| S-103 | Founder directive: tests and agent runs are headless; no code path opens a browser to the dashboard when LOKI_NO_BROWSER=1, CI, a test marker or a non-TTY holds; every test runner exports LOKI_NO_BROWSER=1 | autonomy/run.sh, autonomy/loki (open sites), loki-ts/src if any, tests/run-all-tests.sh, a guard test | MEDIUM | a stub open on PATH records zero calls under every runner; a grep test proves every open site uses the guard | released@2026-09-28T01:11Z | Dispatched 16:23 after dozens of stray "Loki Mode" Chrome tabs. a9792295 cherry-picked as 03d5b515 plus a dist rebuild (11c302bf), pushed 16:34:08Z (ls-remote verified). Cause of the tabs: loki migrate opened its dashboard on port 57376 with a bare open. One guard, loki_browser_allowed/loki_open_url; LOKI_NO_BROWSER=1 in every runner; tests/test-browser-open-guard.sh 15/15. Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| S-104 | Founder report: the UserPromptSubmit pulse hook timed out at 15s and the ponytail hook at 5s under load. Make scripts/v10-pulse.sh finish under 5s with a cached, background-refreshed network layer and hard 3s timeouts; report the ponytail fix | scripts/v10-pulse.sh, scripts/v10-drift-audit-counter.sh, tests | MEDIUM | pulse under 5s under load (timed); a cached run makes no network call; stale values are labeled stale | released@2026-09-27T17:53Z | Stopgap: local hook timeout raised 15 to 45s at 16:24 (settings.local.json, not committed). 5d60a2a8: pulse 2.18s to 0.20s from cache, 64/64. Conflicts with S-76 (T30) on main; S-109 builds on it and resolves. Hook timeout stopgap is 45s locally; the agent recommends 10s after it lands. Ponytail hook: the plugin hooks.json already says 20s (edited today 12:20); sessions started earlier still use 5s; an override outside the plugin cache would survive updates. Being rebased onto main together with S-109 (dispatched 16:48). Cherry-picked (b0f22616) and pushed in cc105687 at 17:05:47Z (ls-remote verified); tests/test-v10-pulse.sh 78/78 on main. In v9.64.0 (Release run 36337270762: publish-npm success). |
-| S-105 | Release job cannot push its tag when the release changes workflow files: "refusing to allow a GitHub App to create or update workflow .github/workflows/release.yml without workflows permission"; it logs "continuing", then gh release create fails ("tag v9.57.0 exists locally but has not been pushed"). Make the tag step fail loudly and document that the Release Manager pre-pushes the tag, or use a token with workflows permission | .github/workflows/release.yml (tag step) | HIGH | a rejected tag push fails that step with a clear message; a pre-pushed tag is detected and reused | released@2026-09-27T17:53Z | Worked around at 16:25: v9.57.0..v9.61.0 pushed by the Release Manager (ls-remote verified), train 2 Release fully rerun. Evidence: Release run 36331009098 release-job log line 5126 "! [remote rejected] v9.57.0 ... without workflows permission" and line 5171 "tag v9.57.0 exists locally but has not been pushed". Batch 1 (build then review), dispatched 17:06. In v9.65.0 (release commit 0103adfa, pushed 17:45:33Z; required-ci success). |
-| S-106 | tests/test-runtime-gate-port-scoping.sh positive control races its own background listener ("lsof cannot enumerate the own-tree decoy listener"); failed shard 0 in train 1 and train 4. Wait for the port to be LISTENing before the positive control | tests/test-runtime-gate-port-scoping.sh | LOW | 20/20 green in Linux docker under 4-way load; the positive control still fails when the listener never starts | released@2026-09-27T17:53Z | Test race, not product code. Suite quarantined until 2026-10-03 (ea8ecf1c); the fix is still needed before expiry. Evidence: Tests run 36332036570, shard 0/8 job 108655699267: "FAIL: positive control failed: lsof cannot enumerate the own-tree decoy listener", "RESULT: 9 passed, 1 failed". Batch 1 (build then review), dispatched 17:06. In v9.65.0 (release commit 0103adfa, pushed 17:45:33Z; required-ci success). |
-| S-107 | P0 moat regression from S-18 (train 5): P9.injection-cannot-reach-token fails on Linux CI only in the opt-out positive control ("the hosts.yml probe is blind under the opt-out"); fails closed but blocks every tree from 1cde81a7 | autonomy/run.sh and/or loki-ts/src/runner/github_token.ts (opt-out path) | HIGH | red then green in a capped Linux container; P9 4/4 in Linux; nested and trusted-push suites still pass | released@2026-09-28T01:11Z | Dispatched 16:31 (opus, docker --cpus=2 --memory=4g). Root cause in the test harness: the GitHub ubuntu runner sets XDG_CONFIG_HOME, so gh ignored the planted $HOME/.config/gh/hosts.yml; only the opt-out leg (no GH_CONFIG_DIR override) noticed. The default and hosts-only checks were false greens on CI. Fix 445efcba (cherry-picked as 298f027e, pushed 16:43:06Z, ls-remote verified) unsets XDG_CONFIG_HOME and GH_CONFIG_DIR per scenario. Linux container with XDG set: before 3/4, after 4/4 CASE PASS; a product mutation now turns default and hosts-only red. No assertion changed. Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| S-108 | D28: scripts/release.sh --bump-only (no prompt, commit or push; bumps 13 files and rebuilds dist) plus a guard that refuses any bump unless Tests and Bun Parity are completed-success for HEAD SHA | scripts/release.sh, tests/test-release-sh.sh | MEDIUM | red, no-run and other-SHA cases refuse with exit 3 and no file changed; green bumps; --bump-only leaves no git side effects | released@2026-09-28T01:11Z | Replaces S-101 and ends the D27 VERSION exception. f5f5f6cf cherry-picked as a537bb22: RELEASE_ON_RED gate (Tests and Bun Parity completed-success for HEAD SHA, else exit 3) and --bump-only; tests/test-release-sh.sh 28/28 on main. Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| S-109 | D28: pulse violations HIGH_LOAD (load > 28), ORPHAN_TEST (tests/* process with PPID 1 or etime > 30 min), STRAY_CONTAINER (swarm container older than 1h or with a restart policy), RELEASE_ON_RED (newest VERSION bump whose Tests failed), built on S-104 | scripts/v10-pulse.sh, tests/test-v10-pulse.sh | MEDIUM | fire and no-fire fixture per violation; pulse under 1s from cache | released@2026-09-27T17:53Z | Must resolve the S-76 T30 test-number collision with S-104. First build stopped on the S-104/S-76 T30 collision (as instructed). Re-dispatched 16:48: rebase S-104, then S-109. Cherry-picked (0986ab39) and pushed in cc105687 at 17:05:47Z (ls-remote verified); tests/test-v10-pulse.sh 78/78 on main. In v9.64.0 (Release run 36337270762: publish-npm success). |
-| S-110 | Fix the 3 suites S-93 newly registered that fail on CI (quarantined until 2026-10-03): test-add-dir-reaches-provider.sh (--add-dir never reaches the provider argv; possibly a real product defect), test-static-analysis-tsconfig.sh (tsc -p . fails on a path-aliased import on CI), test-doctor-json-skills.sh | the three suites and the code each exercises | MEDIUM | each passes on Linux CI (or is deleted with a stated reason) and its quarantine entry is removed | released@2026-09-27T18:12Z | Evidence: Tests run 36334599806, jobs 108662926880 and 108662926920. Batch 1 (build then review), dispatched 17:06. Train 4, pushed 08e4a7d4 at 17:48:38Z (ls-remote verified); approved by review (1/1; HIGH for S-116). P2.council-inconclusive-cannot-exit-zero removed from pending.txt (proven). Quarantine list now empty. Released in v9.66.0 (release commit 0a69d19b, pushed 18:03:32Z). |
-| S-111 | Part C item 9 returns: CI python suite runs pytest -n auto again after S-102 | .github/workflows/test.yml, requirements-test.txt | LOW | 10 of 10 capped-container runs of test_build_supervisor.py with -n 4 under load, 0 failures | released@2026-09-27T18:12Z | Train 5 (51ae52fe). Released in v9.66.0 (release commit 0a69d19b, pushed 18:03:32Z). |
-| S-112 | P8 pending: ablation producer writing .loki/quality/ablation.json (load_bearing / not_load_bearing / not_applicable) | autonomy/lib/ablation.py, tests/test-ablation.sh | HIGH | wall check in docs/v10/ARCHITECT-CUTS.md (17:10Z cut) | parked@2026-09-27T20:00Z | RISKY: rewrites the user working tree in place; needs restore-on-signal. Not wired into run.sh (BACKLOG 34). Held. Held for a CEO decision (P3/P4/P8 moat scope), not dispatchable until then. |
-| S-113 | P8 pending: proof-generator copies ablation.json into facts.ablation; never VERIFIED when not_load_bearing | autonomy/lib/proof-generator.py (collector and _compute_headline), tests/test-proof-ablation-headline.sh | HIGH | wall check in docs/v10/ARCHITECT-CUTS.md (17:10Z cut) | released@2026-09-27T17:53Z | Batch 2, dispatched 17:14. In v9.65.0 (release commit 0103adfa, pushed 17:45:33Z; required-ci success). |
-| S-114 | P3 pending: check_author.py context (spec-only inputs) | autonomy/lib/check_author.py, tests/test-check-author-context.sh | HIGH | wall check in docs/v10/ARCHITECT-CUTS.md (17:10Z cut) | parked@2026-09-27T20:00Z | Held: present-but-unwired promotion risk (BACKLOG 34); needs a run.sh wiring slice. Held for a CEO decision (P3/P4/P8 moat scope), not dispatchable until then. |
-| S-115 | P3 pending: checklist-verify.py --freeze (definition digest, hash mismatch on edit) | autonomy/checklist-verify.py, tests/test-checklist-freeze.sh | HIGH | wall check in docs/v10/ARCHITECT-CUTS.md (17:10Z cut) | parked@2026-09-27T20:00Z | Held: unwired (BACKLOG 34). Held for a CEO decision (P3/P4/P8 moat scope), not dispatchable until then. |
-| S-116 | P2 pending: council must not approve inconclusive evidence on the vote alone | autonomy/completion-council.sh (evidence gate, evaluate), tests/test-council-inconclusive-no-approve.sh | HIGH | wall check in docs/v10/ARCHITECT-CUTS.md (17:10Z cut) | released@2026-09-27T18:12Z | Batch 2, dispatched 17:14. Train 4, pushed 08e4a7d4 at 17:48:38Z (ls-remote verified); approved by review (1/1; HIGH for S-116). P2.council-inconclusive-cannot-exit-zero removed from pending.txt (proven). Quarantine list now empty. Released in v9.66.0 (release commit 0a69d19b, pushed 18:03:32Z). |
-| S-117 | P4 corpus 1/5: 20 logic-bug seeded defects | benchmarks/seeded-defects/cases/SD-0001..0020, fragments/logic-bug.json | MEDIUM | wall check in docs/v10/ARCHITECT-CUTS.md (17:10Z cut) | parked@2026-09-27T20:00Z | CEO decision: whether to spend 6 slices on the corpus (S-117..S-122). Held for a CEO decision (P3/P4/P8 moat scope), not dispatchable until then. |
-| S-118 | P4 corpus 2/5: 20 spec-miss seeded defects | benchmarks/seeded-defects/cases/SD-0021..0040, fragments/spec-miss.json | MEDIUM | wall check in docs/v10/ARCHITECT-CUTS.md (17:10Z cut) | parked@2026-09-27T20:00Z | CEO decision (corpus). Held for a CEO decision (P3/P4/P8 moat scope), not dispatchable until then. |
-| S-119 | P4 corpus 3/5: 20 test-fitting seeded defects | benchmarks/seeded-defects/cases/SD-0041..0060, fragments/test-fitting.json | MEDIUM | wall check in docs/v10/ARCHITECT-CUTS.md (17:10Z cut) | parked@2026-09-27T20:00Z | CEO decision (corpus). Held for a CEO decision (P3/P4/P8 moat scope), not dispatchable until then. |
-| S-120 | P4 corpus 4/5: 20 mock-abuse seeded defects | benchmarks/seeded-defects/cases/SD-0061..0080, fragments/mock-abuse.json | MEDIUM | wall check in docs/v10/ARCHITECT-CUTS.md (17:10Z cut) | parked@2026-09-27T20:00Z | CEO decision (corpus). Held for a CEO decision (P3/P4/P8 moat scope), not dispatchable until then. |
-| S-121 | P4 corpus 5/5: 20 security seeded defects (hermetic) | benchmarks/seeded-defects/cases/SD-0081..0100, fragments/security.json | MEDIUM | wall check in docs/v10/ARCHITECT-CUTS.md (17:10Z cut) | parked@2026-09-27T20:00Z | CEO decision (corpus). Held for a CEO decision (P3/P4/P8 moat scope), not dispatchable until then. |
-| S-122 | P4 corpus assembler build_manifest.py (schema v2, duplicate/category/count checks) | benchmarks/seeded-defects/build_manifest.py, tests/test-seeded-defects-manifest.sh | LOW | wall check in docs/v10/ARCHITECT-CUTS.md (17:10Z cut) | parked@2026-09-27T20:00Z | CEO decision (corpus). Held for a CEO decision (P3/P4/P8 moat scope), not dispatchable until then. |
-| S-123 | BACKLOG 20: JWKS must be https (loopback http only) | autonomy/loki (attestation check), tests/test-jwks-https-only.sh | MEDIUM | wall check in docs/v10/ARCHITECT-CUTS.md (17:10Z cut) | released@2026-09-27T18:55Z | Batch 2, dispatched 17:14. Review CONCERN/REJECT; rework plus re-review dispatched 17:49 (workflow wf_b1414df6-a66) with the reviewer findings. Rework re-review APPROVE (workflow wf_b1414df6-a66); train 6 pushed 0bd45144 at 18:10:14Z (ls-remote verified). Released in v9.67.0 (release commit 7f470727; publish-npm success). |
-| S-124 | BACKLOG 79: iteration 0 drops a stale static-analysis.pass | autonomy/run.sh (iteration-0 drop block), tests/test-iteration0-drops-static-analysis.sh | LOW | wall check in docs/v10/ARCHITECT-CUTS.md (17:10Z cut) | released@2026-09-27T18:55Z | Batch 2, dispatched 17:14. Review CONCERN/REJECT; rework plus re-review dispatched 17:49 (workflow wf_b1414df6-a66) with the reviewer findings. Rework re-review APPROVE (workflow wf_b1414df6-a66); train 6 pushed 0bd45144 at 18:10:14Z (ls-remote verified). Released in v9.67.0 (release commit 7f470727; publish-npm success). |
-| S-125 | BACKLOG 76/89: done-recognition tests_axis zero-test and failed_count honesty | autonomy/lib/done-recognition.sh (tests_axis), tests/test-done-recognition-tests-axis.sh | MEDIUM | wall check in docs/v10/ARCHITECT-CUTS.md (17:10Z cut) | released@2026-09-27T18:55Z | Batch 2, dispatched 17:14. Review CONCERN/REJECT; rework plus re-review dispatched 17:49 (workflow wf_b1414df6-a66) with the reviewer findings. Rework re-review APPROVE (workflow wf_b1414df6-a66); train 6 pushed 0bd45144 at 18:10:14Z (ls-remote verified). Released in v9.67.0 (release commit 7f470727; publish-npm success). |
-| S-126 | BACKLOG 94a: route walk vacuous on FastAPI >=0.141 in test_all_data_gets_scoped | tests/dashboard/test_all_data_gets_scoped.py | MEDIUM | wall check in docs/v10/ARCHITECT-CUTS.md (17:10Z cut) | released@2026-09-27T18:55Z | Batch 2, dispatched 17:14. Review CONCERN/REJECT; rework plus re-review dispatched 17:49 (workflow wf_b1414df6-a66) with the reviewer findings. Rework re-review APPROVE (workflow wf_b1414df6-a66); train 6 pushed 0bd45144 at 18:10:14Z (ls-remote verified). Released in v9.67.0 (release commit 7f470727; publish-npm success). |
-| S-127 | BACKLOG 94b: same vacuous walk in 3 dashboard tests | tests/dashboard/test_fleet_observability.py, test_fleet_retry.py, test_memory_read_scope_auth.py | MEDIUM | wall check in docs/v10/ARCHITECT-CUTS.md (17:10Z cut) | released@2026-09-27T17:53Z | Batch 2, dispatched 17:14. In v9.65.0 (release commit 0103adfa, pushed 17:45:33Z; required-ci success). |
-| S-128 | BACKLOG 148: moat baseline detection blind to a symlinked pending.txt | tests/moat/run.sh (read_baselines, unreached_release), tests/test-moat-runner.sh | MEDIUM | wall check in docs/v10/ARCHITECT-CUTS.md (17:10Z cut) | released@2026-09-27T18:12Z | Batch 2, dispatched 17:14. Train 4, pushed 08e4a7d4 at 17:48:38Z (ls-remote verified); approved by review (1/1; HIGH for S-116). P2.council-inconclusive-cannot-exit-zero removed from pending.txt (proven). Quarantine list now empty. Released in v9.66.0 (release commit 0a69d19b, pushed 18:03:32Z). |
-| S-129 | BACKLOG 93: hard-deadline zero-exit leader waits only 0.2s for the PID file | tests/test-hard-deadline-confinement.sh | LOW | wall check in docs/v10/ARCHITECT-CUTS.md (17:10Z cut) | released@2026-09-27T18:12Z | Batch 2, dispatched 17:14. Train 4, pushed 08e4a7d4 at 17:48:38Z (ls-remote verified); approved by review (1/1; HIGH for S-116). P2.council-inconclusive-cannot-exit-zero removed from pending.txt (proven). Quarantine list now empty. Released in v9.66.0 (release commit 0a69d19b, pushed 18:03:32Z). |
-| S-130 | BACKLOG 117: SettingsPage lists deprecated Gemini and a hardcoded build date | web-app/src/pages/SettingsPage.tsx | LOW | wall check in docs/v10/ARCHITECT-CUTS.md (17:10Z cut) | released@2026-09-27T18:12Z | Batch 2, dispatched 17:14. Train 5, pushed 51ae52fe at 17:52:16Z (ls-remote verified); approved by review. S-88: P9 4/4 in 43s (was about 90s). S-130: web-app dist rebuilt. S-111: pytest -n auto back on after S-102. Released in v9.66.0 (release commit 0a69d19b, pushed 18:03:32Z). |
-| S-131 | BACKLOG 106 (Bun): budget warns when capped and spend is unmeasured | loki-ts/src/runner/budget.ts, loki-ts/tests/runner/budget.test.ts | MEDIUM | wall check in docs/v10/ARCHITECT-CUTS.md (17:10Z cut) | released@2026-09-27T17:53Z | Batch 2, dispatched 17:14; CEO note: warn-never-pause default. In v9.65.0 (release commit 0103adfa, pushed 17:45:33Z; required-ci success). |
-| S-132 | Velocity: skip heavy Tests jobs on a version-bump-only commit whose parent Tests run succeeded (eligibility no looser than release.yml STEP 1) | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | HIGH | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | released@2026-09-27T19:42Z | Batch 4 (build then review), dispatched 18:17. Batch-4 builder was diverted by a relayed message and built nothing; re-dispatched 18:37 in batch 4b (wf_63d4c91e-86d). Review APPROVE (HIGH); cherry-picked 7b328b1f+c50efd15 into train 9, main a39c4995 pushed 19:06:25 (`git ls-remote origin refs/heads/main` = a39c4995). Tagged v9.70.0, awaiting publish-npm (`git ls-remote origin refs/tags/v9.70.0^{}` = 6c459dfa). Published: `npm view loki-mode version` = 9.71.0; npm time lists 9.70.0. |
-| S-133 | Velocity: release.yml required-ci poll 30s to 10s; fix stale publish-npm comment | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | LOW | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | released@2026-09-27T18:55Z | Batch 4 (build then review), dispatched 18:17. Review APPROVE; train 7 pushed aada49d8 (main b7a8dd50 at 18:45:14Z, ls-remote verified). In v9.68.0 (release commit 8d17be2b, pushed 18:54:35Z); released when publish-npm succeeds. |
-| S-134 | Velocity: rebuild shard-durations.tsv from a recent successful run; drift test | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | LOW | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | released@2026-09-27T19:42Z | Batch 4 (build then review), dispatched 18:17. Batch-4 builder was diverted by a relayed message and built nothing; re-dispatched 18:37 in batch 4b (wf_63d4c91e-86d). Review APPROVE; abe6a7ae into train 9 (a39c4995). Tagged v9.70.0, awaiting publish-npm (`git ls-remote origin refs/tags/v9.70.0^{}` = 6c459dfa). Published: `npm view loki-mode version` = 9.71.0; npm time lists 9.70.0. |
-| S-135 | Velocity: parallelize trust-core probe mutations (130s) | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | MEDIUM | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | released@2026-09-27T20:24Z | Batch 4 (build then review), dispatched 18:17. Blocked as scoped: probe_case mutates the shared repo in place (50 of 91 sites target autonomy/run.sh); reviewer reproduced the race. Re-scope: a private repo copy per worker plus a target override. Batch 5 build, re-scoped to a private repo copy per worker (wf_38d4e17c-211). 4a29e278 (MEDIUM review APPROVE); in train 12, main ec01d54b pushed 20:05:58 (`git ls-remote origin refs/heads/main` = ec01d54b). Published in v9.73.0 (`npm view loki-mode version` = 9.73.0; npm time 2026-09-27T20:24Z). |
-| S-136 | Velocity: tests/test-select-tests.sh under 30s, same 38 cases | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | MEDIUM | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | released@2026-09-27T19:42Z | Batch 4 (build then review), dispatched 18:17. Batch-4 builder was diverted by a relayed message and built nothing; re-dispatched 18:37 in batch 4b (wf_63d4c91e-86d). 7fc63d5b REJECT (mapfile crashes under /bin/bash 3.2); rework dispatched 18:53. cafbf57c re-review APPROVE (38/38 under /bin/bash 3.2, 25.6s); lands after the release 10 bump. Note: two builders converged on the same fix. 7fc63d5b+cafbf57c onto main b61045fd pushed 19:19:39 (`/bin/bash tests/test-select-tests.sh` = 38 passed, 0 failed, 33.6s). Tagged v9.70.0, awaiting publish-npm (`git ls-remote origin refs/tags/v9.70.0^{}` = 6c459dfa). Published: `npm view loki-mode version` = 9.71.0; npm time lists 9.70.0. |
-| S-137 | S-81 follow-up: shard-coverage T4 enumerates the real runner | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | LOW | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | released@2026-09-27T19:42Z | Batch 4 (build then review), dispatched 18:17. Batch-4 builder was diverted by a relayed message and built nothing; re-dispatched 18:37 in batch 4b (wf_63d4c91e-86d). Review APPROVE; 4107e16f into train 9 (a39c4995). Fix-forward 6e48decb: T4 unsharded run inherited LOKI_TEST_SHARD in CI (Tests run 36343130286 shard 7/8: "unsharded real run selected 41 of 564"); `LOKI_TEST_SHARD=6/8 bash tests/test-shard-coverage.sh` 18/1 before, 19/0 after. Tagged v9.70.0, awaiting publish-npm (`git ls-remote origin refs/tags/v9.70.0^{}` = 6c459dfa). Published: `npm view loki-mode version` = 9.71.0; npm time lists 9.70.0. |
-| S-138 | GUARDS 12: lint so test fixtures never write the real ~/.gitconfig | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | LOW | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | released@2026-09-27T20:24Z | Batch 4 (build then review), dispatched 18:17. 849b655e review REJECT; rework pending. 2f29ad49 re-review REJECT (2nd); rework in batch 5 (wf_38d4e17c-211). 7431f5dd 3rd REJECT; simplified rework (fail closed unless a named isolation helper is sourced) in batch 6 (wf_3510293b-09b). a95eabea (4th round, review APPROVE); in train 12, main ec01d54b pushed 20:05:58 (`git ls-remote origin refs/heads/main` = ec01d54b). Published in v9.73.0 (`npm view loki-mode version` = 9.73.0; npm time 2026-09-27T20:24Z). |
-| S-139 | GUARDS 13 + BACKLOG 136: RELEASED_AHEAD_OF_NPM; UNKNOWN on tag/npm disagreement | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | MEDIUM | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | released@2026-09-27T19:42Z | Batch 4 (build then review), dispatched 18:17. Batch-4 builder was diverted by a relayed message and built nothing; re-dispatched 18:37 in batch 4b (wf_63d4c91e-86d). Review APPROVE; 28d18393 onto main 06bf5406 pushed 19:08:09. Tagged v9.70.0, awaiting publish-npm (`git ls-remote origin refs/tags/v9.70.0^{}` = 6c459dfa). Published: `npm view loki-mode version` = 9.71.0; npm time lists 9.70.0. |
-| S-140 | BACKLOG 103: jest "Test Suites N failed" / vitest "Test Files N failed" count as failures | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | MEDIUM | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | released@2026-09-27T19:42Z | Batch 4 (build then review), dispatched 18:17. Built 6dbfc1e6; review pending. Review APPROVE; 6dbfc1e6 onto main e952e1ae pushed 19:09:04. Tagged v9.70.0, awaiting publish-npm (`git ls-remote origin refs/tags/v9.70.0^{}` = 6c459dfa). Published: `npm view loki-mode version` = 9.71.0; npm time lists 9.70.0. |
-| S-141 | S-49 follow-up: remaining council readers (~1425, ~1564, ~4232) use -I -S | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | HIGH | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | released@2026-09-27T19:42Z | Batch 4 (build then review), dispatched 18:17. Batch-4 builder was diverted by a relayed message and built nothing; re-dispatched 18:37 in batch 4b (wf_63d4c91e-86d). Review APPROVE (HIGH); 001576f3+958f6548 onto main 06bf5406 pushed 19:08:09. Tagged v9.70.0, awaiting publish-npm (`git ls-remote origin refs/tags/v9.70.0^{}` = 6c459dfa). Published: `npm view loki-mode version` = 9.71.0; npm time lists 9.70.0. |
-| S-142 | S-48 follow-up: convergence-floor NEGATIVE-C for the runner guard | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | LOW | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | released@2026-09-27T19:42Z | Batch 4 (build then review), dispatched 18:17. Batch-4 builder was diverted by a relayed message and built nothing; re-dispatched 18:37 in batch 4b (wf_63d4c91e-86d). Review APPROVE; 59e32d75 into train 9 (a39c4995). Tagged v9.70.0, awaiting publish-npm (`git ls-remote origin refs/tags/v9.70.0^{}` = 6c459dfa). Published: `npm view loki-mode version` = 9.71.0; npm time lists 9.70.0. |
-| S-143 | BACKLOG 117: drop Gemini/Railway/stale gate counts from 6 web-app files | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | LOW | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | released@2026-09-27T19:42Z | Batch 4 (build then review), dispatched 18:17. Batch-4 builder was diverted by a relayed message and built nothing; re-dispatched 18:37 in batch 4b (wf_63d4c91e-86d). Review APPROVE; 6f901f91 into train 9 (a39c4995). Tagged v9.70.0, awaiting publish-npm (`git ls-remote origin refs/tags/v9.70.0^{}` = 6c459dfa). Published: `npm view loki-mode version` = 9.71.0; npm time lists 9.70.0. |
-| S-144 | Footer.tsx version joins release.sh --bump-only | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | LOW | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | released@2026-09-27T18:55Z | Batch 4 (build then review), dispatched 18:17. Review APPROVE; train 7 pushed edb706ed (main b7a8dd50 at 18:45:14Z, ls-remote verified). In v9.68.0 (release commit 8d17be2b, pushed 18:54:35Z); released when publish-npm succeeds. |
-| S-145 | BACKLOG 118: GET /api/checklist/waivers returns 500 on a corrupt file | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | LOW | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | released@2026-09-27T18:55Z | Batch 4 (build then review), dispatched 18:17. Review APPROVE; train 7 pushed 2ef38a2f (main b7a8dd50 at 18:45:14Z, ls-remote verified). In v9.68.0 (release commit 8d17be2b, pushed 18:54:35Z); released when publish-npm succeeds. |
-| S-146 | BACKLOG 118: one id="budget-banner" in the dashboard build | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | LOW | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | released@2026-09-27T20:13Z | Batch 4 (build then review), dispatched 18:17. Batch-4 builder was diverted by a relayed message and built nothing; re-dispatched 18:37 in batch 4b (wf_63d4c91e-86d). 569e8cf4 review CONCERN; rework in batch 5 (wf_38d4e17c-211). dc2e45a1 review CONCERN (e2e harness still targets budget-banner); rework in batch 6 (wf_3510293b-09b). Review APPROVE on acdbd03c; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). Published in v9.72.0 (`npm view loki-mode version` = 9.72.0; npm time 20:13Z). |
-| S-147 | BACKLOG 118: loki metrics --json reports null for unmeasured, no invented time_saved | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | MEDIUM | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | released@2026-09-27T19:47Z | Batch 4 (build then review), dispatched 18:17. Batch-4 builder was diverted by a relayed message and built nothing; re-dispatched 18:37 in batch 4b (wf_63d4c91e-86d). f82eeda0 review CONCERN; rework in batch 5 (wf_38d4e17c-211). Re-review APPROVE; f82eeda0+920b1ae8 onto main c6ed3882 pushed 19:30:18 (`bash tests/test-metrics-json-unmeasured.sh` rc=0). Published: `npm view loki-mode version` = 9.71.0; npm time lists 9.71.0. |
-| S-148 | BACKLOG 118: trust.html says "Not enough history yet" when every axis is insufficient | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | LOW | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | released@2026-09-27T19:05Z | Batch 4 (build then review), dispatched 18:17. Built 92c0f9d8; review pending. Review APPROVE; cherry-picked for train 8. Released in v9.69.0 (b2444763, `git ls-remote origin refs/tags/v9.69.0^{}` = b2444763). |
-| S-149 | BACKLOG 118: prompt_optimizer never-ran vs corrupt markers | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | LOW | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | released@2026-09-27T18:55Z | Batch 4 (build then review), dispatched 18:17. Review APPROVE; train 7 pushed 06eea9ea (main b7a8dd50 at 18:45:14Z, ls-remote verified). In v9.68.0 (release commit 8d17be2b, pushed 18:54:35Z); released when publish-npm succeeds. |
-| S-150 | BACKLOG 118: migration progress null (not 0/0) on a corrupt/missing file | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | LOW | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | released@2026-09-27T18:55Z | Batch 4 (build then review), dispatched 18:17. Review APPROVE; train 7 pushed b7a8dd50 (main b7a8dd50 at 18:45:14Z, ls-remote verified). In v9.68.0 (release commit 8d17be2b, pushed 18:54:35Z); released when publish-npm succeeds. |
-| S-151 | BACKLOG 118: analytics heatmap shows no-data before the activity window | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | LOW | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | released@2026-09-27T19:42Z | Batch 4 (build then review), dispatched 18:17. Batch-4 builder was diverted by a relayed message and built nothing; re-dispatched 18:37 in batch 4b (wf_63d4c91e-86d). Review APPROVE; 97f8b6c5 into train 9 (a39c4995). Tagged v9.70.0, awaiting publish-npm (`git ls-remote origin refs/tags/v9.70.0^{}` = 6c459dfa). Published: `npm view loki-mode version` = 9.71.0; npm time lists 9.70.0. |
-| S-152 | Incident guard: only the Chief of Staff pushes main. A worktree agent pushed 28926937 at 18:35Z. Block `git push` and any commit on main from inside .claude/worktrees (guard hook or a pre-push check in .githooks/pre-push that refuses unless LOKI_RELEASE_MANAGER=1 is set by the orchestrator) | scripts/v10-guard.sh and/or .githooks/pre-push, tests | HIGH | a push from a worktree path is refused with a clear reason; the orchestrator push with the marker still works; fixture per case | released@2026-09-27T20:13Z | Evidence: `git log -1 28926937` author asklokesh 14:35:11; `git ls-remote origin refs/heads/main` = 28926937. f02bcbde review CONCERN (no allowed non-main case); rework in batch 5 (wf_38d4e17c-211). c9590985 review CONCERN (shellcheck SC2163); rework in batch 6 (wf_3510293b-09b). Review APPROVE on 3b649b51; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). Published in v9.72.0 (`npm view loki-mode version` = 9.72.0; npm time 20:13Z). |
-| S-153 | Release reuse: add web-app/src/components/Footer.tsx to release.yml required-ci ALLOWLIST with the same version-only compare, so a version-bump commit that now rewrites the Footer (S-144) can still reuse its parent verdict; also rebuild web-app/dist on --bump-only so the shipped footer shows the version | .github/workflows/release.yml (ALLOWLIST), scripts/release.sh, tests/test_release_required_ci.py | HIGH | a bump touching only allowlisted files incl. Footer.tsx is eligible; a Footer change beyond the version string is not; replay of 8d17be2b is eligible | released@2026-09-27T19:47Z | Evidence: v9.68.0 bump 8d17be2b touches Footer.tsx (git show --stat 8d17be2b). Batch 5 build (wf_38d4e17c-211). Review APPROVE (HIGH); e11137ad onto main c6ed3882 pushed 19:30:18. Published: `npm view loki-mode version` = 9.71.0; npm time lists 9.71.0. |
-| S-01 | BACKLOG 22: orphaned `sleep 300` resource monitor | autonomy/run.sh (resource-monitor spawn/cleanup only, not kill_provider_child), one new test | MEDIUM | red: `loki start` then interrupt leaves a `sleep 300` orphan (ps shows it after exit); green: it is reaped or never orphaned, by PID recorded at spawn | released@2026-09-27T01:33Z | 027ec085 confirmed ancestor of origin/main; note corrected, was stale. |
-| S-02 | BACKLOG 23: client-route test hardcodes main checkout path | tests/lib-extract-client-paths.mjs, tests/lib-match-client-routes.py, tests/test-verify-client-routes.sh | LOW | released@2026-09-27T15:00Z | 1/1 APPROVE: reviewer reproduced from 2 independent real worktrees, mutation-tested both new WORKTREE GUARD assertions independently, confirmed the disclosed BACKLOG 137 interaction (P7's own sed-workaround breaking) is expected, not a surprise. **Merged to main.** S-39/BACKLOG 137 now unblocked -- but note: this merge makes `tests/moat/run.sh` read a live FAIL on `P7.webapp-client-routes-exist` until S-39 lands (an unlisted-in-pending.txt regression per the ratchet), since P7's own copy-and-sed workaround can no longer find the literal it targets. S-39 should be prioritized promptly to close this gap, or a temporary pending.txt entry considered if S-39 doesn't land quickly. Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| S-03 | BACKLOG 25: `loki ci --report` "Argument list too long" on a large diff | autonomy/loki (cmd_ci report path only), one new test | MEDIUM | red: a synthetic diff over the ARG_MAX threshold, exit 126; green: same diff passed via stdin/file, exit 0 | rejected@2026-09-27T01:33Z | Real crash site (export-based ARG_MAX) misdiagnosed and left unfixed; sent back to builder. |
-| S-04 | BACKLOG 26: Bun Parity `doctor-json` flake (disk.available_gb 94 vs 95) | .github/workflows/bun-parity.yml, tests/test-bun-parity-disk-tolerance.sh (new) | LOW | red: two consecutive doctor --json calls disagree on disk.available_gb and the parity check flags it; green: normalized (rounded/bucketed) or excluded from strict comparison, documented why | released@2026-09-27T15:00Z | Merged 7a13b816, test registered f0f51587, pushed. Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| S-05 | BACKLOG 31: `proof-verify.py` "drift unverifiable" reads 1 (tampered) instead of 2 (could not check) | autonomy/lib/proof-verify.py, its test | MEDIUM | red: a genuinely-unverifiable drift case reads 1; green: it reads 2 | released@2026-09-27T15:00Z | Merged 1a02bab1, pushed; quorum topped up 2/2 APPROVE. Fixed the receipt-attest.py substring-lookup break from the rename, plus documented an accepted ceiling (a hand-forged, re-hashed receipt with a stripped diff stat is indistinguishable from an honestly-unverifiable one; unreachable from any honestly-generated receipt). Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| S-06 | BACKLOG 32: docs tell npm users to run `doctor --airgap`, which the default (Bun) route rejects | docs/air-gapped.md, deploy/helm/README.md | LOW | the doc now says `LOKI_LEGACY_BASH=1 loki doctor --airgap` (or notes the Bun-route gap) until P5.airgap-audit-default-route ships; grep confirms the old bare command is gone from both files | released@2026-09-27T01:33Z | In main since c83732b2 / v9.54.2. |
-| S-07 | BACKLOG 33: council `runner=none` counts as a positive signal, a zero-test suite does not -- pick one rule | autonomy/completion-council.sh (the specific vote-reading site only), its test | MEDIUM | released@2026-09-27T15:00Z | Confirmed on main directly at ad47a2ec (this row was stale: BOARD said `review` but the commit was already an ancestor of origin/main; no separate merge commit was needed). Rework #2. Round 1 (regression from rework #1's pass:true narrowing) fixed by dropping the narrowing entirely -- runner=='none' unconditional again (matches the real writer, run.sh:12691-12692, which writes pass as the STRING "inconclusive", never boolean true), while keeping the correct status-first ordering fix. Unanimous 2/2 APPROVE: both reviewers independently confirmed status is checked unconditionally before runner=='none' in both parsers (a crafted runner:none+status:no_tests_run record cannot bypass), original bug and rework-#1 regression both verified fixed with independent fixtures. 78/78, 24/24, 41/41, 5/5 across the 4 regression suites. Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| S-08 | BACKLOG 39: attestation edge labels (`{"keys": []}` reads FAILED not NOT CHECKED; `attestation: false` inconsistent local vs remote) | autonomy/receipt_jwt.py or the relevant attestation renderer, its test | MEDIUM | red: an empty keyset and a false-attestation receipt each render a misleading label on one route; green: both read NOT CHECKED consistently on both routes | released@2026-09-27T15:00Z | Merged bbe307d8, pushed; unanimous 2/2 APPROVE. Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| S-09 | BACKLOG 40: `P3.implementer-prompt-has-no-check-authoring` is phrase-based only | tests/moat/p3-*.sh (add a behavioral assertion; do not weaken the existing phrase check) | MEDIUM | released@2026-09-27T15:00Z | 3 rework rounds, full history preserved in git log (601d1739 and its ancestors). Round 1 CONCERN found+fixed a line-boundary blind spot (multi-line prose defeated the detector) and an undisclosed array-literal false positive. Round 2 CONCERN found+fixed a double-period regression the round-1 fix introduced (switched from a "." -join trick to a real newline join). Round 3 investigated a described CRLF false-negative, found it did NOT reproduce, and instead found+fixed the real bug (CRLF blank lines read as bare `\r`, not empty) -- disclosed transparently rather than silently implementing the wrong framing. Final quorum: unanimous 2/2 APPROVE; the one blocking note (a stale header comment + an `[^.]` awk/grep mislabeling) fixed directly by the Captain (97bfaa84) rather than a 4th rework round, since both reviewers independently confirmed the underlying code was already fully correct. One non-blocking follow-up logged: whitespace-only blank lines not yet treated as paragraph breaks. Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| S-10 | BACKLOG 41: `P1.different-tree-fails` lacks an in-script no-edit control | tests/moat/p1-*.sh | LOW | add the control described (an unedited copy verifies 0 / clean); case still passes, control documented inline | released@2026-09-27T15:00Z | Confirmed on main directly at 368332cf (this row was stale: BOARD said `review` but the commit was already an ancestor of origin/main). Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| S-11 | BACKLOG 42: `doctor --airgap` "local" is a loose substring match, ignores remote `OLLAMA_HOST` | autonomy/loki (airgap audit only) or loki-ts doctor.ts, its test | MEDIUM | red: `OLLAMA_HOST=https://remote.example.com` still reads as local because the string contains "ollama"; green: a remote OLLAMA_HOST counts as required egress | released@2026-09-27T15:00Z | 698ce1c8, pushed; ships in next release cut. Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| S-12 | BACKLOG 46: P2 advisory-only case's positive control differs from the probe in two variables | tests/moat/p2-*.sh | LOW | control now uses an exogenous gate with no tests, matching the probe's other variable exactly; case still passes | released@2026-09-27T01:33Z | 0a59f420 confirmed ancestor of origin/main; note corrected, was stale. |
-| S-13 | BACKLOG 48: same-class D7 hardening -- `loki outcomes canary verify`, `proof share`/`show` heredocs, empty PATH component | autonomy/loki (the specific inline python3 sites named), its test | MEDIUM | released@2026-09-27T15:00Z | Merged bb99e675, pushed; quorum topped up 2/2 APPROVE. RED leg pins a literal parent SHA (reachability-checked, SKIP on a shallow clone) instead of HEAD, confirmed to survive being merged. `loki_verify_tool_path()` rejects any non-absolute PATH entry. Quorum reviewer confirmed all 5 hardened call sites fail closed (hard error), never silently fall back to a bare unscoped python3. Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| S-14 | BACKLOG 49: verifier stdout still says `ok: true` on ABSENT/NOT CHECKED while exit is 1/2 | autonomy/loki (`cmd_proof verify)` case), its test | MEDIUM | released@2026-09-27T15:00Z | `TAMPERED if attestation=="FAILED" or hash_ok is False`; both JSON and `--human` share one verdict computation. Unanimous 2/2 APPROVE. Reviewer 2 independently isolated the hash-only-corrupted case (a scenario reviewer 1's body-mutation approach couldn't architecturally produce, since receipt_sha256 and verification.hash are the same canonical digest by design) and confirmed the `or`'s hash_ok disjunct correctly fires TAMPERED there too. Both reviewers confirmed the `--human` residual gap is real but non-blocking (exit code and stderr both correct; a pure-stdout consumer sees a weaker finding). f8deb64a. Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| S-15 | BACKLOG 50: remote NOT CHECKED returns 0, local returns 2 -- align or document | the remote verifier path, docs/exit-codes.md | LOW | either the remote exit is changed to 2 with a test proving it, or docs/exit-codes.md documents the divergence explicitly with the reason; pick one and record which in the commit message | released@2026-09-27T15:00Z | Main since 34198ff4. Round 1 found the first draft factually wrong (missed the nopubkey unconditional-exit-1 override), corrected and re-approved. Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| S-16 | BACKLOG 22 follow-on / housekeeping: `scripts/release.sh` only bumps 3 of the 14 files CLAUDE.md's release checklist requires (VERSION, package.json, vscode-extension/package.json) | scripts/release.sh | MEDIUM | (not recorded; see Notes) | released@2026-09-27T16:40Z | Rebased to ed565709. Fixed the subshell-scoping bug (`--dry-run`/`--help` silently broken) and switched to anchored per-format sed slots for drift-safety. 2/2 reviewers ran independently: reviewer 1 (Opus) APPROVE, one non-blocking permissions note. Reviewer 2 (Sonnet) CONCERN, blocking: `apply_sed()`'s mktemp+mv silently narrows all 14 touched files from 644 to 600 on every release (mktemp always creates 600, mv keeps the temp file's mode, not the original's) -- confirmed live on a real bump run. Fix (`cp -p` after mktemp, before the sed redirect) dispatched as rework; full verification suite (subshell fix, drift-detection, idempotency, fail-closed assert, plus the new permissions check) to be re-run before a fresh quorum. Correction: stale building@ with no live agent and no commit of its own (git log --all --grep found none). Re-cut to ready. Dispatched 15:00 (workflow wf_29a75a9c-652, slice-card brief). Built 9bf1ddda (test-release-sh.sh). Reviewer dispatched 15:16 to verify the mode-preservation fix. CONCERN: tests/test-release-sh.sh is never invoked. Rework sent 15:28 (register it). Rework 12f2d681: test registered (mode fix 59fcbaa3 is in the branch). Re-review dispatched 15:40. 1/1 APPROVE (test registered; mode fix 59fcbaa3 in the branch). Train 4: this ends the D27 VERSION editor-tool exception. Cherry-picked onto main for train 4 (4 commits); D27 checks green except tests/test-select-tests.sh, which hit the 60s cap (rc=124; CI runs it in full; reviewer ran 38/38). Train 4 release commit 08d64f4e (v9.59.0) pushed 16:07:02Z, ls-remote verified. Released in v9.59.0 (Release run 36332036567 publish-npm success; v9.58.0 itself never published, superseded). |
-| S-17 | BACKLOG 43: council/runner test-result readers (`completion-council.sh`'s 4 `python3 -c` sites) can be shadowed by a committed `hashlib.py`/`json.py` in the agent's own repo (cwd module shadowing, honest-verdict, HIGH) | autonomy/completion-council.sh (the 4 named `python3 -c` test-results readers only, not the S-07 vote site), its test | HIGH | released@2026-09-27T15:00Z | Rebased onto current main in worktree-agent-a5422f6f162d3dd2f (now at 23025a09), NOT yet merged -- HIGH tier requires 3+1 unanimous APPROVE (D12/D13) before merge, which has not run against this diff. Found the CODE fix already shipped in 3bc40efb (all 43 inline python3 sites in this file, including all 4 named readers, already have the D7 pattern) -- this slice is test-coverage-only, no production code changed. Extended tests/moat/p2-honest-verdict.sh's existing P2.council-readers-not-shadowed case to drive the 3 previously-untested readers (council_heuristic_review, council_evaluate_member, council_devils_advocate_review) via mutation-cycle verification (stripped each site's filter, confirmed shadow fired/verdict flipped, restored, reconfirmed clean). No cases.txt/pending.txt change (no new case ID). Solo-verified (not a substitute for quorum): moat matches main (3 of 9, no rule failed), shellcheck clean (one pre-existing unrelated SC2034 warning). Full 4-reviewer HIGH-tier quorum: 3/4 APPROVE, 1/4 CONCERN -- NOT unanimous, rework needed. Reviewer 3 (Opus) found a real, more severe, OUT-OF-SCOPE bypass in the SAME file's reader hardening (bucket-(b) per D21, not a veto on this test-coverage-only slice): the readers' `python3 -E -c` calls have no `-I`/`-S`/fixed-path resolution, lighter than BACKLOG 129's equivalent fix; reproduced live via a planted `.pth` flipping a genuinely-failing verdict to CONFIRMED_COMPLETE. Filed as BACKLOG 134. Reviewer 4 (Sonnet) CONCERN, blocking, reproduced live: the 3 new call sites (`tests/moat/p2-honest-verdict.sh:802-804`) discard rc/stdout and rely only on a shared marker file staying empty -- a typo'd function name (verified: renaming `council_heuristic_review` to a nonexistent name) still reports PASS, since a nonexistent-function call never touches the marker either. Fix: assert rc/vote-text differs between the fail and green legs for each of the 3 new calls (reviewer already confirmed each site's distinct fail/green vote text: council_heuristic_review -> VOTE:REJECT/VOTE:APPROVE; council_evaluate_member -> CONTINUE.../COMPLETE...; council_devils_advocate_review -> OVERRIDE_CONTINUE/CONFIRMED_COMPLETE). Same reviewer also found a 6th reader, `council_managed_should_stop` (already D7-hardened, gated behind 3 default-false experimental flags, not currently exploitable) not covered by this case -- filed as BACKLOG 135, non-blocking follow-up, not part of this rework. Rework commit 4df70b2d (rebased): `council_call_args` now captures and asserts each call's actual vote-text output against the pattern the file's pre-existing 2-reader loop already uses, matching each site's real fail-leg/green-leg strings verified against completion-council.sh source directly. Also fixed a subtler fixture-contamination bug found during rework: `council_heuristic_review`'s original fixture file independently drove REJECT via a separate grep check regardless of whether the D7-guarded reader even ran; switched to a neutral empty file so the assertion depends only on the reader under test. Typo-reproduction re-verified for all 3 sites (before: silent PASS; after: loud FAIL naming the broken site). Full mutation cycle re-verified. Fresh 4-reviewer HIGH-tier quorum: reviewer 1/4 (Opus) APPROVE, independently confirmed the typo test both ways (renamed the test's call AND separately renamed the production function), verified every expected vote string against completion-council.sh source directly, independently reproduced that the neutral-fixture fix is genuinely necessary (the original evidence file's own text content drives REJECT via the role's own grep check, masking a stripped D7 filter at the heuristic reader specifically), and ran the full mutation cycle per-site and combined. No blocking findings. Reviewer 3/4 (Opus) also APPROVE: confirmed the vote-text comparison is exact-match (not a fooled-by-prefix risk), found one genuine limit (the devil's-advocate result-WRITER site at completion-council.sh:4058 is uncaptured stdout, so a decoy vote there could theoretically slip past the vote-text check alone -- but confirmed via its own mutation that the marker check independently catches this case, proving the two checks are complementary, not redundant), reproduced the typo test on 2 of 3 sites, and confirmed the case's own claims stay within what it actually tests (does not overclaim coverage of the separate BACKLOG 134 gap). Flagged (and I confirmed clean, transient) a worktree hygiene note: other review agents' own scratch scripts briefly appeared in this shared worktree's tests/moat/ directory during concurrent review, causing a spurious DUPLICATE SCRIPT moat failure for one reviewer -- verified via git status that nothing persisted or got tracked. Reviewer 4/4 (Sonnet, the original round-1 CONCERN-finder re-checking their own finding) also APPROVE: reproduced the original bug fresh against the pre-rework file for all 3 functions (confirmed the gap was not limited to just one), confirmed all 3 typos now fail loudly against the reworked file, and went further than the original ask by testing a stronger variant not explicitly claimed by the commit -- swapping one function's definition to occupy ANOTHER's name (wrong-function-called-instead-of-missing) -- and confirmed the assertion catches that too, since all 3 sites' vote vocabularies are pairwise distinct. Reviewer 2/4 (Sonnet) also APPROVE: confirmed the 6th-reader scope from BACKLOG 135 still holds and is unchanged, found a real but genuinely out-of-scope bypass (a stub function redefined inside the test harness's own subshell can fool the vote-text check -- requires editing the test itself, not achievable via the actual PYTHONPATH-shadow threat model this test defends against), and caught its own FIRST mutation-cycle attempt was too weak (only proved the marker fired, not the vote-text check specifically) -- consulted the advisor, redid it per-site, and confirmed all 3 vote-text brackets genuinely fire on their own, not just the marker. **Unanimous 4/4 APPROVE. Merged to main (410046ce).** Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| S-18 | BACKLOG 149 (escalated from BACKLOG 44, real production gap not just test-coverage): the GH CLI's own `hosts.yml` credential file is completely unprotected by Rule-of-Two's env-var withhold -- an injected prompt can just run real `gh`, which resolves credentials from `$HOME` regardless of the withheld env vars | autonomy/run.sh (the withhold call site), loki-ts/src/runner/github_token.ts (Bun equivalent), tests/moat/p9-rule-of-two.sh | HIGH | released@2026-09-28T01:11Z | **ROUND 2 REJECT (new reviewer), a different and more severe bypass than round 1**: round 1's fix (env sentinel + GH_CONFIG_DIR + git credential.helper reset via GIT_CONFIG_COUNT/KEY/VALUE) correctly closes both round-1-confirmed bypasses -- verified independently by BOTH round-2 reviewers (one APPROVE, one REJECT, but the REJECT's own verification of the round-1 fixes is itself a clean pass). The REJECT is for a THIRD, previously undisclosed and unhandled vector: **SSH transport is completely unhandled**. Every round-1 mechanism (token sentinel, GH_CONFIG_DIR, credential.helper reset) covers only HTTPS-based git/gh credential resolution -- none touch SSH_AUTH_SOCK, GIT_SSH_COMMAND, core.sshCommand, or ~/.ssh. Reproduced live, read-only: `ssh-add -l` exits 0 (the provider session's live, untouched $HOME/env always has a reachable SSH agent by the fix's own design), and `ssh -T git@github.com` completes full auth as the real account, completely unaffected by every round-1 mitigation. An agent can simply `git remote set-url origin git@github.com:<owner>/<repo>.git && git push` and authenticate exactly as an unrestricted session -- simpler than the already-disclosed `gh auth token -u <username>` gap (no username lookup, no keychain tooling, just the operator's normal always-on ssh-agent). The P9 test's own PASS assertion text is unqualified and false for this case. Fix path per the reviewer: extend the existing capture/apply/restore/depth-counter architecture (already correct for the HTTPS vars) to also sentinel SSH_AUTH_SOCK and override GIT_SSH_COMMAND/core.sshCommand for the withheld session -- a bounded addition to an already-sound design, not a redesign. Two secondary non-blocking findings folded into the rework: (1) `env -u GH_TOKEN -u GITHUB_TOKEN gh auth token` is an undisclosed sibling of the already-disclosed username-lookup gap, needs naming; (2) the Bun/TS route has no git-version floor check the bash route already added, silently no-oping the credential.helper reset on git < 2.31 with no operator signal. Per the founder's D25 directive, this does NOT block the current release train -- the vulnerability this slice fixes (both round-1 and this newly-found SSH gap) is already live in published v9.55.0 either way; S-18 ships in its own train the moment its review reaches unanimous APPROVE. Rework dispatched. Round 3 built 3af8cdac (stack 6e38257c, 94f8b26a, b8c0eccf): SSH_AUTH_SOCK unset and GIT_SSH_COMMAND=false in the withheld window with a trusted re-grant, Bun git-floor warning, P9 SSH tier mutation-tested. Disclosed residual: direct ssh -i <key>. 2 opus HIGH reviewers dispatched 14:26. Ships in its own train once unanimous (D25). Round 3 HIGH reviewer 1: SSH blocker CLOSED (synthetic agent), re-grant/depth/login shells verified; REJECT for a new reproduced Bun-route bypass: 5 bare git spawns (council.ts:178,:190,:401, prd_reuse.ts:161-175) inherit the startup env with real GH_TOKEN/SSH_AUTH_SOCK, so an agent core.fsmonitor script runs with operator creds. Round 4 sent 14:43. Round 4 9cb330cb: Bun start-env spawn leak, nested run fails closed, SSH re-grant test. 2 HIGH reviewers dispatched 15:05. Round 4 closed all round-3 findings, but both HIGH reviewers REJECT: the trusted push in on_run_complete (default on) and create_session_pr runs an agent-planted pre-push hook or core.sshCommand with every withheld channel restored (reproduced with synthetic creds). Round 5 sent 15:16: push from a Loki-owned temp repo. CEO decision pending: a Loki-spawned nested run fails closed and cannot push. Round 5 7d5b7fb4: the push goes from a fresh private repo (origin validated as github.com), gh runs from / with GH_REPO; new 38-check test and P9 planted scenario with a positive control; mutation red. Incidents during the build: a glob rm in the shared scratchpad root and 4 synthetic insteadOf lines written to the real ~/.gitconfig (removed; grep of ~/.gitconfig for loki-test/insteadOf found none at 15:40). 2 HIGH reviewers dispatched 15:40. Round 5: reviewer A APPROVE (no plant saw a credential; fetch runs withheld; URL validator rejects 14 attack forms); reviewer B CONCERN: proof-check.sh:208 `gh repo view` ignores GH_REPO from /, so the opt-in check-run never posts (reproduced). Round 6 sent 15:51 with shallow, alias and warning fixes. Round 6 e84f1136: proof-check uses _loki_trusted_repo, explicit --repo, --update-shallow, visible refusals, case-insensitive host, origin pinned (F1). trusted-push 54/54, P9 4/4. HIGH re-review dispatched 16:01. Train 5 (release 1cde81a7, v9.60.0, pushed 16:22:51Z, ls-remote verified) on the founder instruction "just release everything asap, no more tests for development work completed so far": round 6 was not re-reviewed. Follow-up S-100. Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| S-41 | BACKLOG 139 (top-ranked GF-3 follow-up): shipped composite GitHub Actions (`.github/actions/issue-to-pr/action.yml`, root `action.yml`) still put `GH_TOKEN` in the SAME step as the agent invocation -- an agent can read another process's environment via `/proc/<ppid>/environ` on hosted Linux regardless of its own env | .github/actions/issue-to-pr/action.yml, root action.yml | MEDIUM | released@2026-09-27T15:00Z | Root action.yml was already correct (3 agent-invoking steps never had GH_TOKEN); the real violation was `.github/actions/issue-to-pr/action.yml`'s single fetch-and-run step, split into a token-holding fetch step (writes a PRD file via `gh issue view`) and a token-free `loki start <file>` step (file-mode). Also blanks all 4 token vars on root action.yml's 3 agent steps as defense-in-depth. Unanimous 2/2 APPROVE, both fully independent and adversarial (output-tampering, argument-injection, PRD-content-leak angles all checked clean). One non-blocking follow-up filed: an owner/repo parsing divergence on refs with extra slashes (cosmetic, `gh` rejects either way). 8a714c73 (cherry-picked onto local main, pending push). Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| S-42 | BACKLOG 140: `docs/environment-variables.md`'s `LOKI_ALLOW_AGENT_GITHUB_TOKEN` description is imprecise -- says tokens are "used only by Loki's own push and PR steps," but omits the Bun route (drops the token outright, no push/PR step), the `gh` CLI and proof-check.sh re-grant sites, and the 2 enterprise-token variables entirely | docs/environment-variables.md | LOW | released@2026-09-27T15:00Z | Docs-only, single table cell, skip-rule per SDLC fleet pattern (no review quorum needed). All 4 re-grant sites and both routes' behavior grep-verified against actual source before writing. 32d914f0 (cherry-picked onto local main, pending push). Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| S-43 | BACKLOG 133: `scripts/v10-pulse.sh`'s `PULSE_MOAT_RESULT` file isn't tied to the commit it was measured against -- a stale capture from an earlier commit would read as clean today | scripts/v10-pulse.sh (moat-regression check only), its test | LOW | released@2026-09-27T15:00Z | Sidecar-file convention (`<PULSE_MOAT_RESULT>.sha`, written before the suite runs) compared against `$PULSE_MAIN_REF`'s resolved HEAD; 3 fail-closed paths all demote to UNKNOWN, never false-clean. Rejected a read-time env-var alternative that would have reintroduced the exact bug. 1/1 APPROVE with 2 non-blocking wording nits, one applied directly (the no-provenance error message now says "BEFORE running the suite" instead of the more ambiguous "alongside"). 34/34 tests pass on bash and real bash 3.2.57. 7dd23bcb. Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| S-44 | BACKLOG 143 (escalated from watch-item to active fix after 4 confirmed occurrences, all the same shard index): CI's "Shell tests (shard 2/4)" hangs past its 20min timeout-minutes with no other shard affected | tests/run-all-tests.sh | MEDIUM | released@2026-09-27T15:00Z | **CORRECTS THE WHOLE SESSION'S FRAMING: shard 2/4 was never hanging.** `test-ci-json-argmax.sh` legitimately takes 5-22 minutes (builds a real ~29K-116K "except:" finding diff to exercise ARG_MAX handling); the workflow's `cancel-in-progress` concurrency group killed it mid-run every time a new push landed first -- confirmed via `gh run view --log` on all cancelled runs, cut off inside argmax every time. This is the same push-storm-cancels-CI pattern this session already knew about at commit level, just never connected to the "shard 2 hangs" symptom until now. Fix: per-suite START/END timestamp logging + a `timeout` wrapper (450s default, named overrides for argmax at 2400s and the trust-core mutation-probe suite at 900s) so a suite that TRULY hangs fails loudly and names itself, instead of consuming the whole shard silently. Caught and fixed 2 self-introduced regressions (wrong PID captured for signal delivery when backing `timeout` through a bash function; SIGINT/SIGQUIT pre-ignored by backgrounding, breaking real Ctrl-C). 2 full 4-shard runs, 489/494 pass both times, same 5 pre-existing environment-specific failures independent of the runner. Did NOT touch test.yml's timeout-minutes (shard 2's legitimate runtime, ~33min, exceeds any reasonable job timeout to add one). Headline caveat: does not stop cancel-in-progress from killing shard 2 on a fast push cadence -- that needs a follow-up shrinking/relocating the argmax fixture. Unanimous 2/2 APPROVE, exceptionally thorough (both reviewers independently reproduced every mechanism from scratch with self-written fixtures, ran real suites across multiple shards, confirmed exact-match named-override safety). Merged 41db33c4, 44/44 reconfirmed on main. Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| S-19 | BACKLOG 45: `P4.three-setups-resolve`'s pass bar lets a documented spelling silently dispatch the wrong model (e.g. `--session-model high` sending sonnet) with only a note, not a failure | tests/moat/p4-*.sh (the three-setups case only) | MEDIUM | red: construct the silent-wrong-dispatch scenario, confirm the case currently notes it but still passes; green: the case fails when a documented spelling dispatches a different model than documented | released@2026-09-27T15:00Z | 885b1c1d @ worktree-agent-acb0607e467ebc729, unanimous 2/2 APPROVE, merged. IMPORTANT: found that GF-4 (still unmerged) would falsely claim P4.three-setups-resolve is promotable under GF-4's own catalog changes when it actually still silently mis-resolves high/small under this stricter bar -- GF-4's reviewer must re-check this before GF-4 merges, or the merge will look like a ratchet regression. Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| S-20 | BACKLOG 47: moat bootstrap is not refused on a hotfix/release branch once any moat release already exists on origin (a branch cut before the first carrying tag runs in bootstrap, unratcheted) | tests/moat/run.sh (the bootstrap-detection logic only) | MEDIUM | released@2026-09-27T15:00Z | Mirrors `read_baselines()`'s `-l`/`-L` pair, fixes a newest-tag naming collapse, distinguishes grep error from no-match. Unanimous 2/2 APPROVE; reviewer 2 stress-tested at 1001 unreached tags (no perf/correctness issue) and found a real, pre-existing (not introduced here) blind spot shared with `read_baselines()`: a symlinked pending.txt at an unreached tag is invisible to `git grep -l`/`-L`, filed as a non-blocking BACKLOG follow-up. f064ce61, verified locally: 54/54, real moat suite byte-identical, 4/9 proven, no rule failed. Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| S-21 | BACKLOG 61: `evidence-block.json` writes the raw `$test_pass` in the block path, so `tests.pass` can read true for an inconclusive test axis when another axis blocks | autonomy/completion-council.sh (the evidence-block.json write site only, ~line 2792), its test | MEDIUM | released@2026-09-27T15:00Z | Merged 8431bb39, pushed; quorum topped up 2/2 APPROVE. Same defect class BACKLOG 55 already fixed for evidence-gate-details.json, mirrored to this sibling write site. 60/60 on test-evidence-gate.sh (was 51/51). Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| S-22 | BACKLOG 63: `council_augment_from_managed_memory` runs `python3 -m memory.managed_memory.retrieve` after `cd "${PROJECT_DIR:-$(pwd)}"`; with PROJECT_DIR unset this can run the AGENT's own repo's memory/ package into the council prompt | autonomy/completion-council.sh (this one function only), its test | HIGH | released@2026-09-27T15:00Z | Merged a8e749be, pushed; quorum now 3/4 APPROVE + 1 CONCERN, the CONCERN scoped to the sibling `council_should_stop` function this diff doesn't touch, tracked separately as BACKLOG 127/S-25 and now also fixed and merged. PROJECT_DIR unset now returns 0 immediately (fail-closed no-op), matching the existing D7 pattern in council_managed_should_stop. Production unaffected (run.sh always sets PROJECT_DIR before sourcing this file). BACKLOG 127's sibling shadow-write RCE fix (56eb866f) separately re-verified from scratch by 2 fresh reviewers (unanimous APPROVE, no blocking findings), settling an earlier quorum-count discrepancy; independent RED/GREEN/control repro confirmed real on both bash 3.2 and bash 5.3. BACKLOG 132 opened for a bash-3.2-only mutant-detection gap the reviewers found in that fix's own test. Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| S-23 | BACKLOG 68: the resume union never prunes entries that became tracked -- a file the user committed between sessions is still unstaged by the session commit while the receipt lists it as modified | autonomy/run.sh (the resume-union logic only), its test | MEDIUM | released@2026-09-27T15:00Z | Merged 0bff408e, pushed. Two follow-up fixes combined on top of 5610cebb: (1) bash 3.2 syntax (5 apostrophe-in-comment instances, verified against a real 3.2.57 binary); (2) marker-clear bug (turn-in-flight cleared even on anchor-write failure, silently reintroducing the fail-unsafe scenario -- gated on write success). Merging this into main (which already had S-24's tamper-detection seal) surfaced a REAL interaction bug neither fix's own review could see in isolation: 6 test cases used `resume_log="$(setup_agent_branch ...)"`, a command-substitution subshell whose `_LOKI_SNAPSHOT_SEAL` update never reaches the parent shell -- a stale seal then mismatched the live (correctly pruned) files and fired a false SNAPSHOT_TAMPERED warning, blocking every commit. Confirmed test-only (production calls setup_agent_branch directly, never in `$(...)`); fixed by redirecting to a file instead, matching a pattern one existing test case already used with a comment documenting the exact hazard. 55/55 passing. Lesson: full-suite verification AFTER combining independently-reviewed fixes is not optional when they share mutable state. Follow-up review batch (marker-clear fix, merge-conflict resolution, 6-test-site subshell fix) closed: unanimous 2/2 APPROVE, no blocking findings, 62/62 and moat unchanged. Non-blocking notes recorded as BACKLOG follow-ups (stray stderr on failed tmp-write, a contrived directory-as-anchor edge case that still fails safe, no warning when the marker stays stuck). Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| S-24 | BACKLOG 70: the snapshot/hash state lives in agent-writable `.loki/state` -- an adversarial agent can add entries (hide/uncommit files) or delete the hash file (suppress preexisting_modified disclosure) | autonomy/run.sh (snapshot/hash file location and read/write guards only), its test | HIGH | released@2026-09-27T15:00Z | Merged c983c4fc + the awk-bypass fix c315cbe9, both pushed; quorum now 4/4 APPROVE on the awk fix. In-memory seal, checked at 3 read sites; a mismatch forces the existing fail-closed "commit nothing" path. Two rounds of adversarial review found and closed two real bypasses (`.pth`-file hijack, then a relocated `awk`-on-PATH bypass in the fix for the first). Digest computation now uses only fixed-path system tools and pure shell string handling, with hex validation. 51/51 regression, moat unchanged. BACKLOG 129/130 track the remaining follow-ups (writer/reader paths still bare python3 -E, audit-log digest values, session-created.z unsealed); BACKLOG 129's writer/reader hardening (merge 3e374500) now at full 4/4 HIGH-tier APPROVE quorum. Both bypass classes independently re-reproduced and re-confirmed closed by the top-up reviewers (.pth in Homebrew's own site-packages, fake git on PATH); legitimate-case output confirmed byte-identical pre/post fix. Non-blocking: BACKLOG 131 corrected for an undercounted/misattributed git-call inventory and a missing core.worktree mention; BACKLOG 132 opened for a bash-3.2-only mutant-detection gap in the shadow-write fix's own test (unrelated slice, found during the same top-up pass). Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| S-26 | Founder directive: `scripts/v10-pulse.sh`, the anti-drift status/violation reporter (docs/v10/CONTROL.md). See docs/v10/BACKLOG.md for the full spec. | scripts/v10-pulse.sh (new), tests/test-v10-pulse.sh (new), tests/run-all-tests.sh (registration) | MEDIUM | released@2026-09-27T15:00Z | Rework commit 169d7cbb (worktree-agent-a612cc8e14bb1265a, rebased onto current main) addresses all 3 original CONCERN findings: (1) git calls now explicitly pinned to `$PULSE_MAIN_REF` (6 call sites, verified by grep -- no bare git describe/log/show/rev-parse remain that should be pinned); (2) `--first-parent` added to the tag..MAIN_REF walk, verified against real repo history (128 commits without vs. 80 with, ~32min difference from swarm merge patterns) and a synthetic backdated-branch fixture; (3) MOAT_REGRESSION redesigned around `PULSE_MOAT_RESULT` (a file path to a captured `tests/moat/run.sh` output) as the sole trusted source -- a live suite FAIL is now always a violation regardless of count, a count-only drop fires separately, and with no result supplied the check reports UNKNOWN rather than a false clean. Real behavior change, disclosed by the builder: a default run with no `PULSE_MOAT_RESULT` can no longer exit 0 for this specific check. 31/31 own tests pass (both bash and real bash 3.2.57), shellcheck clean. Re-review: 2/2 APPROVE. Reviewer 2/2 (Sonnet) independently verified all 3 fixes via mutation testing (reverting each fix flips exactly its own test(s)), fed PULSE_MOAT_RESULT 5 different input shapes (real output, hand-crafted fixture, garbage, empty, nonexistent path) all degrading correctly to UNKNOWN or a true parse, confirmed the diff is scoped exactly to the 3 fixes with no regression elsewhere (31/31 full suite, bash -n and shellcheck clean on both bash versions, exit-code/BOARD/CONTROL.md checks all still correct against the real repo), and found one non-blocking documentation-precision nit (header comment doesn't mention the deliberate COULD-NOT-CHECK exclusion, though the actual code and its test T16b handle it correctly). Reviewer 1/2 (Opus) independently confirmed all 3 fixes with its own live/synthetic fixtures (cloned repo with HEAD pinned to an older tag to prove MAIN_REF pinning; a backdated-branch-merged-later fixture for --first-parent; a real `bash tests/moat/run.sh` run fed through PULSE_MOAT_RESULT showing the true 2-of-9-FAIL state where the original code claimed 3-of-9-clean) and flagged one good forward-looking note (the moat-result file isn't yet tied to a commit SHA -- tracked as BACKLOG 133 for the hook-wiring work, not blocking this merge). Unanimous 2/2 APPROVE. **Merged to main (3c3da457).** Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| S-27 | BACKLOG 125 B-1: P7 scanner reassignment-fallback bypass -- `let rows = data; if (!rows.length) rows = [rows]; setRows(rows);` -- `DECL_ARR` only matches the declaration form, never a later bare `x = [` assignment | tests/moat/p7-no-fabricated-data.sh (scanner rule + a new red/green case; never weaken an existing arm) | MEDIUM | released@2026-09-27T15:00Z | New `REASSIGN_ARR` regex + `DECL_KEYWORD` guard catches a fabricated array reassigned after declaration. Unanimous 2/2 APPROVE, both reviewers independently reproduced the bypass with their own fixtures. Non-blocking flag for whoever merges S-28 second: on a destructuring/parameter-default fixture that ALSO flows to a setter (untested by either slice today), whichever arm runs first wins the finding's MESSAGE (correct detection either way, just message-attribution -- "reassigned" vs "parameter default"). Recommend reordering DEFAULT_ARR ahead of REASSIGN_ARR when S-28 merges. 94137535. Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| S-28 | BACKLOG 125 B-2: P7 scanner destructuring/parameter-default bypass -- `const { rows = [rows] } = data;` or `function load(rows = [rows]) {}` -- neither is a `name = [` declaration the scanner recognizes | tests/moat/p7-no-fabricated-data.sh (scanner rule + a new red/green case; never weaken an existing arm) | MEDIUM | (not recorded; see Notes) | released@2026-09-28T01:11Z | Correction: stale building@ with no live agent and no commit of its own (git log --all --grep found none). Re-cut to ready. Dispatched 15:49 (S-29 released). Train 7 (release 9218ea04, v9.62.0, pushed 16:29:17Z, ls-remote and tag ^{} verified), unreviewed (founder "release everything"). The v9.62.0 Release run was cancelled at 16:30 (the tree carries the S-18 P9 regression). Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| S-29 | BACKLOG 125 B-5: P7 scanner module-level named fallback table -- `const FALLBACK_ROWS = [rows];` at column 0, referenced later via `data.length ? data : FALLBACK_ROWS` -- the column-0 exemption plus identifier-branch ternary both let it through unless the name matches sample/mock/demo/fake/placeholder | tests/moat/p7-no-fabricated-data.sh (scanner rule + a new red/green case; never weaken an existing arm) | MEDIUM | released@2026-09-27T15:00Z | Unanimous review across 6 rounds; round 6 (ab72ba3f) got a thorough final APPROVE that extended the discrimination check to 2 other call sites. Merge was non-trivial (S-29's chain predates S-27/S-32's own merges to this same file); a dedicated merge-pass agent reconciled all three lineages (5 conflict hunks, 2 mid-heredoc splices manually repaired), and a dedicated adversarial reviewer independently verified the reconciliation (read the full ~1364-line diff, confirmed heredoc balance, no duplicate definitions, all 3 lineages' fixtures intact, scanner and moat suite clean, built its own combined 3-lineage fixture confirming no shadowing). VOTE: APPROVE. Merged as 418b8f2f (a real 2-parent merge commit, content taken verbatim from the reviewed merge-pass commit cd0e5124 since main had not moved on this file since the merge-pass agent's own base -- confirmed via `git diff` before applying, avoiding a second unreviewed reconciliation attempt). Disclosed residual gap, not fixed here: an enclosing-paren confusion class (`(x || TABLE) && other` etc.), documented with a `ponytail:` comment for a future AST rewrite. Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| S-30 | BACKLOG 125 B-6: P7 scanner ternary-against-null bypass -- `const r = loading ? null : [rows];` -- `is_literal(null)` is true so the both-branches-literal exemption suppresses it; should only treat an array/object literal, never null/undefined/empty-string, as the "literal other branch" | tests/moat/p7-no-fabricated-data.sh (scanner rule + a new red/green case; never weaken an existing arm) | MEDIUM | (not recorded; see Notes) | released@2026-09-27T18:55Z | 1/1 CONCERN: fix only closes half the bypass class. `is_exempting_sibling()`'s `ABSENT` set (null/undefined/''/"") is correct but incomplete -- reviewer independently confirmed `false`/`0`/`{}`/`true` as the exempting sibling ALSO still produce zero findings, same fabrication shape, still invisible. Reviewer's suggested fix (confirmed to close all cases while preserving legitimate exemptions): require the exempting sibling itself be an array literal (`is_literal(v) and v.strip().startswith('[')`), not merely "not one of 4 named absence values." Also: line 920 (the `[rows] : X` ordering) ships with no fixture exercising `is_exempting_sibling` at all -- its own committed fixtures accidentally test the pre-existing identifier-branch path instead. Rework: switch to the array-literal-allowlist approach, add a `[rows] : null`-shaped fixture for line 920's own coverage. Sequences after S-29 per the shared-file note; S-29's own rework will need to route through whichever final helper S-30 ships (not the current is_exempting_sibling if it's replaced). Correction: stale building@ with no live agent and no commit of its own (git log --all --grep found none). Re-cut to ready. Batch 1 (build then review), dispatched 17:06. Review CONCERN/REJECT; rework plus re-review dispatched 17:49 (workflow wf_b1414df6-a66) with the reviewer findings. Rework re-review APPROVE (workflow wf_b1414df6-a66); train 6 pushed 0bd45144 at 18:10:14Z (ls-remote verified). Released in v9.67.0 (release commit 7f470727; publish-npm success). |
-| S-31 | BACKLOG 125 B-7: P7 scanner fabricated-return-from-helper bypass -- `function getRows(d) { if (!d) return [rows]; return d; } setRows(getRows(d))` -- no scanner arm follows a function's return value back to a fabricated literal | tests/moat/p7-no-fabricated-data.sh (scanner rule + a new red/green case; never weaken an existing arm) | MEDIUM | released@2026-09-28T01:11Z | Unanimous 2/2 APPROVE (mechanism + corrected comment, independently verified across two review rounds). Merge-base (10e09a98) is behind S-29's still-in-flight, much larger rework chain on this SAME file -- holding merge until S-29 lands to avoid a bad conflict, per the established shared-file sequencing convention. Will need a rebase pass onto post-S-29 main before merge, not a blind cherry-pick. Rebase onto post-S-29 main dispatched 15:49. Train 7 (release 9218ea04, v9.62.0, pushed 16:29:17Z, ls-remote and tag ^{} verified), unreviewed (founder "release everything"). The v9.62.0 Release run was cancelled at 16:30 (the tree carries the S-18 P9 regression). Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| S-32 | BACKLOG 125 B-8: P7 scanner `Array.from` generator bypass -- `Array.from({ length: 3 }, (_, i) => ({ id: i, action: 'Deployed', user: 'Admin' }))` invents field values inside a generator callback; the existing `Array.from` arm only checks a literal first argument | tests/moat/p7-no-fabricated-data.sh (scanner rule + a new red/green case; never weaken an existing arm) | MEDIUM | released@2026-09-27T15:00Z | New arm fires on `{length: N}` + concise-object-returning arrow, substitutes arrow params with 0 before reusing `is_literal`, requires >=1 literal string field post-substitution. Unanimous 2/2 APPROVE, both reviewers independently reproduced with distinct fixtures; reviewer 2 verified the 3-way merge onto current main via `git merge-file` before I merged it (zero conflicts, purely additive) and found a new non-blocking gap (nested Array.from generators losing an outer scope's loop variable through substitution) filed as BACKLOG 145. d49b26d7. Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| S-33 | BACKLOG 128: stale docs assert a `{"runner":"none","pass":true}` writer shape that doesn't exist (D20 corrected this; the real writer, `enforce_test_coverage` at run.sh:13250, writes `pass:"inconclusive"`, a string, never boolean true) | references/core-workflow.md, docs/VERIFIED-COMPLETION-PLAN.md, tests/test-council-devils-advocate.sh, tests/test-da-veto.sh, tests/test-council-convergence-floor.sh (fixture shapes only; do not touch any assertion logic) | LOW | released@2026-09-27T15:00Z | Not behaviorally load-bearing (harmless today since runner=='none' is unconditional at every reading site), but honesty/documentation-drift cleanup. Found and fixed a 4th documentation occurrence beyond the original bug report's scope. Confirmed a genuinely interesting residual coverage gap in test-council-convergence-floor.sh's NEGATIVE-B (correctly disclosed, not fixed -- out of this fixture-only slice's scope). 1/1 APPROVE. **Merged to main (90e26308).** Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| S-34 | BACKLOG 131(b): `_loki_snapshot_digest`'s python3 fallback (used only when neither sha256sum nor shasum resolves anywhere) is not yet routed through `_loki_snapshot_py_tool`/`-S`; a reviewer already reproduced that Homebrew python3 `-I` alone still fires a `.pth` planted in its own site-packages, so this is a confirmed real gap, not theoretical | autonomy/run.sh (`_loki_snapshot_digest`'s python3 fallback branch only), its test | MEDIUM | released@2026-09-27T15:00Z | Rebased to 0b1293d4 (worktree-agent-a63c48ba10e0c4eb0). Routes the fallback through `_loki_snapshot_py_tool` with `-I -S`, matching the BACKLOG 129 calling convention exactly. RED/GREEN/mutation-verified: reproduced the bypass on the old bare-`python3 -I` shape, confirmed the fix catches it, and separately confirmed `-S` specifically (not just the resolver routing) is load-bearing by testing routing-with-`-I`-only as its own mutation. Legitimate-case output confirmed byte-identical to an independent sha256sum/shasum oracle. Resolver-failure return code changed 0->1 (confirmed behavior-neutral for both real callers). 66/66 on test-branch-lifecycle.sh. Reviewer 1/2 (Opus) APPROVE: independently reproduced every claim in a fresh venv (the .pth-under-`-I`-fires/-under-`-I -S`-inert distinction, the RED/GREEN/mutation cycle, byte-identical legitimate-case output vs. an independent shasum oracle), confirmed the resolver-failure return-code change is behavior-neutral for both real callers with one factual correction (old code returned 127 on a fully-missing python3, not "0 silently" as the builder's note said; conclusion unchanged), and reported the real count is 68/68 (grew from 66 after S-35 also landed), not a discrepancy. No blocking findings; 2 minor non-blocking suggestions (a caller-comment clarification, an optional hex-format check on the fallback's own output). Reviewer 2/2 (Sonnet) also APPROVE: traced the full resolver fallback chain end to end (fail-closed confirmed at both seal and verify time), independently reproduced the .pth proof in an isolated venv, confirmed no completeness gap (grepped the full function body, only one python3 invocation remains and it's routed), confirmed no accidental overlap with S-35's `_loki_snapshot_verify` changes, and self-corrected one review-time framing error via advisor consultation before finalizing. 2/2 unanimous APPROVE. **Merged to main (ef204e24).** Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| S-35 | BACKLOG 130(a): `_loki_snapshot_verify`'s `SNAPSHOT_TAMPERED` audit log doesn't record the live vs. sealed digest values, so an operator can't distinguish a genuine content change from a flaky hash-tool failure (both produce the identical message) | autonomy/run.sh (`_loki_snapshot_verify`'s audit-log write site only), its test | LOW | released@2026-09-27T15:00Z | Both digest values added to the audit line; the audit call reordered to read the sealed digest before it gets cleared two lines later (confirmed necessary via direct reproduction, by both the builder and the reviewer independently). No decision logic changed. 1/1 APPROVE. 64/64 on test-branch-lifecycle.sh. **Merged to main (8e46535e).** Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| S-36 | BACKLOG 130(c): `.loki/state/session-created.z` is not covered by S-24's tamper-detection seal at all -- an agent could add a user's pre-existing files to it, causing a later resume to leave those files out of the snapshot and commit them as session work | autonomy/run.sh (session-created.z write/read sites only), its test | MEDIUM | released@2026-09-27T15:00Z | Two rounds. Round 1 (d2bf15c7) fixed the seal-failure sentinel to re-arm the guard (`"-"` not `""`). Round 2 (4da1f0d4) closed a FIFO/dangling-symlink substitution bypass found in round 1's review: a pre-check returning a distinct `"?"` sentinel for any non-regular, non-absent path, checked before the existing `[ -f ]` absent-check. HIGH-tier 3-reviewer unanimous APPROVE: reviewer 1 independently reproduced the pre-fix bypass and post-fix closure from scratch, traced the `-e`/`-L` dangling-symlink POSIX semantics precisely (`-e` false, `-L` true, confirming the `[ -L ] ||` half is load-bearing), tested real bash 3.2.57. Reviewer 2 independently confirmed the same, checked an internal TOCTOU angle and directory substitution (both fail safe). Reviewer 3 found a genuinely new angle (an intra-digest TOCTOU between the guard's two separate stat calls), reproduced it as a real race on both bash 5 and 3.2.57, then rigorously traced that it is strictly dominated by the already-disclosed, already-accepted verify-to-merge window at every real call site -- not a new bypass, just the same accepted race class. Merged as 7fd57df5 + 471a0cda (clean cherry-picks, no conflicts), 81/81 tests reconfirmed directly on main post-merge. Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| S-39 | BACKLOG 137: `tests/moat/p7-no-fabricated-data.sh`'s own workaround for the S-02 hardcoded-path bug (copy-and-sed-rewrite of `tests/lib-extract-client-paths.mjs`/`tests/lib-match-client-routes.py`) is now broken, since S-02 removed the hardcoded literal the sed relied on | tests/moat/p7-no-fabricated-data.sh (lines ~477-501 only) | LOW | released@2026-09-27T15:00Z | Fixed: `case_webapp_routes` now invokes the two helpers directly from `$REPO_ROOT`, no copy/sed. 1/1 APPROVE (reviewer reproduced the live bug, confirmed fix, ran a false-green check, confirmed `bash tests/moat/run.sh` restores 4/9 proven with P7 PROVEN). bf9776fb (cherry-picked onto local main, pending push). Confirmed locally: moat suite re-run shows P7 PROVEN, 4/9, no rule failed. Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| S-40 | BACKLOG 141 + 142: GF-3's P9 injection moat case unsets `LOKI_SDK_LOOP`/`LOKI_SDK_MODE`, no Bun-route coverage; found and fixed a real production Rule-of-Two leak in `claude_flags.ts` | tests/moat/p9-rule-of-two.sh, loki-ts/src/providers/claude_flags.ts, loki-ts/dist/loki.js(.map) | MEDIUM | released@2026-09-27T15:00Z | Fixed `ensureClaudeHelpCache()`'s bare `Bun.spawn` (no `env`, so Bun's startup snapshot bypassed the token-withholding delete) -- now passes `env: {...process.env}`. 1/1 APPROVE (reviewer independently rebuilt dist from source via git-archive and byte-diffed to confirm the shipped artifact is genuinely current, independently reproduced the mutation test showing a real injected push succeeding pre-fix, found additional out-of-scope spawn sites in doctor.ts/quality_gates.ts and confirmed they're unreachable from withholdGithubTokens()'s call path). P9 PROVEN on both routes post-merge, verified locally. 2f506f3e. Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| S-37 | BACKLOG 3: P9 Rule of Two gaps -- `loki-issue-to-pr.yml` holds issue text, secrets and push in one step; no `author_association` gate on `/loki`; checkout persists credentials; provider env keeps `GH_TOKEN` | .github/workflows/loki-issue-to-pr.yml, tests/moat/p9-rule-of-two.sh | HIGH | parked@2026-09-27T05:18Z | **Duplicate of GF-3** (same BACKLOG 3, same P9 files: .github/workflows/*.yml, tests/moat/p9-rule-of-two.sh). Caught before this was independently dispatched -- parked rather than run in parallel with GF-3 to avoid two agents solving the identical problem on the same files. Un-park only if GF-3 turns out to cover a narrower scope than this row once GF-3's actual diff is reviewed. |
-| S-38 | Founder directive follow-through: wire `.claude/settings.local.json` (local-only, never committed) with SessionStart + UserPromptSubmit hooks running `scripts/v10-pulse.sh`, plus `scripts/v10-drift-audit-counter.sh` for the every-6th-turn drift audit signal | .claude/settings.local.json (gitignored, not a repo file -- no PR/merge, tracked here for visibility only), scripts/v10-drift-audit-counter.sh (new, in-repo, this row's real deliverable) | LOW | released@2026-09-27T15:00Z | Verified hook exit-code semantics with claude-code-guide before wiring (exit 1/2 on UserPromptSubmit do NOT block, only exit 2 does; pass-through with no wrapper is correct). Combined pulse+counter output is 23-24 lines, under the 40-line budget. Confirmed FIRING FOR REAL via an actual UserPromptSubmit invocation (not just a manual test), captured verbatim in PROGRESS.md. Counter tested standalone across 7 simulated turns, correctly signals on turn 6. Committed `scripts/v10-drift-audit-counter.sh` directly (LOW tier, single new file, no production code path); `.claude/settings.local.json` itself is local config, not committed, per its own gitignore rule. Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| S-154 | GUARDS 5 + TODO 8: prune-worktrees.sh treats a cherry-picked branch (git cherry, no + lines) as merged; test forbids mtime signals | scripts/prune-worktrees.sh, tests/test-prune-worktrees.sh (new) | MEDIUM | bash tests/test-prune-worktrees.sh exits 0; cherry-picked fixture listed, one-unique-commit, locked and dirty fixtures kept; dropping the git cherry branch fails the case | released@2026-09-27T20:13Z | Removes worktrees only via git worktree remove. Captain registers the test. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on a41e625f; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). Published in v9.72.0 (`npm view loki-mode version` = 9.72.0; npm time 20:13Z). |
-| S-155 | Velocity: reachability scan (95s on CI, 47s local) under 10s via a per-module stem prefilter, identical verdicts | tests/lib/scan-unreachable-shipped.py | LOW | scan wall time under 10s; stdout and rc byte-identical to the pre-change capture; bash tests/test-no-unreachable-shipped.sh 4 passed 0 failed; removing one real require is still reported | released@2026-09-27T20:13Z | Builder measures regex vs I/O first and records both numbers. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on 3f786ce0; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). Published in v9.72.0 (`npm view loki-mode version` = 9.72.0; npm time 20:13Z). |
-| S-156 | BACKLOG 127 remainder: auto-capture shadow_write runs with PROJECT_DIR unset, and float() splices episode importance into python source | autonomy/run.sh (shadow_write auto-capture block about 21380-21396 only), tests/test-autocapture-shadow-write-guard.sh (new) | HIGH | bash tests/test-autocapture-shadow-write-guard.sh exits 0 under /bin/bash and bash 5; no marker from a planted cwd memory package; no file from an injected importance; trust-core suite passes | released@2026-09-27T20:13Z | Builder names who writes episode_path_file. Only run.sh row in this cut. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on 71d7a246; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). Published in v9.72.0 (`npm view loki-mode version` = 9.72.0; npm time 20:13Z). |
-| S-157 | BACKLOG 98/89: council member vote and _council_convergence_evidence_green read pass:true as green whatever failed_count says | autonomy/completion-council.sh (those 2 parsers only), tests/test-council-failed-count-honesty.sh (new) | HIGH | pass:true with failed_count 2 is not green at both sites; failed_count 0 stays green; trust-core and convergence-floor suites pass; reverting either site fails its case | released@2026-09-27T20:24Z | Mirrors the evidence gate rule (~2014). Only completion-council.sh row in this cut. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. 7a709fde (HIGH review APPROVE); in train 12, main ec01d54b pushed 20:05:58 (`git ls-remote origin refs/heads/main` = ec01d54b). Published in v9.73.0 (`npm view loki-mode version` = 9.73.0; npm time 2026-09-27T20:24Z). |
-| S-158 | BACKLOG 118: per-run cost_partial dropped by /api/cost/timeline runs[] and /api/proofs; pages show a lower bound as a total | dashboard/server.py (runs.append in _compute_cost_timeline and the /api/proofs row only), legacy-ui-static/cost.html, legacy-ui-static/proofs.html, tests/dashboard/test_cost_partial_surfaced.py (new) | MEDIUM | pytest test_cost_partial_surfaced.py passes; fixture cost_partial true surfaces in both endpoints and renders as at least $X; dropping the key fails | released@2026-09-27T20:13Z | Builder names the consumers checked. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on 931a93b6; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). Published in v9.72.0 (`npm view loki-mode version` = 9.72.0; npm time 20:13Z). |
-| S-159 | BACKLOG 114: NLSearch renders No results found when the search request failed | web-app/src/components/NLSearch.tsx, web-app/src/components/NLSearch.state.test.mjs (new) | LOW | node --test NLSearch.state.test.mjs passes incl. the negative assertion; npx tsc -b exits 0 | released@2026-09-27T20:13Z | Captain rebuilds web-app/dist. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on ea5b4462; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). Published in v9.72.0 (`npm view loki-mode version` = 9.72.0; npm time 20:13Z). |
-| S-160 | BACKLOG 114: CommandPalette file-search failure reads as No results found | web-app/src/components/CommandPalette.tsx, web-app/src/components/CommandPalette.state.test.mjs (new) | LOW | node --test CommandPalette.state.test.mjs passes; npx tsc -b exits 0 | released@2026-09-27T20:13Z | Captain rebuilds web-app/dist. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on 3f9873f3; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). Published in v9.72.0 (`npm view loki-mode version` = 9.72.0; npm time 20:13Z). |
-| S-161 | BACKLOG 114: ProjectsPage ignores usePolling error and says No projects yet on a failed fetch | web-app/src/pages/ProjectsPage.tsx, web-app/src/pages/ProjectsPage.state.test.mjs (new) | LOW | node --test ProjectsPage.state.test.mjs passes (error, stale-data and real-empty cases); npx tsc -b exits 0 | released@2026-09-27T20:13Z | Captain rebuilds web-app/dist. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on d2dd3645; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). Published in v9.72.0 (`npm view loki-mode version` = 9.72.0; npm time 20:13Z). |
-| S-162 | BACKLOG 114: SecretsPanel and DocsPanel swallow fetch errors into No secrets / No documentation empty states | web-app/src/components/ProjectWorkspace.tsx (SecretsPanel and DocsPanel fetch and empty branches only), web-app/src/components/ProjectWorkspace.panels.test.mjs (new) | LOW | node --test ProjectWorkspace.panels.test.mjs passes; npx tsc -b exits 0 | released@2026-09-27T20:13Z | Captain rebuilds web-app/dist. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on 6f6a6207; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). Published in v9.72.0 (`npm view loki-mode version` = 9.72.0; npm time 20:13Z). |
-| S-163 | BACKLOG 114: CICDPanel maps neutral/action_required/stale/null conclusions to Failed and unknown statuses to running | web-app/src/components/CICDPanel.tsx (3 normalizers and status map only), web-app/src/components/CICDPanel.status.test.mjs (new) | LOW | node --test CICDPanel.status.test.mjs passes for every conclusion; npx tsc -b exits 0 | released@2026-09-27T20:13Z | Captain rebuilds web-app/dist. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on 36052758; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). Published in v9.72.0 (`npm view loki-mode version` = 9.72.0; npm time 20:13Z). |
-| S-164 | BACKLOG 114: AIChatPanel prints Done. for a non-zero exit with no output | web-app/src/components/AIChatPanel.tsx (the two Done. fallbacks only), web-app/src/components/AIChatPanel.result.test.mjs (new) | LOW | node --test AIChatPanel.result.test.mjs passes; npx tsc -b exits 0 | released@2026-09-27T20:13Z | Captain rebuilds web-app/dist. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on 8aceef56; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). Published in v9.72.0 (`npm view loki-mode version` = 9.72.0; npm time 20:13Z). |
-| S-165 | BACKLOG 117 remainder: TrustedBy asserts Trusted by developers; ChangelogWidget shows March 2026 v6.x as Recent Changes | web-app/src/components/TrustedBy.tsx, web-app/src/components/ChangelogWidget.tsx | LOW | grep for Trusted by developers and 6.71.1 in those files returns rc 1; npx tsc -b exits 0 | released@2026-09-27T20:13Z | Copy only. Captain rebuilds web-app/dist. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on 97ba623f; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). Published in v9.72.0 (`npm view loki-mode version` = 9.72.0; npm time 20:13Z). |
-| S-166 | BACKLOG 114: checkpoint viewer ignores a rejected allSettled fetch and clears the error | legacy-ui/components/loki-checkpoint-viewer.js (load block only), legacy-ui/tests/loki-checkpoint-viewer-fetch-error.node.test.mjs (new) | LOW | node --test the new file passes incl. the negative assertion | released@2026-09-27T20:13Z | Captain rebuilds legacy-ui-static/index.html. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on 4035d21d; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). Published in v9.72.0 (`npm view loki-mode version` = 9.72.0; npm time 20:13Z). |
-| S-167 | BACKLOG 114: council transcripts render a failed hook-events read as zero events | legacy-ui/components/loki-council-transcripts.js (hook events load only), legacy-ui/tests/loki-council-transcripts-fetch-error.node.test.mjs (new) | LOW | node --test the new file passes | released@2026-09-27T20:13Z | Captain rebuilds legacy-ui-static/index.html. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on 3fea74e8; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). Published in v9.72.0 (`npm view loki-mode version` = 9.72.0; npm time 20:13Z). |
-| S-168 | BACKLOG 114: task board hides a server load error whenever local tasks exist | legacy-ui/components/loki-task-board.js (catch and error render only), legacy-ui/tests/loki-task-board-fetch-error.node.test.mjs (new) | LOW | node --test the new file passes; loki-task-board-modal-guard test still passes | released@2026-09-27T20:13Z | Captain rebuilds legacy-ui-static/index.html. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on aa2a64a4; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). Published in v9.72.0 (`npm view loki-mode version` = 9.72.0; npm time 20:13Z). |
-| S-169 | BACKLOG 114: log stream swallows API failures with an empty catch | legacy-ui/components/loki-log-stream.js (API poll catch and empty render only), legacy-ui/tests/loki-log-stream-fetch-error.node.test.mjs (new) | LOW | node --test the new file passes; loki-poll-registry test still passes | released@2026-09-27T20:24Z | Captain rebuilds legacy-ui-static/index.html. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. a990a9ce review REJECT; rework dispatched 19:57Z. 707283f3 (re-review APPROVE, runner lists 598 = main + 1); in train 12, main ec01d54b pushed 20:05:58 (`git ls-remote origin refs/heads/main` = ec01d54b). Published in v9.73.0 (`npm view loki-mode version` = 9.73.0; npm time 2026-09-27T20:24Z). |
-| S-170 | BACKLOG 114: API keys panel renders No API keys configured under its own load-error banner | legacy-ui/components/loki-api-keys.js (table branch only), legacy-ui/tests/loki-api-keys-fetch-error.node.test.mjs (new) | LOW | node --test the new file passes; error render lacks the empty-state sentence | released@2026-09-27T20:13Z | Captain rebuilds legacy-ui-static/index.html. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on ab837a75; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). Published in v9.72.0 (`npm view loki-mode version` = 9.72.0; npm time 20:13Z). |
-| S-171 | BACKLOG 124: lint for response fields interpolated into innerHTML without the escape helper | tests/test-no-unescaped-innerhtml.sh (new), tests/lib/scan-unescaped-innerhtml.py (new) | MEDIUM | passes on main with a reasoned in-file allowlist; planted fixture exits 1; empty-reason entry fails; at least 20 files scanned | released@2026-09-27T20:24Z | Any real XSS found is reported only; repairs go to separate slices. Captain registers. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. db501eba (review APPROVE); in train 12, main ec01d54b pushed 20:05:58 (`git ls-remote origin refs/heads/main` = ec01d54b). Published in v9.73.0 (`npm view loki-mode version` = 9.73.0; npm time 2026-09-27T20:24Z). |
-| S-172 | BACKLOG 132: shadow-write mutant check is green on bash 5.3 and red on /bin/bash 3.2 | tests/test-council-shadow-write-project-dir.sh | LOW | bash tests/test-council-shadow-write-project-dir.sh exits 0; mutant leg red under both /bin/bash and PATH bash, both versions printed | released@2026-09-27T20:13Z | Test-only. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on e2114d09; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). Published in v9.72.0 (`npm view loki-mode version` = 9.72.0; npm time 20:13Z). |
-| S-173 | BACKLOG 135: P2.council-readers-not-shadowed does not drive council_managed_should_stop (cwd-shadow class only) | tests/moat/p2-honest-verdict.sh (that case only) | HIGH | p2-honest-verdict.sh prints CASE P2.council-readers-not-shadowed PASS; removing the sys.path filter in a scratch copy prints FAIL | released@2026-09-27T20:13Z | No .pth leg: that reader is still python3 -E, so a .pth leg would redden a proven case; follows alternate A2. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on 6bc4b5cf; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). Published in v9.72.0 (`npm view loki-mode version` = 9.72.0; npm time 20:13Z). |
-| S-174 | Guard: run_test with a missing or empty argument stops run-all-tests.sh with no summary and skips later suites | tests/run-all-tests.sh (run_test guard and missing-script return only), tests/test-run-all-missing-arg.sh (new) | MEDIUM | bash tests/test-run-all-missing-arg.sh exits 0 with Failed: 1 per leg (one-arg, empty-arg, missing-script) and the later stub's PASSED line printed; guard removed in a scratch copy exits 1; bash tests/test-run-all-dispatch.sh and LOKI_TEST_LIST=1 bash tests/test-shard-coverage.sh exit 0 | released@2026-09-27T20:54Z | Source: 19:57Z cut. Batch 7 (wf_a3ea2c8c-560), build then review. Review APPROVE on a9793dd4; in train 13, main 28e62e44 pushed 20:35:00 (`git ls-remote origin refs/heads/main` = 28e62e44). Published in v9.74.0 (`npm view loki-mode version` = 9.74.0; npm time 2026-09-27T20:54Z). |
-| S-175 | BACKLOG 62: a whitelist-rejected LOKI_MONOREPO_TEST_CMD records pass true and touches unit-tests.pass | autonomy/run.sh (enforce_test_coverage monorepo-custom-rejected branch only), tests/test-monorepo-rejected-cmd-inconclusive.sh (new) | HIGH | bash tests/test-monorepo-rejected-cmd-inconclusive.sh exits 0: pass is "inconclusive", status not_run, no unit-tests.pass; reverting the branch exits 1; bash tests/test-trust-core-tests-detect.sh exits 0 | released@2026-09-27T20:54Z | Source: 19:57Z cut. Batch 7 (wf_a3ea2c8c-560), build then review. Review APPROVE on 1fe8b6a3; in train 13, main 28e62e44 pushed 20:35:00 (`git ls-remote origin refs/heads/main` = 28e62e44). Published in v9.74.0 (`npm view loki-mode version` = 9.74.0; npm time 2026-09-27T20:54Z). |
-| S-176 | BACKLOG 98: proof headline reads a stale test-results.json (_collect_tests has no .test-results.iter check) | autonomy/lib/proof-generator.py (_collect_tests only), tests/test_proof_tests_freshness.py (new) | HIGH | python3 -m pytest -q tests/test_proof_tests_freshness.py passes: ITERATION_COUNT=5 with marker 4 gives facts.tests.status not_run and a headline unlike the fresh case; marker 5 keeps the prior status; removing the check fails the stale case | released@2026-09-27T20:54Z | Source: 19:57Z cut. Batch 7 (wf_a3ea2c8c-560), build then review. Review APPROVE on 4890459d; in train 13, main 28e62e44 pushed 20:35:00 (`git ls-remote origin refs/heads/main` = 28e62e44). Published in v9.74.0 (`npm view loki-mode version` = 9.74.0; npm time 2026-09-27T20:54Z). |
-| S-177 | BACKLOG 98: Bun npm-test fallback reads an exit-0 run that prints failures as passed | loki-ts/src/runner/quality_gates.ts (runTestCoverage npm fallback only), loki-ts/tests/runner/npm_fallback_summary_failures.test.ts (new) | HIGH | cd loki-ts && bun test tests/runner/npm_fallback_summary_failures.test.ts exits 0: jest Tests 1 failed, vitest Test Files 1 failed and pytest 1 passed 1 error all return passed false; Tests 3 passed returns passed true; removing the parse fails the first three | released@2026-09-27T20:54Z | Source: 19:57Z cut. Batch 7 (wf_a3ea2c8c-560), build then review. Review APPROVE on 19174010; in train 13, main 28e62e44 pushed 20:35:00 (`git ls-remote origin refs/heads/main` = 28e62e44). Published in v9.74.0 (`npm view loki-mode version` = 9.74.0; npm time 2026-09-27T20:54Z). |
-| S-178 | BACKLOG 112: /api/cost reads tracker tokens without a USD total as a measured $0 and labels the model sonnet | dashboard/server.py (get_cost context-tracker fallback only), tests/dashboard/test_cost_tracker_fallback_unmeasured.py (new) | MEDIUM | python3 -m pytest -q tests/dashboard/test_cost_tracker_fallback_unmeasured.py passes (tokens without total_cost_usd give cost null; recorded 0.0 stays 0.0; no provider gives model unknown); reverting fails case 1; bash tests/moat/p7-no-fabricated-data.sh prints CASE P7.unmeasured-cost-never-zero PASS | released@2026-09-27T20:54Z | Source: 19:57Z cut. Batch 7 (wf_a3ea2c8c-560), build then review. Review APPROVE on e80a0a5c; in train 13, main 28e62e44 pushed 20:35:00 (`git ls-remote origin refs/heads/main` = 28e62e44). Published in v9.74.0 (`npm view loki-mode version` = 9.74.0; npm time 2026-09-27T20:54Z). |
-| S-179 | BACKLOG 106: loki cost puts 0.0 in place of unknown spend | autonomy/loki (cmd_cost only), tests/test-loki-cost-unmeasured.sh (new) | MEDIUM | bash tests/test-loki-cost-unmeasured.sh exits 0: cap 10 with no measured records gives --json used null and percent null; measured 2.50 gives 2.5 and 25.0; reverting fails the first leg | released@2026-09-27T20:54Z | Source: 19:57Z cut. Batch 7 (wf_a3ea2c8c-560), build then review. Review APPROVE on 3f0dff83; in train 13, main 28e62e44 pushed 20:35:00 (`git ls-remote origin refs/heads/main` = 28e62e44). Published in v9.74.0 (`npm view loki-mode version` = 9.74.0; npm time 2026-09-27T20:54Z). |
-| S-180 | BACKLOG 144: P7 helper-return arm misses class-method helpers | tests/moat/p7-no-fabricated-data.sh (helper-return arm only) | HIGH | bash tests/moat/p7-no-fabricated-data.sh prints PASS for every P7 case and flags the in-script class-method fixture; removing the method-head pattern lets the fixture through; tests/moat/cases.txt unchanged | released@2026-09-27T20:54Z | Source: 19:57Z cut. Batch 7 (wf_a3ea2c8c-560), build then review. Review APPROVE on e8d30a0b; in train 13, main 28e62e44 pushed 20:35:00 (`git ls-remote origin refs/heads/main` = 28e62e44). Published in v9.74.0 (`npm view loki-mode version` = 9.74.0; npm time 2026-09-27T20:54Z). |
-| S-181 | GUARDS 11: v10-guard blocks a glob rm whose parent is a shared root (/tmp, TMPDIR, scratchpad) | scripts/v10-guard.sh (Rule 4 region only), tests/test-v10-guard.sh, docs/v10/GUARDS.md (section 11 only) | MEDIUM | bash tests/test-v10-guard.sh exits 0 with rm -f /tmp/*.log and rm -f scratchpad/* blocked and rm -f /tmp/run-1/*.log allowed; dropping the new rule fails the blocked cases | released@2026-09-27T21:15Z | Source: 19:57Z cut. Batch 7 (wf_a3ea2c8c-560), build then review. 692ec781 review CONCERN (relative glob in scratchpad root); rework 310d2fed, re-review in batch 8 (wf_ff8d537c-40e). Review APPROVE on 310d2fed (re-review APPROVE); in train 14, main 04af133a pushed 20:58:10 (`git ls-remote origin refs/heads/main` = 04af133a). Published in v9.75.0 (`npm view loki-mode version` = 9.75.0; npm time 2026-09-27T21:15Z). |
-| S-182 | docs/exit-codes.md omits the pending loki verify codes (verify --fast exits 0 on INCONCLUSIVE until v10.0.0) | docs/exit-codes.md (loki verify section only) | LOW | bash tests/test-exit-codes-documented.sh exits 0; grep -n P2.fast-verify-inconclusive-not-zero docs/exit-codes.md prints one line; the four measured codes appear in the report with their commands | released@2026-09-27T21:15Z | Source: 19:57Z cut. Batch 8 (wf_ff8d537c-40e), build then review. Review APPROVE on 4b4af831; in train 14, main 04af133a pushed 20:58:10 (`git ls-remote origin refs/heads/main` = 04af133a). Published in v9.75.0 (`npm view loki-mode version` = 9.75.0; npm time 2026-09-27T21:15Z). |
-| S-183 | BACKLOG 114: migration dashboard renders a failed load as No migration data available | legacy-ui/components/loki-migration-dashboard.js (error render branch only), legacy-ui/tests/loki-migration-dashboard-fetch-error.node.test.mjs (new) | LOW | node --test legacy-ui/tests/loki-migration-dashboard-fetch-error.node.test.mjs passes: a rejected fetch renders Could not load and lacks the empty-state sentence; an empty list still renders No migrations found | released@2026-09-27T20:54Z | Source: 19:57Z cut. Batch 7 (wf_a3ea2c8c-560), build then review. Review APPROVE on 1f0dd435; in train 13, main 28e62e44 pushed 20:35:00 (`git ls-remote origin refs/heads/main` = 28e62e44). Published in v9.74.0 (`npm view loki-mode version` = 9.74.0; npm time 2026-09-27T20:54Z). |
-| S-184 | BACKLOG 114: managed memory panel ignores a 200 events payload carrying error | legacy-ui/components/loki-managed-memory-panel.js (events load only), legacy-ui/tests/loki-managed-memory-events-error.node.test.mjs (new) | LOW | node --test legacy-ui/tests/loki-managed-memory-events-error.node.test.mjs passes: the error payload renders the error line and not the empty sentence; events [] with no error still renders the empty sentence | released@2026-09-27T20:54Z | Source: 19:57Z cut. Batch 7 (wf_a3ea2c8c-560), build then review. Review APPROVE on 13a33840; in train 13, main 28e62e44 pushed 20:35:00 (`git ls-remote origin refs/heads/main` = 28e62e44). Published in v9.74.0 (`npm view loki-mode version` = 9.74.0; npm time 2026-09-27T20:54Z). |
-| S-185 | BACKLOG 114: DeployConnections rows read Not connected under their own load error | web-app/src/components/DeployConnections.tsx (row status render only), web-app/src/components/DeployConnections.state.test.mjs (new) | LOW | node --test web-app/src/components/DeployConnections.state.test.mjs passes: no row reads Not connected after a failed fetch; a real connected false still does; cd web-app && npx tsc -b exits 0 | released@2026-09-27T20:54Z | Source: 19:57Z cut. Batch 7 (wf_a3ea2c8c-560), build then review. Review APPROVE on d88c64ac; in train 13, main 28e62e44 pushed 20:35:00 (`git ls-remote origin refs/heads/main` = 28e62e44). Published in v9.74.0 (`npm view loki-mode version` = 9.74.0; npm time 2026-09-27T20:54Z). |
-| S-186 | BACKLOG 116: issue list comment count never shows (gh sends comments as an array) | web-app/src/components/GitHubIssuesPanel.tsx (list comment badge only), web-app/src/types/api.ts (GitHubIssue.comments only), web-app/src/components/GitHubIssuesPanel.comments.test.mjs (new) | LOW | node --test web-app/src/components/GitHubIssuesPanel.comments.test.mjs passes: array of 2 renders 2, number 3 renders 3; cd web-app && npx tsc -b exits 0 | released@2026-09-27T20:54Z | Source: 19:57Z cut. Batch 7 (wf_a3ea2c8c-560), build then review. Review APPROVE on 3817c6f3; in train 13, main 28e62e44 pushed 20:35:00 (`git ls-remote origin refs/heads/main` = 28e62e44). Published in v9.74.0 (`npm view loki-mode version` = 9.74.0; npm time 2026-09-27T20:54Z). |
-| S-187 | BACKLOG 118: CostEstimator prices the whole iteration cap as the estimate | web-app/src/components/ProjectWorkspace.tsx (CostEstimator props only), web-app/src/components/CostEstimator.tsx (export only if needed), web-app/src/components/CostEstimator.estimate.test.mjs (new) | LOW | node --test web-app/src/components/CostEstimator.estimate.test.mjs passes; grep -n 'estimatedIterations={buildStatus.maxIterations' web-app/src/components/ProjectWorkspace.tsx exits 1; cd web-app && npx tsc -b exits 0 | released@2026-09-27T20:54Z | Source: 19:57Z cut. Batch 7 (wf_a3ea2c8c-560), build then review. Review APPROVE on d03a237e; in train 13, main 28e62e44 pushed 20:35:00 (`git ls-remote origin refs/heads/main` = 28e62e44). Published in v9.74.0 (`npm view loki-mode version` = 9.74.0; npm time 2026-09-27T20:54Z). |
-| S-188 | BACKLOG 123: overview proof card wording has no test of its own | legacy-ui/tests/loki-overview-proof-card.node.test.mjs (new) | LOW | node --test legacy-ui/tests/loki-overview-proof-card.node.test.mjs passes: no proof reads Not evaluated, a headline carries the recorded-copy prefix, gaps null reads uncertainty not measured; deleting the prefix in a scratch copy fails it | released@2026-09-27T20:54Z | Source: 19:57Z cut. Batch 7 (wf_a3ea2c8c-560), build then review. Review APPROVE on 6d965cca; in train 13, main 28e62e44 pushed 20:35:00 (`git ls-remote origin refs/heads/main` = 28e62e44). Published in v9.74.0 (`npm view loki-mode version` = 9.74.0; npm time 2026-09-27T20:54Z). |
-| S-189 | BACKLOG 114: learning dashboard renders failed metrics and trends reads as no data | legacy-ui/components/loki-learning-dashboard.js (metrics and trends load plus their two empty branches only), legacy-ui/tests/loki-learning-dashboard-fetch-error.node.test.mjs (new) | LOW | node --test legacy-ui/tests/loki-learning-dashboard-fetch-error.node.test.mjs passes: rejected metrics and trends render Could not load; an empty trends response still renders No trend data available | released@2026-09-27T20:54Z | Source: 19:57Z cut. Batch 7 (wf_a3ea2c8c-560), build then review. Review APPROVE on a746655f; in train 13, main 28e62e44 pushed 20:35:00 (`git ls-remote origin refs/heads/main` = 28e62e44). Published in v9.74.0 (`npm view loki-mode version` = 9.74.0; npm time 2026-09-27T20:54Z). |
-| S-190 | BACKLOG 112: R3 design doc describes project_total_usd as a plain sum | docs/R3-COST-OBSERVABILITY-DESIGN.md | LOW | grep -n 'sum of per-run proof costs' docs/R3-COST-OBSERVABILITY-DESIGN.md exits 1; grep -n project_total_partial docs/R3-COST-OBSERVABILITY-DESIGN.md prints at least one line | released@2026-09-27T21:15Z | Source: 19:57Z cut. Batch 8 (wf_ff8d537c-40e), build then review. Review APPROVE on 1d6786bf; in train 14, main 04af133a pushed 20:58:10 (`git ls-remote origin refs/heads/main` = 04af133a). Published in v9.75.0 (`npm view loki-mode version` = 9.75.0; npm time 2026-09-27T21:15Z). |
-| S-191 | Bring tests/test-review-assurance-tail.sh under 60 s wall time with bounded concurrency, keeping every per-case budget and assertion unchanged. | tests/test-review-assurance-tail.sh, tests/shard-durations.tsv (update its row) | RED: `time bash tests/test-review-assurance-tail.sh` over 60 s today (memory says load-flaky). GREEN: under 60 s on 3 consecutive runs, with identical pass counts printed, and every case still runs (compare the case-name lists before and after). Under `LOKI_TEST_JOBS=1` it still passes. Each parallel case uses its own run-owned temp dir; record and wait on your own PIDs only. Reuse built commit 63396544 (branch worktree-wf_ff8d537c-40e-4) as a starting point after rebasing. No CHANGELOG. | MEDIUM | released@2026-10-16T00:49Z | df4f23207..328ad1f05 on main (MEDIUM TL APPROVE), shard row 116 to 45 |
-| S-192 | BACKLOG 112: no test drives the web-app WebSocket status push payload for unmeasured cost | web-app/tests/test_status_push_unmeasured.py (new), web-app/server.py (lift the nested status reader only if needed) | MEDIUM | python3 -m pytest -q web-app/tests/test_status_push_unmeasured.py passes: no tokens gives cost null and max_iterations null, priced tokens give a number; forcing 0.0 in a scratch copy fails case 1 | released@2026-09-27T21:15Z | Source: 19:57Z cut. Batch 8 (wf_ff8d537c-40e), build then review. Review APPROVE on 0b6deb16; in train 14, main 04af133a pushed 20:58:10 (`git ls-remote origin refs/heads/main` = 04af133a). Published in v9.75.0 (`npm view loki-mode version` = 9.75.0; npm time 2026-09-27T21:15Z). |
-| S-193 | Velocity: v10-ops worktree-budget prints how many worktrees a batch may open before dispatch | scripts/v10-ops.sh (new worktree-budget subcommand), tests/test-v10-ops.sh | LOW | bash tests/test-v10-ops.sh exits 0; scripts/v10-ops.sh worktree-budget 15 prints 15 minus the .claude/worktrees entries in git worktree list --porcelain, and at or over the cap prints 0 and exits 1 | released@2026-09-27T21:15Z | Source: 19:57Z cut. Batch 8 (wf_ff8d537c-40e), build then review. Review APPROVE on a0d7a34d; in train 14, main 04af133a pushed 20:58:10 (`git ls-remote origin refs/heads/main` = 04af133a). Published in v9.75.0 (`npm view loki-mode version` = 9.75.0; npm time 2026-09-27T21:15Z). |
-| S-194 | BACKLOG 108: LOKI_AUTO_PR pushes a branch whose history still holds user files | autonomy/run.sh (create_session_pr only; does not overlap S-175 or S-195), tests/test-auto-pr-agent-committed-refuse.sh (new) | HIGH | bash tests/test-auto-pr-agent-committed-refuse.sh exits 0: auto path with a record makes no push, returns 1 and prints git reset --soft; advisory path prints the cleanup before git push -u; empty record pushes; removing the record read in a scratch copy fails leg 1; bash tests/test-trusted-push-agent-config.sh exits 0 | released@2026-09-27T21:45Z | Source: 20:12Z cut. Batch 8 (wf_ff8d537c-40e), build then review. 7a4b59d7 review CONCERN; rework in batch 9 (wf_4da25841-89e). Review APPROVE on 52a0ac1e (HIGH re-review APPROVE); in train 16, main 800ac46e pushed 21:25:40 (`git ls-remote origin refs/heads/main` = 800ac46e). Published in v9.76.0 (`npm view loki-mode version` = 9.76.0; npm time 2026-09-27T21:45Z). |
-| S-195 | BACKLOG 17: /api/focus POST fires with the dashboard disabled | autonomy/run.sh (dashboard focus notify block only; does not overlap S-175 or S-194), tests/test-focus-post-dashboard-off.sh (new) | MEDIUM | bash tests/test-focus-post-dashboard-off.sh exits 0: ENABLE_DASHBOARD=false leaves the curl shim log empty, true records one POST; removing the guard in a scratch copy fails the false leg | released@2026-09-28T01:11Z | Source: 20:12Z cut. Batch 8 (wf_ff8d537c-40e), build then review. Re-dispatched review APPROVE on 5c86639e (`bash tests/test-focus-post-dashboard-off.sh` 3/3, red 2/3 on parent); cherry-picked onto main 21:40Z. Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| S-196 | council_managed_should_stop diffs Loki's install tree and runs -E readers | autonomy/completion-council.sh (council_managed_should_stop only), tests/moat/p2-honest-verdict.sh (case_council_readers_no_user_site_pth plus the ~858 comment), tests/test-council-managed-diff-target.sh (new) | HIGH | bash tests/moat/p2-honest-verdict.sh prints CASE P2.council-readers-no-user-site-pth PASS and CASE P2.council-readers-not-shadowed PASS; bash tests/test-council-managed-diff-target.sh exits 0 with the target-only file in _CC_DIFF; reverting the readers to -E makes the pth case FAIL; bash tests/moat/run.sh reports no rule failed | released@2026-09-27T21:45Z | Source: 20:12Z cut. Batch 8 (wf_ff8d537c-40e), build then review. a7bc805a review CONCERN; rework in batch 9 (wf_4da25841-89e). Review APPROVE on 6cb0cfec (HIGH re-review APPROVE); in train 15, main e72bcd66 pushed 21:22:34 (`git ls-remote origin refs/heads/main` = e72bcd66). Published in v9.76.0 (`npm view loki-mode version` = 9.76.0; npm time 2026-09-27T21:45Z). |
-| S-197 | BACKLOG 51: NOT CHECKED text should name PYTHONPATH and PYTHONUSERBASE | autonomy/loki (loki_remote_verify_receipt attestation NOT CHECKED branch and cmd_proof --jwks NOT CHECKED echo only; does not overlap S-179), tests/test-proof-verify-jwks.sh (case 4 only) | LOW | bash tests/test-proof-verify-jwks.sh exits 0 with case 4 asserting PYTHONUSERBASE in the NOT CHECKED output; grep -c PYTHONUSERBASE autonomy/loki prints 2 or more; bash tests/test-remote-attestation-verdict.sh exits 0 | released@2026-09-27T21:45Z | Source: 20:12Z cut. Batch 8 (wf_ff8d537c-40e), build then review. 04310c0a review CONCERN; rework in batch 9 (wf_4da25841-89e). Review APPROVE on d5afb96b (re-review APPROVE); in train 15, main e72bcd66 pushed 21:22:34 (`git ls-remote origin refs/heads/main` = e72bcd66). Published in v9.76.0 (`npm view loki-mode version` = 9.76.0; npm time 2026-09-27T21:45Z). |
-| S-198 | BACKLOG 145: P7 Array.from arm loses an outer generator's index when generators nest | tests/moat/p7-no-fabricated-data.sh (Array.from generator arm ~1934-1994 and one fixture beside the B-8 fixture ~3301 only; does not overlap S-180) | HIGH | bash tests/moat/p7-no-fabricated-data.sh prints PASS for every P7 case and flags the nested fixture; removing the outer substitution lets it through; tests/moat/cases.txt unchanged | released@2026-09-27T21:45Z | Source: 20:12Z cut. Batch 9 (wf_4da25841-89e), build then review. Review APPROVE on 78a35aa5; in train 15, main e72bcd66 pushed 21:22:34 (`git ls-remote origin refs/heads/main` = e72bcd66). Published in v9.76.0 (`npm view loki-mode version` = 9.76.0; npm time 2026-09-27T21:45Z). |
-| S-199 | py-tool identity test covers every guarded _loki_snapshot_py_tool copy under autonomy/ | tests/test-council-py-tool-identity.sh | LOW | bash tests/test-council-py-tool-identity.sh exits 0 and prints the number of copies compared (at least 1 besides run.sh); a one-byte change to completion-council.sh's copy in a scratch tree exits 1 | released@2026-09-27T21:15Z | Source: 20:12Z cut. Batch 8 (wf_ff8d537c-40e), build then review. Review APPROVE on 41c07bd1; in train 14, main 04af133a pushed 20:58:10 (`git ls-remote origin refs/heads/main` = 04af133a). Published in v9.75.0 (`npm view loki-mode version` = 9.75.0; npm time 2026-09-27T21:15Z). |
-| S-200 | BACKLOG 54: done-recognition readers load user-site .pth (-E only) | autonomy/lib/done-recognition.sh (python3 sites plus guarded helper copy), tests/test-done-recognition-no-user-site-pth.sh (new) | HIGH | bash tests/test-done-recognition-no-user-site-pth.sh exits 0 and reverting one site to -E in a scratch copy fails it; bash tests/test-done-recognition-tests-axis.sh and bash tests/test-reuse-done-recognition.sh exit 0 | released@2026-09-27T21:15Z | Source: 20:12Z cut. Batch 8 (wf_ff8d537c-40e), build then review. Review APPROVE on 6a55b22f; in train 14, main 04af133a pushed 20:58:10 (`git ls-remote origin refs/heads/main` = 04af133a). Published in v9.75.0 (`npm view loki-mode version` = 9.75.0; npm time 2026-09-27T21:15Z). |
-| S-201 | BACKLOG 54: council-v2 readers load .pth; a crashed sycophancy check skips the devil's advocate | autonomy/council-v2.sh (python3 sites, Step 4 and 5 fallbacks, guarded helper copy), tests/test-council-v2-no-user-site-pth.sh (new) | MEDIUM | bash tests/test-council-v2-no-user-site-pth.sh exits 0 (pth leg and detector-failure leg run the devil's advocate on a unanimous approve); reverting either change fails its leg; bash tests/test-council-v2-quorum.sh exits 0 | released@2026-09-27T21:15Z | Source: 20:12Z cut. Batch 8 (wf_ff8d537c-40e), build then review. Review APPROVE on 72851565; in train 14, main 04af133a pushed 20:58:10 (`git ls-remote origin refs/heads/main` = 04af133a). Published in v9.75.0 (`npm view loki-mode version` = 9.75.0; npm time 2026-09-27T21:15Z). |
-| S-202 | BACKLOG 54: voter-agents readers load user-site .pth (-E only) | autonomy/lib/voter-agents.sh (3 python3 sites plus guarded helper copy), tests/test-voter-agents-no-user-site-pth.sh (new) | HIGH | bash tests/test-voter-agents-no-user-site-pth.sh exits 0 and reverting fails it; bash tests/test-voter-agents-json.sh and bash tests/test-sdk-voter-agents.sh exit 0 | released@2026-09-27T21:45Z | Source: 20:12Z cut. Batch 9 (wf_4da25841-89e), build then review. Review APPROVE on ccb1f0fa; in train 15, main e72bcd66 pushed 21:22:34 (`git ls-remote origin refs/heads/main` = e72bcd66). Published in v9.76.0 (`npm view loki-mode version` = 9.76.0; npm time 2026-09-27T21:45Z). |
-| S-203 | BACKLOG 54: proof-check readers load user-site .pth (-E only) | autonomy/lib/proof-check.sh (3 heredoc readers plus guarded helper copy), tests/test-proof-check-no-user-site-pth.sh (new) | MEDIUM | bash tests/test-proof-check-no-user-site-pth.sh exits 0 and reverting fails it; bash tests/test-proven-pr-check.sh exits 0 | released@2026-09-27T21:45Z | Source: 20:12Z cut. Batch 9 (wf_4da25841-89e), build then review. Review APPROVE on b4bfe05d; in train 15, main e72bcd66 pushed 21:22:34 (`git ls-remote origin refs/heads/main` = e72bcd66). Published in v9.76.0 (`npm view loki-mode version` = 9.76.0; npm time 2026-09-27T21:45Z). |
-| S-204 | BACKLOG 53: checklist verification loads user-site .pth (-E only) | autonomy/prd-checklist.sh (python3 sites incl. checklist-verify.py call and oracle heredoc, plus guarded helper copy), tests/test-prd-checklist-no-user-site-pth.sh (new) | HIGH | bash tests/test-prd-checklist-no-user-site-pth.sh exits 0 and reverting fails it; bash tests/moat/p2-honest-verdict.sh prints CASE P2.checklist-verify-not-shadowed PASS; bash tests/test-prd-checklist-interval-w4.sh exits 0 | released@2026-09-27T21:45Z | Source: 20:12Z cut. Batch 9 (wf_4da25841-89e), build then review. Review APPROVE on 80c0a3f7; in train 16, main 800ac46e pushed 21:25:40 (`git ls-remote origin refs/heads/main` = 800ac46e). Published in v9.76.0 (`npm view loki-mode version` = 9.76.0; npm time 2026-09-27T21:45Z). |
-| S-205 | Bun loki proof verify runs a PATH python3 -E (user-site .pth reaches the verdict) | loki-ts/src/commands/proof.ts (verifier spawn only), loki-ts/src/util/python.ts (extend existing helper only if used), loki-ts/tests/commands/proof_verify_interpreter.test.ts (new) | HIGH | cd loki-ts && bun test tests/commands/proof_verify_interpreter.test.ts tests/commands/proof_verify_parity.test.ts exits 0; reverting to python3 -E fails the new test; no resolvable interpreter exits 2 | released@2026-09-27T21:45Z | Source: 20:12Z cut. Batch 9 (wf_4da25841-89e), build then review. Review APPROVE on 75c6b9e9; in train 16, main 800ac46e pushed 21:25:40 (`git ls-remote origin refs/heads/main` = 800ac46e). Published in v9.76.0 (`npm view loki-mode version` = 9.76.0; npm time 2026-09-27T21:45Z). |
-| S-206 | BACKLOG 114: cockpit actions say working tree is clean and no run in progress after a failed fetch | web-app/src/cockpit/FinalActions.tsx (disabled reasons only), web-app/src/cockpit/FinalActions.reasons.test.mjs (new) | LOW | node --test web-app/src/cockpit/FinalActions.reasons.test.mjs passes: git null lacks The working tree is clean and Nothing to push, status null lacks No run in progress, real data keeps both; cd web-app && npx tsc -b exits 0 | released@2026-09-27T21:15Z | Source: 20:12Z cut. Batch 8 (wf_ff8d537c-40e), build then review. Review APPROVE on ff852f0c; in train 14, main 04af133a pushed 20:58:10 (`git ls-remote origin refs/heads/main` = 04af133a). Published in v9.75.0 (`npm view loki-mode version` = 9.75.0; npm time 2026-09-27T21:15Z). |
-| S-207 | BACKLOG 114: cockpit evidence says No gate results recorded when the checklist request failed | web-app/src/cockpit/useCockpitState.ts (getChecklist via settle only), web-app/src/cockpit/EvidencePanel.tsx (empty branch only), web-app/src/cockpit/ExecutionCockpit.tsx (EvidencePanel props only), web-app/src/cockpit/EvidencePanel.state.test.mjs (new) | LOW | node --test web-app/src/cockpit/EvidencePanel.state.test.mjs passes: an error renders Could not load gate results, items [] keeps No gate results recorded; node web-app/src/cockpit/run-derive-view-test.mjs exits 0; cd web-app && npx tsc -b exits 0 | released@2026-09-27T21:45Z | Source: 20:12Z cut. Batch 9 (wf_4da25841-89e), build then review. Review APPROVE on b969a3cb; in train 15, main e72bcd66 pushed 21:22:34 (`git ls-remote origin refs/heads/main` = e72bcd66). Published in v9.76.0 (`npm view loki-mode version` = 9.76.0; npm time 2026-09-27T21:45Z). |
-| S-208 | BACKLOG 118: trust trajectory reads any non-pass council verdict as a failure | autonomy/lib/trust_trajectory.py (_verdict_is_pass only), tests/test_trust_trajectory_unknown_verdict.py (new) | MEDIUM | python3 -m pytest -q tests/test_trust_trajectory_unknown_verdict.py tests/test_trust_trajectory.py tests/dashboard/test_trust_trajectory_endpoint.py passes: an unknown verdict adds no data point, REJECTED stays 0.0; reverting fails case 1 | rejected@2026-09-27T20:58Z | Source: 20:12Z cut. Batch 8 (wf_ff8d537c-40e), build then review. Closed without code: the gate did not reproduce (no writer emits a verdict that is neither pass nor fail; reviewer APPROVE of the close, proof-generator.py:104-148 is the only final_verdict writer). |
-| S-209 | BACKLOG 99 (Bun): codex, cline and aider get the prompt without the commit-hygiene line | loki-ts/src/runner/providers.ts (codex, cline, aider invokers only), loki-ts/tests/runner/provider_commit_hygiene.test.ts (new), loki-ts/tests/runner/providers.test.ts (argv asserts only if moved) | MEDIUM | cd loki-ts && bun test tests/runner/provider_commit_hygiene.test.ts tests/runner/providers.test.ts exits 0: all three argvs carry the providers/codex.sh literal, claude not double-prefixed; removing the prefix fails the three legs | released@2026-09-27T21:45Z | Source: 20:12Z cut. Batch 9 (wf_4da25841-89e), build then review. Review APPROVE on 78f2f65d; in train 15, main e72bcd66 pushed 21:22:34 (`git ls-remote origin refs/heads/main` = e72bcd66). Published in v9.76.0 (`npm view loki-mode version` = 9.76.0; npm time 2026-09-27T21:45Z). |
-| S-210 | Velocity: help-discoverability (29s) and completion-coverage (30s) probe loops under 10s each | tests/test-help-discoverability.sh, tests/test-completion-coverage.sh (probe loops only) | LOW | time bash tests/test-help-discoverability.sh and time bash tests/test-completion-coverage.sh each exit 0 with real under 10s; real_count and pass counts match the pre-change capture; both timings reported | released@2026-09-27T21:45Z | Source: 20:12Z cut. Batch 9 (wf_4da25841-89e), build then review. Review APPROVE on d4fb8ad2; in train 16, main 800ac46e pushed 21:25:40 (`git ls-remote origin refs/heads/main` = 800ac46e). Published in v9.76.0 (`npm view loki-mode version` = 9.76.0; npm time 2026-09-27T21:45Z). |
-| S-211 | BACKLOG 75: register the four suites no runner executes (Captain, after S-174 merges) | tests/run-all-tests.sh (four run_test lines only, after S-174 merges), tests/shard-durations.tsv (four lines) | LOW | grep -c -e test_managed_completion_flag -e test_managed_review_flag -e test-evidence-gate-no-tests -e test-voter-agents-json tests/run-all-tests.sh prints 8; bash tests/test-shard-coverage.sh exits 0; each suite ran 3 of 3 from a scratch cwd with no .loki/state/provider left | released@2026-09-27T21:45Z | Source: 20:12Z cut. Batch 9 (wf_4da25841-89e), build then review. Review APPROVE on a04bbb7a; in train 15, main e72bcd66 pushed 21:22:34 (`git ls-remote origin refs/heads/main` = e72bcd66). Published in v9.76.0 (`npm view loki-mode version` = 9.76.0; npm time 2026-09-27T21:45Z). |
-| S-212 | GUARDS 5, 12 and 13 still read PENDING after S-138, S-139 and S-154 landed (after S-181 merges) | docs/v10/GUARDS.md (sections 5, 12, 13 only; does not overlap S-181 section 11) | LOW | awk '/^## 12\./,0' docs/v10/GUARDS.md piped to grep -c 'PENDING, no slice cut' prints 0; bash tests/test-no-ambient-gitconfig-writes.sh and bash tests/test-v10-pulse.sh exit 0 | released@2026-09-27T21:45Z | Source: 20:12Z cut. Batch 9 (wf_4da25841-89e), build then review. Review APPROVE on bd135cb8; in train 15, main e72bcd66 pushed 21:22:34 (`git ls-remote origin refs/heads/main` = e72bcd66). Published in v9.76.0 (`npm view loki-mode version` = 9.76.0; npm time 2026-09-27T21:45Z). |
-| S-213 | BACKLOG 123: cost.html and proofs.html council-vote labels have no test of their own | legacy-ui/tests/static-council-vote-label.node.test.mjs (new) | LOW | node --test legacy-ui/tests/static-council-vote-label.node.test.mjs passes (proofs.html council prefix and title, cost.html Council vote header); renaming the header or dropping the title in a scratch copy fails it | parked@2026-09-27T21:43Z | Source: 20:12Z cut. Batch 10 (wf_6fed529f-a3d), build then review. Paused by CEO P0 (Loki 10 engine) before review; built commit ce106a03 kept on branch worktree-wf_6fed529f-a3d-1. |
-| S-214 | BACKLOG 147: P7 useMemo arm misses a factory that calls a registered fabricator | tests/moat/p7-no-fabricated-data.sh (HELPER_LOCAL_DECL_TMPL ~1182 and its use ~2186, ceiling comment ~978-986, one fixture beside the DECL_USEMEMO fixture ~3138-3160 only; does not overlap S-198) | HIGH | bash tests/moat/p7-no-fabricated-data.sh prints PASS for every P7 case and flags the composed useMemo fixture; removing the useMemo prefix in a scratch copy lets it through; git diff --stat tests/moat/cases.txt is empty | parked@2026-09-27T21:43Z | Source: 20:59Z cut. Batch 10 (wf_6fed529f-a3d), build then review. Paused by CEO P0 (Loki 10 engine) before review; built commit 657597c1 kept on branch worktree-wf_6fed529f-a3d-2. |
-| S-215 | PR receipt renderer in proof-pr.sh imports json from the target repo (cwd shadow) | autonomy/lib/proof-pr.sh (render_evidence_receipt_md heredoc reader plus guarded _loki_snapshot_py_tool copy), tests/test-proof-pr-no-cwd-shadow.sh (new) | HIGH | bash tests/test-proof-pr-no-cwd-shadow.sh exits 0 (a planted json.py cannot forge the headline) and reverting to bare python3 - in a scratch copy fails it; bash tests/test-proven-pr-receipt.sh exits 0; bash tests/test-council-py-tool-identity.sh exits 0 and counts one more copy | parked@2026-09-27T21:43Z | Source: 20:59Z cut. Batch 10 (wf_6fed529f-a3d), build then review. Paused by CEO P0 (Loki 10 engine) before review; built commit 56a41332 kept on branch worktree-wf_6fed529f-a3d-3. |
-| S-216 | loki verify inline readers import from the tree under review (cwd shadow) | autonomy/verify.sh (reader sites ~190, 591, 1269, 1271, 1295, 1337, 1339, 1441 plus guarded helper copy; not the unittest or py_compile runs), tests/test-verify-no-cwd-shadow.sh (new) | HIGH | bash tests/test-verify-no-cwd-shadow.sh exits 0 and reverting one site in a scratch copy fails it; bash tests/test-verify.sh exits 0; bash tests/moat/run.sh reports no rule failed; bash tests/test-council-py-tool-identity.sh exits 0 | parked@2026-09-27T21:43Z | Source: 20:59Z cut. Batch 10 (wf_6fed529f-a3d), build then review. Paused by CEO P0 (Loki 10 engine) before review; built commit 29eb5d3b kept on branch worktree-wf_6fed529f-a3d-4. |
-| S-217 | BACKLOG 81: enforce_test_coverage package.json readers load user-site .pth | autonomy/run.sh (enforce_test_coverage _declared_test_script and _ws_script readers only; anchor on names), tests/test-enforce-test-coverage-pkg-readers-pth.sh (new) | HIGH | bash tests/test-enforce-test-coverage-pkg-readers-pth.sh exits 0 (a .pth no longer changes the recorded test gate outcome) and reverting one reader to -E in a scratch copy fails it; no .loki/state/provider left in the repo; bash tests/test-honest-gate-status.sh exits 0 | parked@2026-09-27T21:43Z | Source: 20:59Z cut. Batch 10 (wf_6fed529f-a3d), build then review. Paused by CEO P0 (Loki 10 engine) before review; built commit 67589d2d kept on branch worktree-wf_6fed529f-a3d-5. |
-| S-218 | BACKLOG 131c: snapshot git status runs an agent-chosen core.fsmonitor command | autonomy/run.sh (_loki_untracked_status only), tests/test-untracked-status-fsmonitor.sh (new) | HIGH | bash tests/test-untracked-status-fsmonitor.sh exits 0 (no fsmonitor marker, real untracked file still listed) and removing the two -c flags in a scratch copy fails it; bash tests/test-no-ambient-gitconfig-writes.sh and bash tests/test-branch-lifecycle.sh exit 0 | parked@2026-09-27T21:43Z | Source: 20:59Z cut. Batch 10 (wf_6fed529f-a3d), build then review. Paused by CEO P0 (Loki 10 engine) before review; built commit 8e9bb0ae kept on branch worktree-wf_6fed529f-a3d-6. |
-| S-219 | BACKLOG 83: a failed git add -A makes the session commit silently commit nothing | autonomy/run.sh (commit_session_changes git add -A block only), tests/test-session-commit-add-failure.sh (new) | MEDIUM | bash tests/test-session-commit-add-failure.sh exits 0: an empty embedded repo prints Left uncommitted naming the add failure, a normal repo still commits; removing the rc check in a scratch copy fails leg 1; bash tests/test-branch-lifecycle.sh exits 0 | parked@2026-09-27T21:43Z | Source: 20:59Z cut. Paused by CEO P0 (Loki 10 engine). |
-| S-220 | BACKLOG 109: untrack step's global reset drops force-staged agent files from the session commit | autonomy/run.sh (_loki_untrack_agent_committed_user_files only), tests/test-untrack-keeps-force-staged.sh (new) | MEDIUM | bash tests/test-untrack-keeps-force-staged.sh exits 0: git add -f dist/bundle.js lands in the session commit while the pre-existing user file stays untracked on disk; restoring git reset -q in a scratch copy fails it; bash tests/test-branch-lifecycle.sh exits 0 | parked@2026-09-27T21:43Z | Source: 20:59Z cut. Paused by CEO P0 (Loki 10 engine). |
-| S-221 | BACKLOG 123: audit.py verify exits 0 when it checked nothing | dashboard/audit.py (_unified_cli verify branch and docstring only; tip and prefix untouched), tests/dashboard/test_audit_verify_cli_nothing_checked.py (new) | MEDIUM | python3 -m pytest -q tests/dashboard/test_audit_verify_cli_nothing_checked.py: empty dir exits 2, valid chain 0, tampered 1, tip on an empty dir still 0; bash tests/test-audit-chain-honesty.sh and bash tests/test-audit-js-suites.sh exit 0 | parked@2026-09-27T21:43Z | Source: 20:59Z cut. Batch 10 (wf_6fed529f-a3d), build then review. Paused by CEO P0 (Loki 10 engine) before review; built commit 725adbf1 kept on branch worktree-wf_6fed529f-a3d-7. |
-| S-222 | BACKLOG 118: skill-session WebSocket status push hardcodes running_agents 0 | dashboard/server.py (skill-session broadcast payload ~1030-1047 only), tests/dashboard/test_skill_session_ws_running_agents.py (new) | LOW | python3 -m pytest -q tests/dashboard/test_skill_session_ws_running_agents.py shows running_agents None on the skill-session push; restoring 0 fails it | parked@2026-09-27T21:43Z | Source: 20:59Z cut. Batch 10 (wf_6fed529f-a3d), build then review. Paused by CEO P0 (Loki 10 engine) before review; built commit e41553cd kept on branch worktree-wf_6fed529f-a3d-8. |
-| S-223 | BACKLOG 114/118: notification triggers read No triggers configured after a failed read | dashboard/server.py (get_notification_triggers only), legacy-ui/components/loki-notification-center.js (_loadTriggers and triggers empty branch only), tests/dashboard/test_notification_triggers_unreadable.py (new), legacy-ui/tests/loki-notification-triggers-error.node.test.mjs (new) | LOW | python3 -m pytest -q tests/dashboard/test_notification_triggers_unreadable.py shows triggers null with error on a corrupt file and [] on a missing one; node --test legacy-ui/tests/loki-notification-triggers-error.node.test.mjs shows an error lacks No triggers configured and an empty list keeps it | parked@2026-09-27T21:43Z | Source: 20:59Z cut. Paused by CEO P0 (Loki 10 engine). |
-| S-224 | BACKLOG 118: web-app receipt and cost trend show a partly priced run as a complete cost | web-app/src/components/EvidenceReceiptPanel.tsx (Cost field only), web-app/src/api/client.ts (ProofDetail cost type and cost/timeline runs type only), web-app/src/pages/MetricsPage.tsx (costTrend only), web-app/src/components/EvidenceReceiptPanel.cost.test.mjs (new) | MEDIUM | node --test web-app/src/components/EvidenceReceiptPanel.cost.test.mjs: cost_partial true renders at least $1.20, absent keeps $1.20, a partial run's trend label carries (partial); cd web-app && npx tsc -b exits 0 | parked@2026-09-27T21:43Z | Source: 20:59Z cut. Batch 10 (wf_6fed529f-a3d), build then review. Paused by CEO P0 (Loki 10 engine) before review; built commit 3d463e79 kept on branch worktree-wf_6fed529f-a3d-9. |
-| S-225 | BACKLOG 118: standalone receipts list shows a partly priced run as a complete cost | legacy-ui/scripts/build-standalone.js (loadReceipts cost cell only), tests/test-receipts-panel.sh (one new leg) | LOW | bash tests/test-receipts-panel.sh exits 0 with the new leg asserting at least $X.XX only when cost_partial is true; bash tests/test-budget-banner-dedup.sh exits 0 | parked@2026-09-27T21:43Z | Source: 20:59Z cut. Batch 10 (wf_6fed529f-a3d), build then review. Paused by CEO P0 (Loki 10 engine) before review; built commit c9cd69c4 kept on branch worktree-wf_6fed529f-a3d-10. |
-| S-226 | BACKLOG 106 class: loki stats reads unmeasured cost as $0.00 on both routes | autonomy/loki (cmd_stats only), loki-ts/src/commands/stats.ts, loki-ts/tests/commands/stats_unmeasured.test.ts (new), tests/test-stats-unmeasured-cost.sh (new) | MEDIUM | bash tests/test-stats-unmeasured-cost.sh exits 0 (all-zero records give cost_usd null and not recorded, same on both routes); cd loki-ts && bun test tests/commands/stats.test.ts tests/commands/stats_unmeasured.test.ts exits 0; bash tests/test-bash-bun-parity.sh exits 0 | parked@2026-09-27T21:43Z | Source: 20:59Z cut. Batch 10 (wf_6fed529f-a3d), build then review. Paused by CEO P0 (Loki 10 engine) before review; built commit ea739eed kept on branch s-226-stats-unmeasured-cost. |
-| S-227 | BACKLOG 106 class: loki status prints Budget $0 for a run it never measured, on both routes | autonomy/loki (cmd_status budget block only), loki-ts/src/commands/status.ts (readBudgetField and its budget caller only), loki-ts/tests/commands/status.test.ts (budget legs only), tests/test-status-budget-unmeasured.sh (new) | MEDIUM | bash tests/test-status-budget-unmeasured.sh exits 0 (budget_used 0, null or absent prints not recorded on both routes, a positive value prints as today); cd loki-ts && bun test tests/commands/status.test.ts exits 0; bash tests/test-status-cli-provider-parity.sh exits 0 | parked@2026-09-27T21:43Z | Source: 20:59Z cut. Paused by CEO P0 (Loki 10 engine). |
-| S-228 | BACKLOG 121: DeployConnections pushes default not-connected states upward after its own fetch failed | web-app/src/components/DeployConnections.tsx (connect and disconnect handlers only), web-app/src/components/DeployConnections.propagate.test.mjs (new) | LOW | node --test web-app/src/components/DeployConnections.propagate.test.mjs shows no synthesized statuses reach onStatusChange after a failed fetch; node --test web-app/src/components/DeployConnections.state.test.mjs and cd web-app && npx tsc -b exit 0 | parked@2026-09-27T21:43Z | Source: 20:59Z cut. Paused by CEO P0 (Loki 10 engine). |
-| S-229 | BACKLOG 114: preview header says Detecting project type forever after a failed preview-info fetch | web-app/src/components/ProjectWorkspace.tsx (getPreviewInfo call ~839 and Detecting project type branch ~1877 only), web-app/src/components/ProjectWorkspace.preview.test.mjs (new) | LOW | node --test web-app/src/components/ProjectWorkspace.preview.test.mjs shows a rejected fetch renders Could not detect project type and lacks Detecting project type; node --test web-app/src/components/ProjectWorkspace.panels.test.mjs and cd web-app && npx tsc -b exit 0 | parked@2026-09-27T21:43Z | Source: 20:59Z cut. Batch 10 (wf_6fed529f-a3d), build then review. Paused by CEO P0 (Loki 10 engine) before review; built commit af232770 kept on branch worktree-wf_6fed529f-a3d-12. |
-| S-230 | BACKLOG 115/118: ProjectWorkspace labels unknown phases building and Replay Build can never appear | web-app/src/components/ProjectWorkspace.tsx (buildPhase memo ~1401-1410 and Replay Build condition ~1488 only; does not overlap S-229), web-app/src/components/ProjectWorkspace.phase.test.mjs (new) | LOW | node --test web-app/src/components/ProjectWorkspace.phase.test.mjs shows an unrecognized phase is not building and a completed idle session shows Replay Build; cd web-app && npx tsc -b exits 0 | parked@2026-09-27T21:43Z | Source: 20:59Z cut. Paused by CEO P0 (Loki 10 engine). |
-| S-231 | BACKLOG 52: the Moat suite CI check reads as moat proven at 0 of 9 | .github/workflows/test.yml (moat-suite job name only) | LOW | gh api required_status_checks for main does not list Moat suite (else report-only); git grep -n "name: Moat suite" -- .github prints nothing; git grep -n "Moat suite" -- tests scripts .github lists only the step-summary heading; the next push shows the renamed check | parked@2026-09-27T21:43Z | Source: 20:59Z cut. Batch 10 (wf_6fed529f-a3d), build then review. Paused by CEO P0 (Loki 10 engine) before review; built commit 8dddd2d3 kept on branch worktree-wf_6fed529f-a3d-13. |
-| S-232 | autonomy/loki is linted only inside the sentrux test; the lint suite schedules big files last | tests/run-shellcheck.sh, tests/test-sentrux-init-rules.sh (T6 only) | LOW | LOKI_SHELLCHECK_JOBS=4 bash tests/run-shellcheck.sh exits 0, prints Checked ./autonomy/loki, counts match the pre-change capture plus loki; time bash tests/test-sentrux-init-rules.sh exits 0 with 8 passed under 10s; grep -c shellcheck tests/test-sentrux-init-rules.sh prints 0; both timings reported | parked@2026-09-27T21:43Z | Source: 20:59Z cut. Paused by CEO P0 (Loki 10 engine). |
-| S-233 | BACKLOG 72 remainder: refused resume does not name the blocking file or where the earlier commits are | autonomy/run.sh (setup_agent_branch resume block around the no-overwrite-ignore checkout only), tests/test-refused-resume-warning.sh (new) | LOW | bash tests/test-refused-resume-warning.sh exits 0 with the warning naming the conflicting ignored file and the recorded branch; bash tests/test-branch-lifecycle.sh exits 0 | released@2026-10-16T00:49Z | 1731c5e14. TL APPROVE (red on parent, mutation red, paths with spaces, cap 5, locale-safe fallback). On main: test PASS, bash -n ok, shard 19/0, drift 6/0. Nit: tracked-change refusals also say ignored file(s). |
-| EV-1 | Eval runner and scorer (eval/loki10/harness.py, run.sh, summarize): fresh clone per run, local bare remote, hidden tests after the arm, nonce-verified grading, pre-arm task_invalid checks, provider-only cost | eval/loki10/{harness.py,run.sh,summarize,lib-tmp.sh,README.md,test-harness.sh,fixtures/} | HIGH | bash eval/loki10/test-harness.sh | released@2026-09-28T01:11Z | D29 gate. Built d63fc5c2 (61 passed, 0 failed); adversarial review REJECT on 3cf723be fixed item by item; merging EV-3 and the task nonce fixes on branch worktree-agent-ad850d483c4960e62. d63fc5c2..68bfbc4f (test-harness 77 passed; no-op baseline graded all 29 tasks not completed, none task_invalid, 108s); main 694866fc. Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| EV-2 | Eval task set: 25 or more real tasks with hidden tests (augmentiq, public issues with merged-fix tests, quickstart briefs) | eval/loki10/tasks/ | HIGH | python3 eval/loki10/harness.py validate eval/loki10/tasks/*/ | released@2026-09-28T01:11Z | 29 tasks (augmentiq 1: the repo has only 3 issues; public 14; quickstart 14); re-review APPROVE (every public task red at ref, green at fix); on main 51b37c6f. Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| EV-3 | Eval arm config isolation: fresh CLAUDE_CONFIG_DIR per run, one credential passed only to the arm | eval/loki10/harness.py (arm_env, arm_auth), test-harness.sh leg 12, README | HIGH | bash eval/loki10/test-harness.sh | released@2026-09-28T01:11Z | 451ba56c; security review CONCERN (test could not catch a leak) fixed: M1/M2/M4 leak mutations each red; merging into EV-1 branch. 451ba56c (merged via EV-1 branch); main 694866fc. Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| EV-7 | Task nonce fix: aiq-52 and the 14 qs tasks print LOKI_EVAL_NONCE only after all assertions pass | eval/loki10/tasks/aiq-52-searchbar, eval/loki10/tasks/qs-* | MEDIUM | a no-op baseline over all 29 tasks grades every task not completed, none task_invalid | released@2026-09-28T01:11Z | Found by the EV-1 audit: 15 tasks could never pass under nonce grading. Assigned to the EV-1 builder with the baseline run. 1a17ad92 (15 tasks print the nonce after assertions; aiq-52 genuine pass at b65b0752 "Tests 3 passed (3)"); main 694866fc. Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| EV-4 | Raw claude -p arm: real runs on the gate tasks at the gate model and budget | eval/loki10 results under eval/loki10/results/ (gitignored) plus a summary | HIGH | eval/loki10/run.sh --arm raw-claude --task <id> records completed, time_to_pr_s and provider cost | released@2026-09-28T01:11Z | Smoke on 3 public tasks now, from a scratch clone of the EV-1 branch with EV-3 merged; the full arm runs when EV-1 lands. Smoke 23:02Z: 3/3 completed, p50 34s, p90 45s, $0.1944 per completed (`summarize --markdown`), 0 capped; full 29-task arm runs next. Full arm: 27/29, p50 39s, p90 68s, $0.2363 per completed (results in ~/loki-ci-logs/eval-raw-claude-20260927T231653Z). Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| EV-5 | Legacy arm: loki start at the same model and 15-minute cap | same as EV-4 | HIGH | eval/loki10/run.sh --arm legacy --task <id> records completed or capped | released@2026-09-28T02:38Z | Smoke on 1 public task now; capped runs score not completed. Smoke on pub-more-itertools-1192: hidden_pass true, pr_opened false, completed false (results row; arm_stdout.log: "committed as 4f3f20a ... but not pushed ... this session's rules say commits stay local only"); full 29-task arm started 23:27Z. Budget exception: a 29-task measurement at a 900s cap per task and --parallel 3 runs up to about 150 minutes by design (agent status 23:32Z); it is a measurement, not a build. Finished (measurement, not code): 29/29 results, completed 15/29, hidden pass 26/29, p50 190s, p90 441s, cost measured on 0/29 (~/loki-ci-logs/ev5-legacy/results.jsonl); ran the global loki v9.78.0 (manifest arm_binary loki). Released v9.81.0 (npm view loki-mode time: 2026-09-28T02:38:54Z). |
-| EV-6 | Gate report: results into docs/v10/METRICS.md and the CHANGELOG block (completion rate, p50/p90 time to PR, cost per completed task, misses) | eval/loki10/summarize, docs/v10/METRICS.md | MEDIUM | eval/loki10/summarize --markdown over the three arms renders every gate number, including misses | released@2026-09-28T01:11Z | Runs after the first full arm pass; Chief of Staff publishes. Staffed in engine10-gate-push (wf_1d47133f-7c7). Review APPROVE (publish_gate.sh and test-publish-gate.sh); merges together with E-33 (its test is red without gate_report.py). Merged 23b20e6f (train E12): shard coverage 19/0, drift 6/0, engine10 349 pass 0 fail, tsc exit 0. test-publish-gate 11/0. Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| E-00 | ORPHAN guard: pulse flags long-running worktree run.sh and /tmp/loki-run-*.sh processes; timeout -k 10 on run.sh/loki launches | scripts/v10-pulse.sh, tests/test-v10-pulse.sh, tests/test-timeout-escalates.sh, about 50 test launch sites | MEDIUM | bash tests/test-v10-pulse.sh and bash tests/test-timeout-escalates.sh | released@2026-09-28T01:11Z | D29 incident guard. Review CONCERN (guard matched only literal paths); rework b26c102a catches $LOKI and TBIN-style launches (reviewer mutation on test-why-honest-report.sh goes red: `bash tests/test-timeout-escalates.sh` 0 passed, 1 failed). Main a5f049d2 pushed 22:24:22 (`git ls-remote origin refs/heads/main` = a5f049d2); pulse 90 passed, 0 failed. Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| E-01 | Event log, schema and shared types | loki-ts/src/engine10/events.ts, loki-ts/src/engine10/types.ts, loki-ts/tests/engine10/events.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/events.test.ts | released@2026-09-28T01:11Z | Source: ENGINE.md 21:50Z cut; wave 1; depends on none Phase A (wf_f5dde039-0c5), build then review. Review CONCERN on e825568c (stale deep limits and push mode vs revised ENGINE.md), fixed in 4138471f; main 4138471f pushed 22:10:59 (`git ls-remote origin refs/heads/main` = 4138471f; tests/engine10 25 pass, 0 fail). Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| E-02 | State machine skeleton, resume, cap, optional loader | loki-ts/src/engine10/machine.ts, loki-ts/tests/engine10/machine.test.ts, loki-ts/tests/engine10/budget.test.ts | HIGH | cd loki-ts && bun test tests/engine10/machine.test.ts tests/engine10/budget.test.ts | released@2026-09-28T01:11Z | Source: ENGINE.md 21:50Z cut; wave 1; depends on E-01 Phase B (engine10-phaseB), build then review. Review CONCERN; rework in engine10-phaseB-rework. 761fbad8 (HIGH re-review APPROVE); main 694866fc pushed 22:55:38 (`git ls-remote origin refs/heads/main` = 694866fc; tests/engine10 plus spawn guard 185 pass, 0 fail; tsc 0 errors). Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| E-03 | Supervisor/worker split, Rule of Two, engine.json marker | loki-ts/src/engine10/supervisor.ts, loki-ts/src/engine10/worker.ts, loki-ts/tests/engine10/rule_of_two.test.ts | HIGH | cd loki-ts && bun test tests/engine10/rule_of_two.test.ts | released@2026-09-28T01:11Z | Source: ENGINE.md 21:50Z cut; wave 1; depends on E-01, E-02 Phase B (engine10-phaseB), build then review. Review CONCERN; rework in engine10-phaseB-rework. 1b08ea30 (HIGH re-review APPROVE); main 694866fc pushed 22:55:38 (`git ls-remote origin refs/heads/main` = 694866fc; tests/engine10 plus spawn guard 185 pass, 0 fail; tsc 0 errors). Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| E-04 | Intake (no PRD, already-done detection) | loki-ts/src/engine10/stages/intake.ts, loki-ts/src/engine10/fetch_issue.ts, loki-ts/src/engine10/repomap.ts, loki-ts/tests/engine10/intake.test.ts, loki-ts/tests/engine10/fixtures/intake/ | MEDIUM | cd loki-ts && bun test tests/engine10/intake.test.ts | released@2026-09-28T01:11Z | Source: ENGINE.md 21:50Z cut; wave 1; depends on E-02, E-03 Phase B (engine10-phaseB), build then review. 518f7e89 (review APPROVE); on main (`git ls-remote origin refs/heads/main` = 646701bc; tests/engine10 88 pass, 0 fail; tsc 0 errors). Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| E-05 | Test map and real runner detection | loki-ts/src/engine10/testmap.ts, loki-ts/tests/engine10/testmap.test.ts, loki-ts/tests/engine10/fixtures/testmap/ | MEDIUM | cd loki-ts && bun test tests/engine10/testmap.test.ts | released@2026-09-28T01:11Z | Source: ENGINE.md 21:50Z cut; wave 1; depends on none Phase A (wf_f5dde039-0c5), build then review. Review CONCERN (fixture path, evidence, commands, bunfig, reference grep); rework in phase B. a0cbc7b8 (rework review APPROVE); on main (`git ls-remote origin refs/heads/main` = 646701bc; tests/engine10 88 pass, 0 fail; tsc 0 errors). Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| E-06 | Cost capture into cost-summary.py records | loki-ts/src/engine10/cost.ts, loki-ts/tests/engine10/cost.test.ts, loki-ts/tests/engine10/fixtures/cost/ | MEDIUM | cd loki-ts && bun test tests/engine10/cost.test.ts | released@2026-09-28T01:11Z | Source: ENGINE.md 21:50Z cut; wave 1; depends on none Phase A (wf_f5dde039-0c5), build then review. Review APPROVE on c5a7d395 (cherry-picked 33327ca1); main 4138471f. Follow-up: write .loki/metrics/efficiency/iteration-N.json per ENGINE.md section 10. E-06b efficiency records (d65d90e2, review APPROVE) plus cost_source provider in 4cc3da48. Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| E-07 | Session wrapper (process group, heartbeat, model override) | loki-ts/src/engine10/session.ts, loki-ts/tests/engine10/session.test.ts, loki-ts/tests/engine10/fixtures/session/ | MEDIUM | cd loki-ts && bun test tests/engine10/session.test.ts | released@2026-09-28T01:11Z | Source: ENGINE.md 21:50Z cut; wave 1; depends on E-01, E-06 Phase B (engine10-phaseB), build then review. Review CONCERN; rework in engine10-phaseB-rework. 6c2f9f07 (re-review CONCERN was a test gap only; follow-up E-TG); main 694866fc pushed 22:55:38 (`git ls-remote origin refs/heads/main` = 694866fc; tests/engine10 plus spawn guard 185 pass, 0 fail; tsc 0 errors). Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| E-08 | Implement stage and brief | loki-ts/src/engine10/stages/implement.ts, loki-ts/tests/engine10/implement.test.ts, loki-ts/tests/engine10/fixtures/implement/ | MEDIUM | cd loki-ts && bun test tests/engine10/implement.test.ts | released@2026-09-28T01:11Z | Source: ENGINE.md 21:50Z cut; wave 1; depends on E-05, E-07 Phase B (engine10-phaseB), build then review. 646701bc (review APPROVE); on main (`git ls-remote origin refs/heads/main` = 646701bc; tests/engine10 88 pass, 0 fail; tsc 0 errors). Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| E-09 | Fast verify | loki-ts/src/engine10/stages/verify.ts, loki-ts/tests/engine10/verify.test.ts, loki-ts/tests/engine10/fixtures/verify/ | MEDIUM | cd loki-ts && bun test tests/engine10/verify.test.ts | released@2026-09-28T01:11Z | Source: ENGINE.md 21:50Z cut; wave 1; depends on E-02, E-05 Phase B (engine10-phaseB), build then review. Review CONCERN; rework in engine10-phaseB-rework. 779983fa (re-review CONCERN was a test gap only; follow-up E-TG); main 694866fc pushed 22:55:38 (`git ls-remote origin refs/heads/main` = 694866fc; tests/engine10 plus spawn guard 185 pass, 0 fail; tsc 0 errors). Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| E-10 | Seal (signed receipt, NOT PROVEN) | loki-ts/src/engine10/stages/seal.ts, loki-ts/tests/engine10/seal.test.ts | HIGH | cd loki-ts && bun test tests/engine10/seal.test.ts | released@2026-09-28T01:11Z | Source: ENGINE.md 21:50Z cut; wave 1; depends on E-01, E-09 Phase B (engine10-phaseB), build then review. Review CONCERN; rework in engine10-phaseB-rework. 5b53ccb0 (HIGH re-review APPROVE); main 694866fc pushed 22:55:38 (`git ls-remote origin refs/heads/main` = 694866fc; tests/engine10 plus spawn guard 185 pass, 0 fail; tsc 0 errors). Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| E-11 | Trusted push and PR | autonomy/lib/engine10-push.sh, loki-ts/src/engine10/stages/pr.ts, tests/test-engine10-push.sh, loki-ts/tests/engine10/pr.test.ts | HIGH | bash tests/test-engine10-push.sh | released@2026-09-28T01:11Z | Source: ENGINE.md 21:50Z cut; wave 1; depends on E-03, E-10 Shell half (engine10-push.sh) building early (wf_f70c455a-69e); stages/pr.ts after E-01. Shell half (engine10-push.sh) review APPROVE on 1a6bc2c4, merged in main 6f2dfd9c (`bash tests/test-engine10-push.sh` 15 passed, 0 failed); stages/pr.ts still to build. TS half (stages/pr.ts) building as E-11b in engine10-wave2. TS half 2a3e3264 review APPROVE; main 694866fc. Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| E-12 | CLI entry behind LOKI_ENGINE=v10 | loki-ts/src/engine10/cli.ts, loki-ts/src/cli.ts (case engine10 before default at line 303), bin/loki (block between lines 244 and 246), tests/test-engine10-dispatch.sh, loki-ts/tests/engine10/cli.test.ts | MEDIUM | bash tests/test-engine10-dispatch.sh | released@2026-09-28T01:11Z | Source: ENGINE.md 21:50Z cut; wave 1; depends on E-03 Building early (wf_f70c455a-69e), build then review. Review CONCERN (one-word v10 routing trusted the telemetry allowlist, missing estimate/intent/outcomes); fixed in 6f2dfd9c (one-word args stay legacy; `bash tests/test-engine10-dispatch.sh` 33 passed, 0 failed); main 6f2dfd9c pushed 22:17:49. Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| E-13 | Live output and 5-line summary | loki-ts/src/engine10/output.ts, loki-ts/tests/engine10/output.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/output.test.ts | released@2026-09-28T01:11Z | Source: ENGINE.md 21:50Z cut; wave 1; depends on E-01 Wave 1b (wf_60ffc02a-bf8). b15b2112 (review CONCERN fixed in 4cc3da48: tokens-null wording, injected missing eta path, import errors rethrown); on main (`git ls-remote origin refs/heads/main` = 646701bc; tests/engine10 88 pass, 0 fail; tsc 0 errors). Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| E-14 | Thin-path end to end | loki-ts/tests/engine10/e2e.test.ts, loki-ts/tests/engine10/fixtures/e2e/ | MEDIUM | cd loki-ts && bun test tests/engine10/e2e.test.ts | parked@2026-09-27T23:36Z | Source: ENGINE.md 21:50Z cut; wave 1; depends on E-01 through E-13 engine10-integrate (wf_c7ce2eb5-e8f). Built 9d9ff7d2 (first real v10 run: 30s, hidden pass, $0.45); HIGH review CONCERN (green only via run.ts glue, over the 5,000-line budget with it); held, absorbed by E-42. Stopped and re-sliced (CEO 23:31Z): its work (9d9ff7d2) is absorbed by E-42, which deletes the run.ts glue. |
-| E-15 | Wall author (blind, hashed) | loki-ts/src/engine10/stages/wall.ts, loki-ts/tests/engine10/wall.test.ts, loki-ts/tests/engine10/fixtures/wall/ | MEDIUM | cd loki-ts && bun test tests/engine10/wall.test.ts | released@2026-09-28T01:11Z | Source: ENGINE.md 21:50Z cut; wave 2; depends on E-02, E-04, E-07 Wave 2 (engine10-wave2). engine10-integrate (wf_c7ce2eb5-e8f). Review APPROVE (9a463171); main 44731e0f pushed 23:25:50 (tests/engine10 plus spawn guard 334 pass, 0 fail; engine10 4923 lines). Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| E-16 | Plan (10 lines or fewer) | loki-ts/src/engine10/stages/plan.ts, loki-ts/tests/engine10/plan.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/plan.test.ts | released@2026-09-28T01:11Z | Source: ENGINE.md 21:50Z cut; wave 2; depends on E-02, E-04, E-07 Wave 2 (engine10-wave2). 03ffe6b8 (review APPROVE); main 694866fc pushed 22:55:38 (`git ls-remote origin refs/heads/main` = 694866fc; tests/engine10 plus spawn guard 185 pass, 0 fail; tsc 0 errors). Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| E-17 | Fix rounds and failure grouping | loki-ts/src/engine10/stages/fix.ts, loki-ts/src/engine10/failures.ts, loki-ts/tests/engine10/fix.test.ts, loki-ts/tests/engine10/failures.test.ts, loki-ts/tests/engine10/fixtures/failures/ | MEDIUM | cd loki-ts && bun test tests/engine10/fix.test.ts tests/engine10/failures.test.ts | released@2026-09-28T01:11Z | Source: ENGINE.md 21:50Z cut; wave 2; depends on E-07, E-09 Wave 2 (engine10-wave2). engine10-integrate (wf_c7ce2eb5-e8f). Review APPROVE (d88a1078); main 44731e0f pushed 23:25:50 (tests/engine10 plus spawn guard 334 pass, 0 fail; engine10 4923 lines). Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| E-18 | Per-repo cache by tree hash | loki-ts/src/engine10/cache.ts, loki-ts/tests/engine10/cache.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/cache.test.ts | released@2026-09-28T01:11Z | Source: ENGINE.md 21:50Z cut; wave 2; depends on E-04, E-05 Wave 2 (engine10-wave2). engine10-integrate (wf_c7ce2eb5-e8f). Review APPROVE (9816234f); main 44731e0f pushed 23:25:50 (tests/engine10 plus spawn guard 334 pass, 0 fail; engine10 4923 lines). Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| E-19 | Hard cap and DRAFT PR body | loki-ts/src/engine10/pr_body.ts, loki-ts/tests/engine10/cap.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/cap.test.ts | released@2026-09-28T01:11Z | Source: ENGINE.md 21:50Z cut; wave 2; depends on E-02, E-07, E-11 engine10-integrate (wf_c7ce2eb5-e8f). Review APPROVE (028fcaf0); main 44731e0f pushed 23:25:50 (tests/engine10 plus spawn guard 334 pass, 0 fail; engine10 4923 lines). Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| E-20 | ETA | loki-ts/src/engine10/eta.ts, loki-ts/tests/engine10/eta.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/eta.test.ts | released@2026-09-28T01:11Z | Source: ENGINE.md 21:50Z cut; wave 2; depends on E-13, E-18 Wave 2 (engine10-wave2). e22aace4 (review APPROVE); main 694866fc pushed 22:55:38 (`git ls-remote origin refs/heads/main` = 694866fc; tests/engine10 plus spawn guard 185 pass, 0 fail; tsc 0 errors). Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| E-21 | loki status | loki-ts/src/engine10/status.ts, loki-ts/tests/engine10/status.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/status.test.ts | released@2026-09-28T01:11Z | Source: ENGINE.md 21:50Z cut; wave 2; depends on E-01, E-12 Wave 2 (engine10-wave2). engine10-integrate (wf_c7ce2eb5-e8f). Review APPROVE (a5cabf83); main 44731e0f pushed 23:25:50 (tests/engine10 plus spawn guard 334 pass, 0 fail; engine10 4923 lines). Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| E-22 | loki verify | loki-ts/src/engine10/verify_cmd.ts, loki-ts/tests/engine10/verify_cmd.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/verify_cmd.test.ts | released@2026-09-28T01:11Z | Source: ENGINE.md 21:50Z cut; wave 2; depends on E-10 Wave 2 (engine10-wave2). engine10-integrate (wf_c7ce2eb5-e8f). Review APPROVE (11ebbe89); main 44731e0f pushed 23:25:50 (tests/engine10 plus spawn guard 334 pass, 0 fail; engine10 4923 lines). Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| E-23 | Deep verify (async, token-less worker) | loki-ts/src/engine10/stages/deep.ts, loki-ts/tests/engine10/deep.test.ts, loki-ts/tests/engine10/fixtures/deep/ | MEDIUM | cd loki-ts && bun test tests/engine10/deep.test.ts | released@2026-09-28T01:11Z | Source: ENGINE.md 21:50Z cut; wave 2; depends on E-03, E-10, E-11 engine10-integrate (wf_c7ce2eb5-e8f). Review APPROVE (854c93f9); main 44731e0f pushed 23:25:50 (tests/engine10 plus spawn guard 334 pass, 0 fail; engine10 4923 lines). Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| E-24 | Dashboard over SSE | loki-ts/src/engine10/dashboard/server.ts, loki-ts/src/engine10/dashboard/page.ts, loki-ts/tests/engine10/dashboard.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/dashboard.test.ts | released@2026-09-28T01:11Z | Source: ENGINE.md 21:50Z cut; wave 3; depends on E-01, E-12 Wave 3 (engine10-wave3). Review APPROVE on 85d398e4; tests/engine10 plus spawn guard 231 pass, 0 fail; test-engine10-push-gitlab 20 passed. Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| E-25 | Adapter interface and GitHub adapter | loki-ts/src/engine10/adapters/types.ts, loki-ts/src/engine10/adapters/index.ts, loki-ts/src/engine10/adapters/github.ts, loki-ts/tests/engine10/adapters_github.test.ts, loki-ts/tests/engine10/fixtures/adapters-github/ | MEDIUM | cd loki-ts && bun test tests/engine10/adapters_github.test.ts | released@2026-09-28T01:11Z | Source: ENGINE.md 21:50Z cut; wave 3; depends on E-04, E-11 Wave 3 (engine10-wave3). Review APPROVE on cf1a390f; tests/engine10 plus spawn guard 231 pass, 0 fail; test-engine10-push-gitlab 20 passed. Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| E-26 | GitLab adapter (issue in, MR out) | loki-ts/src/engine10/adapters/gitlab.ts, autonomy/lib/engine10-push-gitlab.sh, loki-ts/tests/engine10/adapters_gitlab.test.ts, tests/test-engine10-push-gitlab.sh, loki-ts/tests/engine10/fixtures/adapters-gitlab/ | HIGH | bash tests/test-engine10-push-gitlab.sh | released@2026-09-28T01:11Z | Source: ENGINE.md 21:50Z cut; wave 3; depends on E-25 Wave 3 (engine10-wave3). Review APPROVE on e96cb3f4 (HIGH review APPROVE); tests/engine10 plus spawn guard 231 pass, 0 fail; test-engine10-push-gitlab 20 passed. Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| E-27 | Jira read adapter | loki-ts/src/engine10/adapters/jira.ts, loki-ts/tests/engine10/adapters_jira.test.ts, loki-ts/tests/engine10/fixtures/adapters-jira/ | MEDIUM | cd loki-ts && bun test tests/engine10/adapters_jira.test.ts | released@2026-09-28T01:11Z | Source: ENGINE.md 21:50Z cut; wave 3; depends on E-25 Wave 3 (engine10-wave3). Review APPROVE on 410fdc06; tests/engine10 plus spawn guard 231 pass, 0 fail; test-engine10-push-gitlab 20 passed. Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| E-28 | Slack notify adapter | loki-ts/src/engine10/adapters/slack.ts, loki-ts/tests/engine10/adapters_slack.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/adapters_slack.test.ts | released@2026-09-28T01:11Z | Source: ENGINE.md 21:50Z cut; wave 3; depends on E-13, E-25 Wave 3 (engine10-wave3). Review APPROVE on cda6ffdb; tests/engine10 plus spawn guard 231 pass, 0 fail; test-engine10-push-gitlab 20 passed. Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| E-29 | Escalation (--deep, logged auto) | loki-ts/src/engine10/escalate.ts, loki-ts/tests/engine10/escalate.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/escalate.test.ts | released@2026-09-28T01:11Z | Source: ENGINE.md 21:50Z cut; wave 3; depends on E-02, E-16 Wave 3 (engine10-wave3). Review APPROVE on dd453b7b; tests/engine10 plus spawn guard 231 pass, 0 fail; test-engine10-push-gitlab 20 passed. Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| E-30 | Legacy alias contract (golden routes) | tests/test-engine10-legacy-contract.sh, tests/fixtures/engine10-legacy-routes.txt | MEDIUM | bash tests/test-engine10-legacy-contract.sh | released@2026-09-28T01:11Z | Source: ENGINE.md 21:50Z cut; wave 3; depends on E-12 Building early (wf_f70c455a-69e), build then review. Review CONCERN (no Bun row with extra args); rework in wf_60ffc02a-bf8. 77927604 (review APPROVE); on main (`git ls-remote origin refs/heads/main` = 646701bc; tests/engine10 88 pass, 0 fail; tsc 0 errors). Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| E-41 | Local-origin push mode so a v10 run can open a "PR" in the eval (bare local origin only, no credentials, hooks env scrubbed) | autonomy/lib/engine10-push.sh, loki-ts/src/engine10/stages/pr.ts, tests/test-engine10-push.sh, loki-ts/tests/engine10/pr.test.ts | HIGH | bash tests/test-engine10-push.sh | released@2026-09-28T01:11Z | dea31627 plus review fixes; HIGH review CONCERN non-blocking (no remote reached the local path, no token reached any hook); main 44731e0f; test-engine10-push 36 passed. Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| E-42 | Real entry runs end to end: supervisor and worker main, pr stage only in the supervisor with the pinned origin, stage exports, seal commit fix, CLI invoker markers, in-engine cost records, real model id; absorbs and deletes run.ts | loki-ts/src/engine10/{supervisor,worker,session,cost}.ts, stages/*, tests/engine10/e2e.test.ts | HIGH | LOKI_ENGINE=v10 LOKI_TS_ENTRY=<abs>/loki-ts/src/cli.ts bin/loki "<task>" --no-pr, then eval/loki10/run.sh --arm v10 --task pub-more-itertools-1192 | released@2026-09-28T01:11Z | engine10-e42 (wf_2111e96d-f6e). Merged 9db2a4ed (train E10, cherry-picked 71a7ac36, 260b034d, 8a6f77dd); train head bun test tests/engine10/ 346 pass 0 fail, tsc exit 0. Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| E-43 | Stage cost knobs (plan and wall on/off and tier, fix rounds) so the eval measures the full design and cheaper variants | loki-ts/src/engine10/knobs.ts, loki-ts/tests/engine10/knobs.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/knobs.test.ts | parked@2026-09-28T00:04Z | engine10-e42. TL CONCERN (reproduced): defaults planning/development match neither live literal (plan fast, wall planning), a silent cost rise. Parked, superseded by E-45 (same plan/wall tier control, cost-directed); engine has about 12 lines of budget left. |
-| E-44 | Output fixes: status column spacing; token count includes cache tokens | loki-ts/src/engine10/output.ts, loki-ts/tests/engine10/output.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/output.test.ts | released@2026-09-28T01:11Z | engine10-e42. Merged 9db2a4ed (31ce71a0); TL APPROVE. Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| E-45 | Cost path for the gate: small tasks skip the separate plan call (implementer plans), Wall author pinned to sonnet with a short prompt and the cached repo map; variant recorded | loki-ts/src/engine10/sizing.ts, loki-ts/tests/engine10/sizing.test.ts, plan/wall wiring | HIGH | cd loki-ts && bun test tests/engine10/sizing.test.ts, then a 5-task v10 measurement before the full arm | released@2026-09-28T02:38Z | CEO directive 23:31Z: target cost per completed task at or below $0.2363 (raw claude -p baseline). engine10-gate-push. Opus CONCERN (reproduced): repomap caps at 2000 files so the over-3000 rule never fires; truncated map must size normal. Rework dispatched with a Wall tier assertion. Merged 646a6cd7 (train E13): engine10 388 pass 0 fail, tsc exit 0, test-engine10-dist 18/0, test-engine10-docs 26 passed, test-harness 82/0. Opus APPROVE (32e1f225): both mutations red. Released v9.81.0 (npm view loki-mode time: 2026-09-28T02:38:54Z). |
-| E-52 | Eval harness passes LOKI_TS_ENTRY and an allowlist of LOKI_E10_* knobs to the v10 arm (dropped today, so knobs never reach the run) | eval/loki10/harness.py (arm_env only), eval/loki10/test-harness.sh (one leg) | HIGH | bash eval/loki10/test-harness.sh; a leg asserts LOKI_E10_PLAN reaches the arm env and GH_TOKEN does not | released@2026-09-28T02:38Z | Source: E-42 real run finding 1. Merged 646a6cd7 (train E13): engine10 388 pass 0 fail, tsc exit 0, test-engine10-dist 18/0, test-engine10-docs 26 passed, test-harness 82/0. Opus APPROVE (fa3b6754). Released v9.81.0 (npm view loki-mode time: 2026-09-28T02:38:54Z). |
-| E-53 | Verify runs pytest with the repo's own interpreter (.venv/bin/python, venv/bin/python) when present, not bare python -m pytest (always PARTIAL on venv repos) | loki-ts/src/engine10/testmap.ts (pytest command only), loki-ts/tests/engine10/testmap.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/testmap.test.ts; fixture with .venv/bin/python selects it | released@2026-09-28T02:38Z | Source: E-42 finding 2. Net line change must be 10 or fewer (budget). Merged 646a6cd7 (train E13): engine10 388 pass 0 fail, tsc exit 0, test-engine10-dist 18/0, test-engine10-docs 26 passed, test-harness 82/0. APPROVE (505287fd). Released v9.81.0 (npm view loki-mode time: 2026-09-28T02:38:54Z). |
-| E-54 | A killed or timed-out Wall author never copies its test file into the repo | loki-ts/src/engine10/stages/wall.ts (kill path only), loki-ts/tests/engine10/wall.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/wall.test.ts; aborted wall leaves git status clean | released@2026-09-28T02:38Z | Source: E-42 finding 3. TL CONCERN: externally killed session (exit null, killed false) still copies the Wall file. Rework dispatched. Merged 3ab2a8fa (train E14, rebased on main): engine10 404 pass 0 fail (402 pass 0 fail with claude removed from PATH), tsc exit 0, test-harness 86/0, test-local-ci-gitleaks 6/0, test-engine10-dist 18/0. Released v9.81.0 (npm view loki-mode time: 2026-09-28T02:38:54Z). |
-| E-55 | Seal marks NOT PROVEN when the diff edits or deletes a pre-existing test file (implement weakening tests) | loki-ts/src/engine10/stages/seal.ts (check only), loki-ts/tests/engine10/seal.test.ts | HIGH | cd loki-ts && bun test tests/engine10/seal.test.ts; fixture diff touching an existing test yields a NOT PROVEN entry naming the file | released@2026-09-28T02:38Z | Source: E-42 finding 4. Opus reviewer (Seal). Opus CONCERN (reproduced): git status T (test file replaced by symlink) not flagged. Rework dispatched. Merged 3ab2a8fa (train E14, rebased on main): engine10 404 pass 0 fail (402 pass 0 fail with claude removed from PATH), tsc exit 0, test-harness 86/0, test-local-ci-gitleaks 6/0, test-engine10-dist 18/0. Released v9.81.0 (npm view loki-mode time: 2026-09-28T02:38:54Z). |
-| E-56 | Verify matches Wall test paths repo-relative (absolute vs relative mismatch drops the Wall test from fast verify) | loki-ts/src/engine10/stages/verify.ts (path normalize only), loki-ts/tests/engine10/verify.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/verify.test.ts; absolute Wall path is selected | released@2026-09-28T02:38Z | Source: E-42 finding 5. Merged 646a6cd7 (train E13): engine10 388 pass 0 fail, tsc exit 0, test-engine10-dist 18/0, test-engine10-docs 26 passed, test-harness 82/0. APPROVE (cc9b55ed). Released v9.81.0 (npm view loki-mode time: 2026-09-28T02:38:54Z). |
-| E-57 | Line reclaim: engine10 back to 4,700 or fewer by deleting dead exports and duplicated helpers, no behavior change | loki-ts/src/engine10/ (deletions only, no new files) | LOW | cd loki-ts && bun test tests/engine10/ && bunx tsc --noEmit; budget.test count at or below 4700 | released@2026-09-28T02:38Z | Source: train E10 hit 5,019 and needed a header trim; E-36, E-45 and E-52..E-56 need room. Merge after the gate-path slices to avoid conflicts. Dispatched after train E13. Merged 3ab2a8fa (train E14, rebased on main): engine10 404 pass 0 fail (402 pass 0 fail with claude removed from PATH), tsc exit 0, test-harness 86/0, test-local-ci-gitleaks 6/0, test-engine10-dist 18/0. Released v9.81.0 (npm view loki-mode time: 2026-09-28T02:38:54Z). |
-| EV-10 | Harness reaps arm descendants that escape the timeout process group: after the cap, KILL recorded PIDs under the run clone (.loki/**/*.pid) and processes whose cwd is inside that run-owned clone; guard in docs/v10/GUARDS.md | eval/loki10/harness.py (kill_orphans only), eval/loki10/test-harness.sh (one leg), docs/v10/GUARDS.md (one entry) | HIGH | bash eval/loki10/test-harness.sh; a fixture arm that setsid-spawns a sleeper leaves no live process after the cap | released@2026-09-28T02:38Z | Source: incident 00:08Z, pulse ORPHAN_WORKTREE caught 4 legacy /tmp/loki-run-*.sh loops (ppid 1, 30 min, 15-min cap) plus 2 sleep 300 children from run dir loki-run.u6ikBxCT; stopped by PID (kill -TERM 58249 58251 58633 58634 57049 56916, ps -p afterwards empty). Never match by name. Opus CONCERN: Linux /proc/<pid> mtime is not process start, so the age filter passes everything. Rework dispatched. Merged 3ab2a8fa (train E14, rebased on main): engine10 404 pass 0 fail (402 pass 0 fail with claude removed from PATH), tsc exit 0, test-harness 86/0, test-local-ci-gitleaks 6/0, test-engine10-dist 18/0. Released v9.81.0 (npm view loki-mode time: 2026-09-28T02:38:54Z). |
-| E-60 | Secret-scan guard before push: scripts/local-ci.sh fast tier runs gitleaks v8.30.0 with .gitleaksignore over origin/main..HEAD when the binary is present (SKIP line, not green, when absent); fixtures must build secret-shaped strings at runtime; entry in docs/v10/GUARDS.md | scripts/local-ci.sh (one step), tests/test-local-ci-gitleaks.sh, docs/v10/GUARDS.md | MEDIUM | bash tests/test-local-ci-gitleaks.sh: a commit adding a planted AKIA fixture fails the step; the same fixture built by concatenation passes | released@2026-09-28T02:38Z | Source: incident 00:45Z. Security Audit gitleaks failed on 9dc0b1d3 and 085306ae (3 findings: deep.test.ts aws-access-token, test-engine10-push-gitlab.sh gitlab-pat, rule_of_two.test.ts generic-api-key, all synthetic), so v9.79.0 and v9.80.0 never reached npm (npm view loki-mode version = 9.78.0). Baselined in 5190756f; local full-history scan shows only local-branch copies. Dispatched. Merged 3ab2a8fa (train E14, rebased on main): engine10 404 pass 0 fail (402 pass 0 fail with claude removed from PATH), tsc exit 0, test-harness 86/0, test-local-ci-gitleaks 6/0, test-engine10-dist 18/0. Released v9.81.0 (npm view loki-mode time: 2026-09-28T02:38:54Z). |
-| E-61 | A session that exits with an error fails its stage (implement reported done after exit "error" in 1s with 0 tokens) and its stderr tail is kept under the run dir for diagnosis | loki-ts/src/engine10/session.ts (stderr capture only), loki-ts/src/engine10/stages/implement.ts, loki-ts/src/engine10/stages/plan.ts, tests | HIGH | cd loki-ts && bun test tests/engine10/; a stub provider exiting 1 yields stage.failed with the stderr tail path | released@2026-09-28T16:03Z | Source: incident 01:38Z (EV-8 0/5 twice). Opus reviewer. Overlaps E-68 (exit classification) and E-69; builder of E-68 covers the stage-failure part. Wave E19, after E-68 landed (ea288330). D33: states its net core line delta; core must stay under 5,000 (92 lines of headroom shared by E-67, E-66, E-61, M-14, merge order E-67, E-66, E-61); offset any excess by deleting dead core code. Built b5f9f7fe (branch slice-E-61) at 04:30Z; its Opus review died on the 04:48Z access outage. Needs review only; D33 core delta must be checked. Wave E21 (wf_39ab3f7d-8f3). Opus review. Opus APPROVE of b5f9f7fe; merged into train E22 (9042e964): `bun test tests/engine10/` 547 pass 0 fail, tsc 0, `bash tests/test-v10-pulse.sh` 107 passed, `bash eval/loki10/test-harness.sh` 108 passed. Released in v10.2.1 (npm publish 2026-09-28T16:03Z; every cited commit is an ancestor of the v10.2.1 tag; `git merge-base --is-ancestor`). |
-| E-62 | Eval harness v10 arm defaults to this repo's bin/loki (never the global loki, which was v9.78.0) and the manifest records its path and the agent SDK version; local-ci and the harness refuse when loki-ts/node_modules differs from bun.lock | eval/loki10/harness.py (loki_bin default, manifest), scripts/local-ci.sh (one check), eval/loki10/test-harness.sh (one leg) | HIGH | bash eval/loki10/test-harness.sh; a leg asserts the v10 arm binary is the repo bin/loki | released@2026-09-28T16:03Z | Source: incident 01:38Z. Wave E19, after EV-13 landed (ea288330). Built 3e8f6dc8 (branch slice-E-62). Opus REJECT (reproduced): the new lockfile check in scripts/local-ci.sh is not in _FAST_KEEP, so the fast tier (the only gate) skips it. Next: rework. Wave E21 (wf_39ab3f7d-8f3). r2. r2 3e4f489c Opus APPROVE; conflicts in eval/loki10/test-harness.sh with EV-11a. Next: one engineer rebases EV-11b first, then E-62, onto main. r3 30047e4e Opus APPROVE (includes EV-11b-r2); merged locally; `bash eval/loki10/test-harness.sh` 114 passed 0 failed, validate all ok. Released in v10.2.1 (npm publish 2026-09-28T16:03Z; every cited commit is an ancestor of the v10.2.1 tag; `git merge-base --is-ancestor`). |
-| E-63 | Pulse STALE_PROGRESS violation when the newest PROGRESS.md entry is over 35 minutes old | scripts/v10-pulse.sh, tests/test-v10-pulse.sh | MEDIUM | bash tests/test-v10-pulse.sh | released@2026-10-03T09:21Z | on main f4876505c; first tag v10.0.0 (drift audit 09:24Z) |
-| E-64 | Lean small path and model cascade (D31): small tasks get one sonnet implement session with the cached repo map, impacted tests, PR; no plan or Wall unless no relevant tests; opus only on a test failure, reason logged; cost per call type | loki-ts/src/engine10 (implement, fix, plan, wall, sizing, session) | HIGH | cd loki-ts && bun test tests/engine10/; then EV-8 5-task measurement | released@2026-09-28T21:01Z | Source: D30, D31. Opus REJECT (47f0d33a): a non-escalated fix round still runs on the top model while the event says no escalation; does not merge onto main. Rework dispatched. Rework APPROVE (branch worktree-wf_4601e7b3-4d8-1: 70bae9be, db2c104f, 01ff7737): non-escalated fix rounds run on the cheap model and the event records the real model. Not merged; must be re-measured (full small arm) before it becomes the default. Merged c9c15f38 (trainE18), session.ts conflict with E-68 resolved to the 30s heartbeat; `bun test tests/engine10/` 444 pass. Still behind the gate: re-measure before default. Released in v10.5.0 (merge c9c15f38 is an ancestor of v10.5.0). |
-| E-65 | Session token diet: find and cut what makes one v10 session cost more than raw claude -p on the same task and model | loki-ts/src/engine10, engine10-only flag in loki-ts/src/runner if needed | HIGH | before/after token table on one task, then the EV-8 5 tasks | released@2026-10-16T00:49Z | Source: EV-8 variant C (a sonnet session $0.155 to $0.32 vs raw opus $0.216 per whole task). Built 92e3c06c: engine sessions 6 tools, no legacy append, no MCP, settingSources project; prefix 20.4k -> 7.1k tokens; 5 tasks on claude-sonnet-5 v10 4/5 $0.1523 per completed vs raw 4/5 $0.2113. Opus CONCERN: M5 (tools spread removed) and M6 (noAppend ignored) survive 1345 tests; rework sent (query()-level assertion, rebase). Opus APPROVE on rework c9a90cce (M5, M6, M7, M8 all red; runner plus engine10 1347 pass 0 fail, also without claude on PATH). Merged 8b76fd9a with dist rebuilt. EV-8 D (opus, lean, no plan or Wall) 4/5 $0.1571 per completed p50 28s; E (sonnet, lean) 4/5 $0.1519 p50 27.5s; raw opus on the same 5 tasks 5/5 $0.2161 p50 41s (~/loki-ci-logs/ev8r-{D,E}/results.jsonl). |
-| EV-11 | Medium eval tier: 15 multi-file tasks with hidden tests, tier field and --tier selection | eval/loki10/tasks/, eval/loki10/harness.py, run.sh | HIGH | python3 eval/loki10/harness.py validate; no-op baseline grades 15 not completed, 0 invalid | released@2026-09-28T21:01Z | Source: D30. Opus CONCERN: 3 of 15 medium tasks verified (ea04f1e0). Rework dispatched to finish the 15. Rework (branch worktree-wf_4601e7b3-4d8-2, head 5718225a): 4 of 15 medium tasks verified (pub-attrs-1313, pub-click-2869, pub-faker-1817, pub-jinja-1413). Opus CONCERN: 11 tasks still missing; leads in eval/loki10/tasks/INDEX.md. Wave E18 rework: 11 missing medium tasks, branch slice-EV-11-medium-15. Opus REJECT: pub-werkzeug-3121 hidden test not verbatim as claimed; pub-werkzeug-3105 grades a feature deletion as completed. Rework wave E19. Rework r2 f7cf7b58 (branch slice-EV-11-r2). Opus REJECT (reproduced): pub-faker-1817 grades a feature deletion (uniqueness tracking removed) as completed. Next: per-task deletion-mutant audit. Wave E21 (wf_39ab3f7d-8f3). Split EV-11a/EV-11b by task, per-task deletion-mutant audit. EV-11a (02e68591, Opus APPROVE) merged into train E22 (9042e964): `bun test tests/engine10/` 547 pass 0 fail, tsc 0, `bash tests/test-v10-pulse.sh` 107 passed, `bash eval/loki10/test-harness.sh` 108 passed. EV-11b (39ee810b, Opus APPROVE) conflicts with EV-11a in harness.py and test-harness.sh (each resolved the EV-11-r2 merge separately); rebase onto main next. EV-11b r2 0d601f64 Opus APPROVE, merged with E-62-r3; gitleaks v8.30.0 dir scan of eval/loki10/tasks finds only the known pub-werkzeug-3271 pin. Released in v10.5.0 (merge d25f9d43 is an ancestor of v10.5.0). |
-| EV-12 | Large eval tier: 10 feature or legacy tasks with hidden tests, including augmentiq-style issues | eval/loki10/tasks/ | HIGH | validate plus no-op baseline over 10 | parked@2026-09-28T18:58Z | Source: D30. Opus REJECT (fbd32234): 3 legacy tasks point at fixtures absent before merge (prepare_failed); spec items missing. Rework dispatched. Rework (branch worktree-wf_4601e7b3-4d8-3, head 0b9a2d91: 10 large tasks, repo-relative fixture sources). Opus REJECT: the repo-relative sources, .. rejection and fixture fixes are reproduced, but the large tasks are still smaller than the medium ones (task-size finding open). Next: rework with genuinely feature-sized tasks. Wave E18 rework: feature-sized large tasks, branch slice-EV-12-large-tasks. Opus REJECT: only lg-rbac reworked (1 of 10 feature-sized); fixture files outside the set. Rework wave E19 (fixtures now in set). Rework r2 237daa65 (branch slice-EV-12-r2). Opus REJECT: large tasks still not all feature-sized (engineer report agrees). Next: split across engineers, a few tasks each. Wave E21 (wf_39ab3f7d-8f3). Split EV-12a/b/c by task. Round 4: EV-12a CONCERN (size bar met by deleted docstrings, about 93-106 added lines), EV-12b REJECT (bundles built by an uncommitted script; no legacy code left), EV-12c REJECT (storage.validate counted but untested). Sent to the CTO for a tier ruling before any further rework. D34 (CTO): synthetic lg-* tasks closed, not merged; replaced by EV-12S (size gate) and EV-12A/B/C (real upstream PRs, 5 needed), then EV-12D (INDEX). Legacy moves to M-27. Wave E24 (wf_55378a48-585): EV-12S approved (rebase onto main pending), large tasks passing review 2 of 5 (lg-werkzeug-1513, lg-werkzeug-1680); EV-12A 1769 fix, EV-12B fresh search, EV-12C hardening building. D38 (CTO): upstream-first hidden tests plus requirements map; EV-12S approved (8ef877e8, merge pending); EV-12E, EV-12F, EV-12G cut. Reviewer shortcut patches saved to ~/loki-ci-logs/ev12-shortcuts/. Parked 18:58Z per D40 (fix medium before large; EV-12F/G deprioritized); branches kept. |
-| M-00 | MODERNIZE.md design (CTO and Architect) and the Part 2 slice table M-01.. | docs/v10/MODERNIZE.md | HIGH | doc under 400 lines with a 20 to 30 slice plan | released@2026-10-16T00:49Z | Source: D30 Part 2. ETA 02:45Z. Built 17e97855 (399 lines, 30 slices); merges in train E17 (b2ad73ce). |
-| M-01 | Modernize event types, log wrapper and state paths | loki-ts/src/engine10/modernize/types.ts, loki-ts/src/engine10/modernize/log.ts, loki-ts/tests/engine10/modernize/log.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/log.test.ts | released@2026-09-28T05:00Z | Source: MODERNIZE.md (D30). Depends on none. Built on branch worktree-wf_4601e7b3-4d8-4 (777f6cdd M-01, 212a7404 M-02, 6b00c05c M-05, 3d8edb5d M-06). TL CONCERN: cluster.ts tarjanSCC recursion overflows the stack on dependency chains of about 20-50k nodes (the M-28/M-29 scale); needs an iterative SCC. Wave E18 (wf_5063e58d-7a5) carries it with the M-05 iterative SCC rework, branch slice-M-05-iterative-scc. Merged f4d98c0b with M-05. Released in v10.1.0 (npm publish 2026-09-28T05:00Z; every cited commit is an ancestor of the v10.1.0 tag; `git merge-base --is-ancestor`). |
-| M-02 | Inventory core: files, languages, build, entry points, tests | loki-ts/src/engine10/modernize/inventory.ts, loki-ts/tests/engine10/modernize/inventory.test.ts, loki-ts/tests/engine10/modernize/fixtures/inv/ | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/inventory.test.ts | released@2026-09-28T05:00Z | Source: MODERNIZE.md (D30). Depends on M-01. Built on branch worktree-wf_4601e7b3-4d8-4 (777f6cdd M-01, 212a7404 M-02, 6b00c05c M-05, 3d8edb5d M-06). TL CONCERN: cluster.ts tarjanSCC recursion overflows the stack on dependency chains of about 20-50k nodes (the M-28/M-29 scale); needs an iterative SCC. Wave E18 with M-05, branch slice-M-05-iterative-scc. Merged f4d98c0b with M-05. Released in v10.1.0 (npm publish 2026-09-28T05:00Z; every cited commit is an ancestor of the v10.1.0 tag; `git merge-base --is-ancestor`). |
-| M-03 | Python import graph via tokenize (lexes py2 source) | loki-ts/src/engine10/modernize/lang/python.ts, autonomy/lib/modernize/py_imports.py, loki-ts/tests/engine10/modernize/python_graph.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/python_graph.test.ts | released@2026-09-28T14:26Z | Source: MODERNIZE.md (D30). Depends on M-02. Wave E18, based on the M-02 branch, branch slice-M-03-python-graph. TL REJECT: bare relative from-imports (from . import X) mis-parsed in py_imports.py. Rework wave E19. Rework 8b5e1340 TL APPROVE (sonnet); merged c90d7924; `bun test tests/engine10/` 481 pass 0 fail. Released in v10.1.1 (npm publish 2026-09-28T14:26Z; every cited commit is an ancestor of the v10.1.1 tag; `git merge-base --is-ancestor`). |
-| M-04 | Java graph via jdeps, import-scan fallback recorded | loki-ts/src/engine10/modernize/lang/java.ts, loki-ts/tests/engine10/modernize/java_graph.test.ts, loki-ts/tests/engine10/modernize/fixtures/java8/ | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/java_graph.test.ts | released@2026-09-28T16:03Z | Source: MODERNIZE.md (D30). Depends on M-02. Wave E18, based on the M-02 branch, branch slice-M-04-java-graph. TL REJECT: wildcard and static imports silently dropped in the import-scan fallback. Rework wave E19. Rework r2 7713ad9b (branch slice-M-04-r2). TL REJECT (reproduced): an unresolved wildcard whose package has no local files is dropped silently (java.ts importScanGraph). Next: rework. Wave E21 (wf_39ab3f7d-8f3). r3. Rework r3 771ff0a0 TL APPROVE; merged into train E22 (9042e964): `bun test tests/engine10/` 547 pass 0 fail, tsc 0, `bash tests/test-v10-pulse.sh` 107 passed, `bash eval/loki10/test-harness.sh` 108 passed. Released in v10.2.1 (npm publish 2026-09-28T16:03Z; every cited commit is an ancestor of the v10.2.1 tag; `git merge-base --is-ancestor`). |
-| M-05 | SCC clustering, 1,500-line unit cap, topological waves | loki-ts/src/engine10/modernize/cluster.ts, loki-ts/tests/engine10/modernize/cluster.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/cluster.test.ts | released@2026-09-28T05:00Z | Source: MODERNIZE.md (D30). Depends on M-02. Built on branch worktree-wf_4601e7b3-4d8-4 (777f6cdd M-01, 212a7404 M-02, 6b00c05c M-05, 3d8edb5d M-06). TL CONCERN: cluster.ts tarjanSCC recursion overflows the stack on dependency chains of about 20-50k nodes (the M-28/M-29 scale); needs an iterative SCC. Wave E18 rework: iterative Tarjan, branch slice-M-05-iterative-scc. TL APPROVE (sonnet): iterative Tarjan 372ebe11, red on recursive (RangeError), 2000/2000 fuzz identical; merged f4d98c0b, `bun test tests/engine10/modernize/` 28 pass 0 fail. Released in v10.1.0 (npm publish 2026-09-28T05:00Z; every cited commit is an ancestor of the v10.1.0 tag; `git merge-base --is-ancestor`). |
-| M-06 | Up-front estimate (cost, time, risk), --budget math, --dry-run print | loki-ts/src/engine10/modernize/estimate.ts, loki-ts/tests/engine10/modernize/estimate.test.ts | LOW | cd loki-ts && bun test tests/engine10/modernize/estimate.test.ts | released@2026-09-28T05:00Z | Source: MODERNIZE.md (D30). Depends on M-05. Built on branch worktree-wf_4601e7b3-4d8-4 (777f6cdd M-01, 212a7404 M-02, 6b00c05c M-05, 3d8edb5d M-06). TL CONCERN: cluster.ts tarjanSCC recursion overflows the stack on dependency chains of about 20-50k nodes (the M-28/M-29 scale); needs an iterative SCC. Wave E18 with M-05, branch slice-M-05-iterative-scc. Merged f4d98c0b with M-05. Released in v10.1.0 (npm publish 2026-09-28T05:00Z; every cited commit is an ancestor of the v10.1.0 tag; `git merge-base --is-ancestor`). |
-| M-07 | modernize CLI and flag parsing; TABLE route in engine10 cli | loki-ts/src/engine10/modernize/cli.ts, loki-ts/src/engine10/cli.ts (TABLE and USAGE line only), loki-ts/tests/engine10/modernize/cli.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/cli.test.ts | released@2026-09-28T21:01Z | Source: MODERNIZE.md (D30). Depends on M-06, E-31 merged or parked. Wave E21 (wf_39ab3f7d-8f3). TL APPROVE of 13848b53, but merged after E-66/E-61/M-24 core reads exactly 5,000 (cap is under 5,000). Next: net core delta at most -1 (offset in cli.ts or dead core code), then merge. r2 TL REJECT (reproduced): modernize/cli.ts TABLE-routed but not in registry.ts (registry.test.ts red when merged); report claimed 40/0 but 39/1; --help lost its modernize line. Next: register it, keep the USAGE line, offset core elsewhere. Wave E26 (wf_9ba5fcaf-75a). Round 4. r4 3c73b6cb honest (unsquashed) version; its only blocking finding (core 5,000) no longer reproduces after E-67 removed escalate.ts: merged 02c30314, core 4,977, budget/registry/cli tests 41 pass 0 fail, `bun test tests/engine10/` 654 pass (1 load-timeout, 35/0 alone), dist 18 passed. Released in v10.5.0 (merge 02c30314 is an ancestor of v10.5.0). |
-| M-08 | bin/loki modernize arm to engine10 regardless of default | bin/loki (modernize arm only), tests/test-modernize-dispatch.sh | MEDIUM | bash tests/test-modernize-dispatch.sh | released@2026-09-28T21:01Z | Source: MODERNIZE.md (D30). Depends on M-07. Dispatched 18:58Z, sonnet engineer. Tech Lead REJECT r1 (engine10-dispatch count) and r2 (shadowed legacy modernize heal/migrate: alias-forwarding 204/9); APPROVE r3 766a493b (engine10 only when --to present). Merged; modernize-dispatch 18/0, engine10-dispatch 35/0, alias-forwarding 213/0 (main baseline), shard coverage 19/0, drift 6/0. Released in v10.5.0 (merge 019ddb0e is an ancestor of v10.5.0). |
-| M-09 | py2/3 capture tracer with type-tagged JSON and branch coverage | autonomy/lib/modernize/py_capture.py, tests/test-modernize-py-capture.sh, tests/fixtures/modernize/py2/ | HIGH | bash tests/test-modernize-py-capture.sh | released@2026-09-28T14:26Z | Source: MODERNIZE.md (D30). Depends on M-01. Built a4fbf034 (branch worktree-wf_4601e7b3-4d8-5). Opus REJECT (reproduced): unsupported types (sets, Decimal, datetime, bytearray, custom classes) record as equal with no not_proven entry, so the oracle could certify unproven equivalence. Next: rework. Wave E18 rework: unsupported types yield not_proven, branch slice-M-09-not-proven-types. Opus REJECT of 3594eee5: subclasses of supported types (namedtuple, IntEnum, OrderedDict) tag as the base type with no not_proven. Rework wave E19. Rework 085bc2e0 Opus APPROVE; merged b8d40a34; `bash tests/test-modernize-py-capture.sh` Passed 50 Failed 0 Skipped 1 (no python2). Released in v10.1.1 (npm publish 2026-09-28T14:26Z; every cited commit is an ancestor of the v10.1.1 tag; `git merge-base --is-ancestor`). |
-| M-10 | Coverage-guided input search (read-only session, plateau stop) | loki-ts/src/engine10/modernize/oracle/search.ts, loki-ts/tests/engine10/modernize/search.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/search.test.ts | released@2026-09-28T21:01Z | Source: MODERNIZE.md (D30). Depends on M-09. Opus REJECT (reproduced): a failed seed capture is reported as a plateau. Next: rework. r2 d7db4fb1 Opus APPROVE; merged dc827b80 (on top of v10.2.2): full `cd loki-ts && bun test` 2277 pass 0 fail, `bash tests/test-engine10-dist.sh` 18 passed, `bash tests/test-v10-pulse.sh` 117 passed. Released in v10.5.0 (merge 66c5e465 is an ancestor of v10.5.0). |
-| M-11 | Java capture: JUnit under JDK 8 with JaCoCo plus Randoop | autonomy/lib/modernize/java_capture.sh, loki-ts/src/engine10/modernize/oracle/java.ts, loki-ts/tests/engine10/modernize/java_capture.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/java_capture.test.ts | released@2026-09-28T21:01Z | Source: MODERNIZE.md (D30). Depends on M-04. Opus REJECT (reproduced): multi-line java -version breaks status.json (json_escape skips newlines). Next: rework. Wave E26 (wf_9ba5fcaf-75a). Round 3. r3 e476435b opus APPROVE (every C0 byte escaped as \u00XX; malformed status.json reported as its own reason); merged locally. Released in v10.5.0 (merge 4a11c285 is an ancestor of v10.5.0). |
-| M-12 | Oracle seal, held-out split, 80% floor, up-front NOT PROVEN | loki-ts/src/engine10/modernize/oracle/seal.ts, loki-ts/tests/engine10/modernize/oracle_seal.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/oracle_seal.test.ts | released@2026-09-28T21:01Z | Source: MODERNIZE.md (D30). Depends on M-09. Opus REJECT (reproduced): delete-and-reseal defeats tamper evidence (hashes stored beside the data). Next: rework. r2 d9026ec6 Opus APPROVE (reseal refused via the append-only log); merged dc827b80 (on top of v10.2.2): full `cd loki-ts && bun test` 2277 pass 0 fail, `bash tests/test-engine10-dist.sh` 18 passed, `bash tests/test-v10-pulse.sh` 117 passed. Released in v10.5.0 (merge b71d80fa is an ancestor of v10.5.0). |
-| M-13 | Equivalence checker with sealed normalizers and contract output | loki-ts/src/engine10/modernize/equiv.ts, loki-ts/tests/engine10/modernize/equiv.test.ts, loki-ts/tests/engine10/modernize/fixtures/equiv/ | HIGH | cd loki-ts && bun test tests/engine10/modernize/equiv.test.ts | released@2026-09-28T22:26Z | Source: MODERNIZE.md (D30). Depends on M-12. Wave E27 (wf_bcacb1d1-e76). Wave E27 stopped 18:37Z (founder: over budget, load 50). REJECT (reproduced): a unit whose oracle seal is NOT_PROVEN still gets a clean equivalence pass. Branch slice-M-13-equiv kept. Dispatched 21:18Z sonnet (founder 17:10 staffing directive). r2 b379c171 REJECT (3 blockers), r3 89ea40ae REJECT on B3 (normalizers still caller-supplied: tolerance 1e9 after the new tree gives PROVEN). D42 (4): only fix (a), sealOracle hashes the normalizers; M-13 may edit the M-12 seal file for this only. r4 dispatched 21:42Z. r4 fe3cae28 opus APPROVE (normalizer hash in the oracle seal; tolerance 1e9 after seal gives NOT_PROVEN; hand-edited sealed.json refused; canonical hash over all 3 fields). Merged. Released in v10.5.3 (merge cb1ef386 is an ancestor of v10.5.3). |
-| M-14 | Wall pre-sealed mode: oracle plus conformance, green base is an error | loki-ts/src/engine10/stages/wall.ts (pre-sealed branch only), loki-ts/tests/engine10/modernize/wall_presealed.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/wall_presealed.test.ts | released@2026-09-28T23:18Z | Source: MODERNIZE.md (D30). Depends on M-12, E-54. D33: states its net core line delta; core must stay under 5,000 (92 lines of headroom shared by E-67, E-66, E-61, M-14, merge order E-67, E-66, E-61); offset any excess by deleting dead core code. Wave E27 (wf_bcacb1d1-e76). Wave E27 stopped 18:37Z (founder: over budget, load 50). REJECT: branch empty (no commits). Dispatched 21:51Z. r1 867cffab opus REJECT: crash/OOM/signal exits read as red; bare ImportError enum reads a missing third-party package as red; no file sha256 or verify; no binding to the oracle seal. r2 dispatched 21:57Z. r2 86d078eb (crash/signal exits not_run; inRepo on collection errors; file sha256 plus verify; oracle seal required; base_sha recorded); presealed 26/26, modernize 222/0; opus re-review 22:04Z. r2 86d078eb opus: B1, B3, B4 fixed; B2 still open (inRepo is a caller-supplied flag: name six with inRepo true gives red). r3 derives it from the repo tree. r3 ef4fa166 opus APPROVE (inRepo derived from the real tree via realpath; symlinks and .. names give not_run; verify re-runs verifySeal). Merged; modernize suite green. Released in v10.5.5 (merge c8f9a7d0 is an ancestor of v10.5.5). |
-| M-15 | Unit runner: card to v10 run with oracle Wall and equiv check | loki-ts/src/engine10/modernize/unit.ts, loki-ts/tests/engine10/modernize/unit.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/unit.test.ts | released@2026-10-16T00:49Z | Source: MODERNIZE.md (D30). Depends on M-13, M-14. Requirement from the M-13 review: call sealOracle with the card normalizers before implement, and test that ordering. From the M-14 review: derive the failing module from the traceback file path under the target runtime (site-packages can shadow a repo name); resolve the module part of an AttributeError so real reds are sealable; call verifyPreSealedWall and verifySeal before trusting a Wall. Dispatched 22:09Z (M-13, M-14 merged).  WIND-DOWN 2026-09-28: opus r1 REJECT (B1 importer frame made a missing third-party package red; B2 PROVEN without conformance re-run or ablation) fixed at 03b35a69 on slice-M-15 (modernize plus budget 250/0, both red then green on real pytest 9.0.2). NEXT: opus r2 review of 03b35a69, then merge. Opus r3 REJECT (18:40Z): B1 added pytest.toml/.pytest.ini or test file bypasses conformance to PROVEN with u.py unmodernized; r4 widens drift rules, adds throwing-stub ablation test, re-syncs the collection rule to E-125 6fc6e950. M-17 must build the production runStub. PARKED 20:05Z by the adoption directive (docs/v10/PROGRESS.md 20:05Z); resumes after Tier 0 is green. |
-| M-16 | Deterministic codemods first (futurize, OpenRewrite) or skipped | loki-ts/src/engine10/modernize/codemod.ts, loki-ts/tests/engine10/modernize/codemod.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/codemod.test.ts | released@2026-09-28T16:03Z | Source: MODERNIZE.md (D30). Depends on M-02. Built 0a8bbe6c (branch slice-M-16-codemods); TL review died on the 04:48Z access outage. Wave E21 (wf_39ab3f7d-8f3). TL review. TL APPROVE of 0a8bbe6c; merged into train E22 (9042e964): `bun test tests/engine10/` 547 pass 0 fail, tsc 0, `bash tests/test-v10-pulse.sh` 107 passed, `bash eval/loki10/test-harness.sh` 108 passed. Released in v10.2.1 (npm publish 2026-09-28T16:03Z; every cited commit is an ancestor of the v10.2.1 tag; `git merge-base --is-ancestor`). |
-| M-17 | Scheduler: N workers, worktrees, cascade, best-of-2, budget stop | loki-ts/src/engine10/modernize/scheduler.ts, loki-ts/tests/engine10/modernize/scheduler.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/scheduler.test.ts | released@2026-10-16T00:49Z | Source: MODERNIZE.md (D30). Depends on M-15. |
-| M-18 | Re-slice non-equivalent units to depth 2, then NOT PROVEN | loki-ts/src/engine10/modernize/reslice.ts, loki-ts/tests/engine10/modernize/reslice.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/reslice.test.ts | released@2026-09-28T23:18Z | Source: MODERNIZE.md (D30). Depends on M-05, M-13.  Merged 20c51512 after TL r2 APPROVE (f41e7e70; reslice 13/0, modernize 241/0 on main). Released in v10.5.5 (merge 20c51512 is an ancestor of v10.5.5). |
-| M-19 | Strangler targets and routes.json (py2/dual/py3, per-module release) | loki-ts/src/engine10/modernize/routes.ts, loki-ts/src/engine10/modernize/targets/python3.ts, loki-ts/src/engine10/modernize/targets/java21.ts, loki-ts/tests/engine10/modernize/routes.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/routes.test.ts | released@2026-09-28T16:03Z | Source: MODERNIZE.md (D30). Depends on M-05. Built 3299d359 (branch slice-M-19-routes); TL review died on the 04:48Z access outage. Wave E21 (wf_39ab3f7d-8f3). TL review. TL APPROVE of 3299d359; merged into train E22 (9042e964): `bun test tests/engine10/` 547 pass 0 fail, tsc 0, `bash tests/test-v10-pulse.sh` 107 passed, `bash eval/loki10/test-harness.sh` 108 passed. Released in v10.2.1 (npm publish 2026-09-28T16:03Z; every cited commit is an ancestor of the v10.2.1 tag; `git merge-base --is-ancestor`). |
-| M-20 | Wave verify: full build, integration and original suite | loki-ts/src/engine10/modernize/wave.ts, loki-ts/tests/engine10/modernize/wave.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/wave.test.ts | released@2026-10-16T01:20Z | b3df49d8d APPROVED (sonnet review, mutant killed), riding fv-train. Source: MODERNIZE.md (D30). Depends on M-17, M-19. |
-| M-21 | Wave ship: one PR per wave with unit receipts, draft unless all proven | loki-ts/src/engine10/modernize/ship.ts, loki-ts/tests/engine10/modernize/ship.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/ship.test.ts | released@2026-10-16T02:04Z | Source: MODERNIZE.md (D30). Depends on M-20. |
-| M-22 | Unit-level resume after coordinator crash | loki-ts/src/engine10/modernize/resume.ts, loki-ts/tests/engine10/modernize/resume.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/resume.test.ts | released@2026-10-16T02:04Z | Source: MODERNIZE.md (D30). Depends on M-17, E-39. |
-| M-23 | Remote units via POST /jobs kind unit, Helm worker.engine v10, local re-verify | autonomy/trigger-server.py (unit job kind only), deploy/helm/autonomi/templates/job-worker.yaml, deploy/helm/autonomi/values.yaml, loki-ts/src/engine10/modernize/remote.ts, loki-ts/tests/engine10/modernize/remote.test.ts, tests/test-trigger-server-unit-jobs.py | HIGH | python3 tests/test-trigger-server-unit-jobs.py && (cd loki-ts && bun test tests/engine10/modernize/remote.test.ts) | released@2026-10-16T02:04Z | Source: MODERNIZE.md (D30). Depends on M-17. |
-| M-24 | Dashboard /modernize view | loki-ts/src/engine10/dashboard/modernize.ts, loki-ts/src/engine10/dashboard/server.ts (one route), loki-ts/tests/engine10/modernize/dashboard.test.ts | LOW | cd loki-ts && bun test tests/engine10/modernize/dashboard.test.ts | released@2026-09-28T16:03Z | Source: MODERNIZE.md (D30). Depends on M-01. Built fe3dd87a (branch slice-M-24-dashboard); TL review died on the 04:48Z access outage. Wave E21 (wf_39ab3f7d-8f3). TL review. TL APPROVE of fe3dd87a; merged into train E22 (9042e964): `bun test tests/engine10/` 547 pass 0 fail, tsc 0, `bash tests/test-v10-pulse.sh` 107 passed, `bash eval/loki10/test-harness.sh` 108 passed. Released in v10.2.1 (npm publish 2026-09-28T16:03Z; every cited commit is an ancestor of the v10.2.1 tag; `git merge-base --is-ancestor`). |
-| M-25 | Final report and verdict (COMPLETE only if all proven), sealed | loki-ts/src/engine10/modernize/report.ts, loki-ts/tests/engine10/modernize/report.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/report.test.ts | released@2026-10-16T02:40Z | Source: MODERNIZE.md (D30). Depends on M-13, M-21. |
-| M-26 | End-to-end: py2 fixture repo modernized with stub provider | loki-ts/tests/engine10/modernize/e2e.test.ts, loki-ts/tests/engine10/modernize/fixtures/e2e_py2/ | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/e2e.test.ts | released@2026-10-16T22:45Z | Source: MODERNIZE.md (D30). Depends on M-08, M-22, M-25. Reconciled 2026-10-16: shipped as ea6d2eef8 (ancestor of main c89555bce). |
-| M-27 | Legacy-Bench pilot harness; confirm public set; calibrate cap | eval/modernize/pilot.py, eval/modernize/test-pilot.sh | HIGH | bash eval/modernize/test-pilot.sh | parked@2026-10-16T23:05Z | Source: MODERNIZE.md (D30). Depends on M-26. D34: absorbs the D30 large-tier legacy coverage. D98 park after round 2: round 2 opus BLOCK on fc2a7e90 (F1, budget-skipped units vanish, partial run counts ok). Carried forward as M-27b on top of fc2a7e90. |
-| M-27b | M-27 carry-forward: pilot counts planned units from wave.started/estimate.printed, unrun units are not proven, missing modernize.completed or non-zero exit is not ok, cost per 1K lines labelled lower bound | eval/modernize/pilot.py, eval/modernize/test-pilot.sh | HIGH | bash eval/modernize/test-pilot.sh | released@2026-10-17T03:50Z | Base fc2a7e90 (M-27 round 1 fixes). Source: M-27 round 2 HIGH review F1. Unblocks M-28. Round 1 BLOCK (no producer for modernize.completed, spend undercount, planned units); round 2 fix 7fc7c886 (test-pilot 32/0) in HIGH round 2 review. Round 2 APPROVE 7fc7c886 (test-pilot 32/0, structural 25/0), merged; ships in 11.17.7. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| M-28 | 200K scale run (Mercurial 4.x, measured first, fallback Calibre) | eval/modernize/scale.py, eval/modernize/MODERNIZE.md section 12 | HIGH | python3 eval/modernize/scale.py --target hg --dry-run-first | released@2026-10-17T03:50Z | Merged 90f48b846 (fix ac1edf2e8, HIGH r2 APPROVE; test-pilot 48/0). 6db850558 HIGH r1 BLOCK (B1: scratch copy has no .git, so git ls-files sees 0 units); fixing for r2. Source: MODERNIZE.md (D30). Depends on M-27b (M-27 parked; M-27b merged 23:30Z). Dry-run harness only; the paid run needs --execute and --budget-usd. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| M-29 | 1M scale run (Hadoop 2.x Java 8 to 21, measured first) | eval/modernize/scale_1m.py, eval/modernize/SCALE-1M.md | HIGH | python3 eval/modernize/scale_1m.py --dry-run-first | ready@2026-09-28T02:45Z | Source: MODERNIZE.md (D30). Depends on M-28, M-11. |
-| M-25w | Modernize report and reslice event wired in production (FC-M25W): coordinator calls writeReport at run end, reslice.ts emits unit.resliced, and a guard asserts every declared modernize event has a producer | loki-ts/src/util/modernize_coordinator.ts, loki-ts/src/engine10/modernize/reslice.ts, loki-ts/tests/engine10/modernize/e2e.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/ | released@2026-10-17T03:50Z | Source: M-27 HIGH review B2/B3 (FAILURE-CLASSES FC-M25W). Engine10 core is at 4999 of 5000 lines; the coordinator lives in src/util, keep engine10 edits net zero. HIGH round 1 APPROVED 8836ea62 (engine10 2600 pass 0 fail, typecheck clean, 9 Seal probes fail closed). Ships in 11.17.7. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| M-25w-b | M-25w follow-ups: producer guard requires the event name inside an append( call (review mutations M2-M4 fooled it); coordinator calls reslice() so unit.resliced is emitted in real runs; unit.planned and codemod.skipped get producers and leave the allowlist (FC-M25W-b); pilot.py docstring no longer says no writer emits unit.resliced | loki-ts/src/util/modernize_coordinator.ts, loki-ts/src/engine10/modernize/, loki-ts/tests/engine10/modernize/, eval/modernize/pilot.py | HIGH | cd loki-ts && bun test tests/engine10/modernize/ | released@2026-10-17T03:50Z | HIGH APPROVE 90868d3af (modernize 527 pass 0 fail, tsc 0, pilot 32/0; guard red on all 3 producer deletions) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| M-25w-c | Modernize producer guard hardening: hasProducer requires a word boundary before append( and ignores strings and comments; each declared modernize event has a behavioral producer test; pilot.py:425 stale "no writer emits unit.resliced" comment fixed; a codemod tool that exits non-zero logs an event | loki-ts/tests/engine10/modernize/log.test.ts, eval/modernize/pilot.py, loki-ts/src/util/modernize_coordinator.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/ | released@2026-10-17T03:50Z | merge of 46df77c54 after TL APPROVE: 565 pass rc=0, pilot 48 passed, 2 mutations red Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| REL-GUARD-b | REL-GUARD follow-ups: guard rows run in a clean detached worktree of HEAD, fail closed on missing tsv or zero suites, timeout 300, env -u LOKI_RUN_TMP | scripts/release.sh, scripts/impacted-gate.sh, tests/test-release-sh.sh, tests/test-impacted-gate.sh | HIGH | bash tests/test-release-sh.sh | released@2026-10-17T03:50Z | Round 1 BLOCK 729cb804 (dirty-tree refusal blocked every main-checkout release); round 2 8d28a3a47 in final HIGH review (D98). Round 2 APPROVED (release-sh 43/0, dry run against the real global-guards.tsv with a dirty red row: PASS 23 suites rc 0 in 196s). Ships in 11.17.7. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| REL-GUARD-c | REL-GUARD-b follow-ups: an interrupted release leaves a registered guard worktree (prune does not reclaim it while the dir exists), so remove stale loki-guard.* registrations at function start or via a scoped trap; prune after the rm; log the chmod 700 failure branch | scripts/release.sh, tests/test-release-sh.sh | LOW | bash tests/test-release-sh.sh | released@2026-10-17T03:50Z | c78236338+7fa0b91d9, LOW approved; release-sh 49/0, no-tmp-sweep 8/0, sigpipe 4/0.  Source: REL-GUARD-b HIGH round 2 non-blocking notes 1-3. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| Q17-01 | Slack "Run finished" message shows the stored receipt verdict, with TAMPERED or UNVERIFIED when the integrity check says so, not only the outcome. It also says "(unattested)" when no verdict is available. | loki-ts/src/util/slack_events.ts, loki-ts/src/engine10/supervisor.ts (the finished-event call site only), loki-ts/tests/engine10/slack_events.test.ts | HIGH | `cd loki-ts && bun test tests/engine10/slack_events.test.ts tests/engine10/output.test.ts`; `cd loki-ts && bunx tsc --noEmit` | released@2026-10-17T03:50Z | merge of e2f197d94 after TL APPROVE (47 pass rc=0, mutation red 2 fail); follow-up: supervisor-level tampered test Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| Q17-02 | engine10 console `Cost` line adds "N% of cap $X" when a run cap is set (`--max-cost` or `LOKI_E10_MAX_COST_USD`), so users see how close a `loki start` run came to its cap. Without a cap the line is byte-identical to today. | loki-ts/src/engine10/output.ts (costLine only), loki-ts/src/engine10/supervisor.ts (pass the resolved cap into the summary input), loki-ts/tests/engine10/output.test.ts | MEDIUM | `cd loki-ts && bun test tests/engine10/output.test.ts tests/engine10/output_group.test.ts`; `cd loki-ts && bunx tsc --noEmit` | released@2026-10-17T02:57Z | merge 5f1cde7f2 dist 70e4a9b12; TL r2 APPROVE 11eac46fa, rebased to 5032a1912 (supervisor.ts conflict, TL APPROVE resolution). TL BLOCK ff4c80939: no supervisor-level test for the capUsd pass-through; r1 fix building. v11.17.13 npm next 11.17.13 |
-| Q17-03 | Verify's flaky list becomes a rerun signal in `decideRecovery`. A fail-then-pass check no longer burns a fix round, while a real failure still does. The fail-safe default is kept. | loki-ts/src/runner/recovery_policy.ts, loki-ts/tests/runner/harness_intelligence.test.ts | MEDIUM | `cd loki-ts && bun test tests/runner/harness_intelligence.test.ts`; `cd loki-ts && bunx tsc --noEmit` | released@2026-10-17T03:50Z | TL APPROVE 3dec444fa (bun test runner+engine10+util 4157 pass 0 fail, 3/3 mutations red) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| Q17-04 | FC-68 siblings: `assert-wall-executed.sh` also fails the release smoke when an expected non-Wall check (lint, mutation proof, cross review) is missing from the receipt `checks[]` without a failing exit. | scripts/assert-wall-executed.sh, scripts/real-run.sh (SC_* knob in the existing scenario parser), tests/test-real-run-guards.sh | HIGH | `bash tests/test-real-run-guards.sh`; `bash -n scripts/assert-wall-executed.sh scripts/real-run.sh` | parked@2026-10-17T00:20Z | D98 park after HIGH r2 BLOCK on b617d3e1f: B1 fixed, B2 not; SC_EXPECT_CHECKS=node is met by the Wall check node:loki_wall_* alone (verify.ts:277, wall.ts:22), so a dropped non-Wall test still passes. Re-sliced as Q17-04b. r2 fix b617d3e1f (wall guard 36/0); HIGH r2 review running. FAILURE-CLASSES.md:643 FC-68 "Siblings: any other check a receipt could lose without a failing exit ... is not yet counted". Release gate, so HIGH. Needs red-then-green: a receipt with the lint check dropped must go red. |
-| Q17-04b | Q17-04 re-slice: real-run scenarios pin the exact non-Wall check names (trivial-sum node:sum.test.js, two-bug node:lib.test.js) on top of b617d3e1f, plus a guard test where only the Wall test is a node check and token node:sum.test.js fails | tests/real-run/scenarios/trivial-sum.sh, tests/real-run/scenarios/two-bug.sh, tests/test-wall-executed-guard.sh | MEDIUM | `bash tests/test-wall-executed-guard.sh`; `bash tests/test-sigpipe-guard.sh` | released@2026-10-17T03:50Z | TL APPROVE e1bdde7d3 (bare-node mutation caught by structural check); merged with Q17-04 commits. Built e1bdde7d3 (wall guard 0 FAIL, shellcheck rc 0, sigpipe 4/0); TL review running. Source: Q17-04 HIGH r2 finding, fix option 1. Base b617d3e1f (branch q17-04). Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| Q17-05 | Shipper sends the sha256 of each event line before redaction, so the Control Plane can tell a genuine redaction from a downgrade (FAILED edited to PARTIAL plus a planted [REDACTED]). Today such a log reads only "(unattested)" or UNVERIFIED. | loki-ts/src/util/redact.ts, packages/control-plane/src/server/integrity.ts, packages/control-plane/test/integrity.test.ts | HIGH | `cd packages/control-plane && bun test test/integrity.test.ts`; `cd loki-ts && bun test tests/util/redact.test.ts` | rejected@2026-10-17T00:38Z | HIGH r1 BLOCK on 36524784d, design unsound (D12): client-supplied pre-redaction chain is trusted, so copying log.sealed events_sha256 makes a FAILED-to-VERIFIED forgery read attested and sig-checked; chain not bound to run id (cross-run replay). Not patchable in place; re-sliced as Q17-05b (engine-side redaction). Branch q17-05 kept. Built 36524784d (control-plane integrity 61/0, loki-ts util 286/0); HIGH r1 review running. FAILURE-CLASSES.md:140 deferred sibling of EL-FC08b. Delivered accuracy and Seal. A forged downgrade must read TAMPERED. Test file paths are the nearest existing ones; the engineer confirms by `ls`. |
-| Q17-05b | EL-FC08b at source: the engine redacts secrets in event data before it hashes the log and signs the seal, so an honest run holding a token ships byte-identical lines that the Control Plane hashes itself and reads VERIFIED; the shipper redaction becomes a no-op on already-redacted lines, and any later edit (including a planted [REDACTED]) reads TAMPERED. No client-supplied hash is ever trusted. | loki-ts/src/util/redact.ts, the engine event-log writer that computes events_sha256 (locate via git grep events_sha256 loki-ts/src), packages/control-plane/test/integrity.test.ts | HIGH | `cd packages/control-plane && bun test test/server/`; `cd loki-ts && bun test tests/util/ tests/engine10/` | released v11.17.47 | Source: Q17-05 HIGH r1 (FAILURE-CLASSES.md:139-140). Architect pass first: confirm the writer call site and the parity with run.sh before building; forgery fixtures A-D from the Q17-05 review must read TAMPERED or UNVERIFIED, never VERIFIED. |
-| Q18-01 | FC-25c(b) remainder: control-plane shipper gitOrigin runs raw execFileSync("git") with a real-token env; convert to safeGit and make the raw-spawn guard scan packages/control-plane | packages/control-plane/src/shipper/discover.ts, loki-ts/tests/util/fc25_raw_spawn_guard.test.ts | HIGH | `cd loki-ts && bun test tests/util/fc25_raw_spawn_guard.test.ts tests/util/fc25_safe_git.test.ts`; `cd packages/control-plane && bun test`; `cd loki-ts && bunx tsc --noEmit` | released@2026-10-17T03:50Z | HIGH APPROVE dbb93205a (bun test util 289 pass, 6/6 guard mutations caught); follow-up: comment integrations.ts:85 key-path split Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| Q18-02 | FC-25c(a): allowToken keeps repo-local core.sshCommand, remote.*.uploadpack/receivepack and repo-scope credential.helper; pin them off while the user global helper still works | loki-ts/src/util/safe_git.ts, loki-ts/tests/util/fc25_safe_git.test.ts | HIGH | `cd loki-ts && bun test tests/util/fc25_safe_git.test.ts`; `bash tests/moat/p9-rule-of-two.sh`; `cd loki-ts && bunx tsc --noEmit` | released@2026-10-17T03:50Z | HIGH r1 APPROVE 730f27460: tests/util 289/0 rc=0, p9 4 PASS, 2 mutations each fail 1 test; merged 38b6b4b13, dist 3a1c1255c. Reviewer ran no hostile-repo probes, so those go to Q18-02b. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| Q18-02b | FC-25c(b): run the hostile-repo probes against safe_git allowToken and close any that leak: credential.helper with a leading !, credential.<url>.helper (including = in the url), include.path and includeIf, insteadOf to ext:: or file::, http.proxy and TLS keys, core.askPass, GIT_CONFIG_COUNT, extensions.worktreeConfig | loki-ts/src/util/safe_git.ts, loki-ts/tests/util/fc25_safe_git.test.ts | HIGH | `cd loki-ts && bun test tests/util/`; `bash tests/moat/p9-rule-of-two.sh` | released@2026-10-17T03:50Z | merged e0365685b (HIGH r2 APPROVE 9482dbe62) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| Q18-03 | FC-25c guard: moat case fails if allowToken is passed outside base_guard.ts and modernize_unit.ts (SAFEGIT-REPOCONFIG 1+2) | tests/moat/p9-rule-of-two.sh | HIGH | `bash tests/moat/p9-rule-of-two.sh`; `cd loki-ts && bunx tsc --noEmit` | parked@2026-10-17T01:03Z | D98 r2 BLOCK 9a22006f6: moat run.sh rc=0 P9 PROVEN, but fetch-only pin is a prefix match (allowToken: args[0] === "fetch" || ... passes) and positional safeGitEnv check is single-line and stops at nested parens. Re-sliced as Q18-03b. |
-| Q18-03b | Moat P9 allowToken guard closes r2 bypasses: fetch-only pin must end at the option boundary; positional safeGitEnv and safeGitArgs opt-in detected across lines and with nested-call first arguments, whole-file, outside safe_git.ts | tests/moat/p9-rule-of-two.sh | HIGH | bash tests/moat/run.sh | released@2026-10-17T01:58Z | v11.17.11 (npm next 11.17.11, Tests and Release green on df98addc8). HIGH r2 APPROVE 531ad3376; merged 31e4f4b47. Follow-up Q18-03c. || widen and same-line second allowToken pass the pin; r1 fix: whole-file pin, occurrence count, alias imports fail closed |
-| Q18-04 | Deep-stage council has no production runner (deep always records "council (not wired)"); add a default CouncilRunner running one read-only reviewer session via the existing session runner; failure or oversize stays NOT PROVEN | loki-ts/src/engine10/stages/deep.ts, loki-ts/tests/engine10/deep_wiring.test.ts | HIGH | `cd loki-ts && bun test tests/engine10/deep.test.ts tests/engine10/deep_wiring.test.ts`; `cd loki-ts && bunx tsc --noEmit` | released@2026-10-17T03:50Z | merged 0fbe7454e (HIGH r2 APPROVE 3fa77dc4e; follow-ups: providers deny-list argv test, MCP write tools not denied, findings discarded) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| Q18-05 | AI-BOM writer hook (MARK-3 named in ai_bom.ts header): after seal write a CycloneDX AI-BOM next to the receipt listing only what ran | loki-ts/src/contrib/ai_bom.ts, loki-ts/src/contrib/index.ts, loki-ts/src/engine10/hooks.ts, loki-ts/tests/features/ai_bom.test.ts | HIGH | `cd loki-ts && bun test tests/features/ai_bom.test.ts tests/engine10/seal.test.ts`; `cd loki-ts && bunx tsc --noEmit` | released@2026-10-17T03:50Z | HIGH APPROVE 3adc5461a; merged 4f7a447db, dist 4a1dc5e65. Follow-ups: leak filter misses github_pat_/glpat-/AIza/npm_/hf_ and is case-sensitive; SAFE_NAME drops provider/model ids with an interior slash; pass a frozen receipt to hooks.sealed. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| Q18-06 | Stalled session never killed: session.stalled has no consumer; kill after LOKI_E10_STALL_KILL_S idle (default 0, off) and emit session.ended reason stalled | loki-ts/src/engine10/session.ts, loki-ts/src/runner/watchdog.ts, loki-ts/tests/engine10/session.test.ts | MEDIUM | `cd loki-ts && bun test tests/engine10/session.test.ts tests/runner/watchdog.test.ts`; `cd loki-ts && bunx tsc --noEmit` | released@2026-10-17T03:50Z | HIGH r2 APPROVE c612595ad; merged df0741e69, dist 538c04a41. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| Q18-07 | loki start heartbeat shows no ETA: estimateEtaS has no production caller; call it from the heartbeat line and record actuals at seal | loki-ts/src/engine10/output.ts, loki-ts/src/contrib/eta.ts, loki-ts/tests/engine10/output.test.ts | MEDIUM | `cd loki-ts && bun test tests/engine10/output.test.ts tests/engine10/eta.test.ts`; `cd loki-ts && bunx tsc --noEmit` | released@2026-10-17T02:57Z | merge 8b4a94371 dist 47031e380; TL APPROVE d288e13ef. PO refill 2026-10-17, grep-checked not shipped: grep estimateEtaS only output.ts:139. Wait for Q17-01/Q17-02 (output.ts overlap). v11.17.13 npm next 11.17.13 |
-| Q18-08 | checkDecomposable (D61-09) has no production caller; call it in run_group after the DAG is written so a heavily overlapping DAG runs sequentially; invalid confirm keeps the deterministic DAG | loki-ts/src/features/speed/run_group.ts, loki-ts/tests/features/speed/group_output.test.ts | MEDIUM | `cd loki-ts && bun test tests/engine10/decompose_check.test.ts tests/engine10/route_group.test.ts`; `cd loki-ts && bunx tsc --noEmit` | released@2026-10-17T03:50Z | TL APPROVE 5a181823a: speed+seal_group+spawn_env_guard 61/0, tsc 0 non-control-plane errors, 3 mutations each red; merged 91264c08c, dist 64923228f. Report-only warning on stderr; forced sequential execution is out of scope. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| Q18-09 | Budget loader test: add the never-run mutation leg (drop one cache tier in the loader, must go red) | loki-ts/test/budget_cache_pricing.test.ts | LOW | `cd loki-ts && bun test test/budget_cache_pricing.test.ts`; `cd loki-ts && bunx tsc --noEmit` | released@2026-10-17T03:50Z | TL APPROVE ea65b07b7: real _loadPricing mutations cache_write_1h, cache_read, over_100k each red; baseline 10/0. PO refill 2026-10-17, grep-checked not shipped: FAILURE-CLASSES line 195 follow-up. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| Q18-10 | select-tests.sh maps dashboard/web-app shell suites to handlers only by full path; add a route needle so a suite driving an API route by URL is selected when that handler changes | scripts/select-tests.sh, tests/test-select-tests.sh | MEDIUM | `bash tests/test-select-tests.sh`; `bash tests/test-select-tests-run.sh`; `cd loki-ts && bunx tsc --noEmit` | released@2026-10-17T03:50Z | TL APPROVE 24a708366: select-tests-run 14/0, sigpipe 4/0, route_needles mutation turns 2 new asserts red; merged ce7624e12. PO refill 2026-10-17, grep-checked not shipped: FAILURE-CLASSES line 360 still thin. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| Q18-11 | group.started/group.unit events and createGroupRenderer (D61-14) have no producer or caller; emit from backlog launcher callbacks and attach the renderer to group runs | loki-ts/src/features/speed/group_grid.ts, loki-ts/src/features/speed/group_output.ts, loki-ts/tests/engine10/output_group.test.ts | MEDIUM | `cd loki-ts && bun test tests/engine10/output_group.test.ts tests/features/speed/group_output.test.ts`; `cd loki-ts && bunx tsc --noEmit` | released@2026-10-17T02:57Z | merge 326cf3402; TL APPROVE cb3e92fca (real-spawn onOut tap untested, follow-up). PO refill 2026-10-17, grep-checked not shipped: Architect confirms file set apart from Q18-08 first; else hold until Q18-08 merges. v11.17.13 npm next 11.17.13 |
-| Q18-03c | P9 allowToken guard residuals from Q18-03b r2: named re-export with as (export { safeGitEnv as x } from safe_git), indirect calls (const f = safeGitEnv; .apply; spread args), and a shadowed args default in a pinned file all give F=0 | tests/moat/p9-rule-of-two.sh | HIGH | bash tests/moat/run.sh | parked@2026-10-17T01:55Z | Shipped via Q18-03d merge 98611351a. D98 2 rounds used: r2 head 2b3421402 closes all r1 bypasses but its comment strip misses regex literals and template nesting, a regression vs main; continued as Q18-03d on top of 2b3421402. r1 BLOCK (HIGH), r2 fix in progress. Source: Q18-03b HIGH r2 notes 1, 2 and 4. Obfuscated key escapes (unicode escapes, computed concatenation) cannot be closed by grep; record as accepted residual. |
-| Q18-03d | P9 allowToken guard: comma, import and indirect scans fail if either raw or comment-stripped text trips them (strip misses regex literals and template nesting); add regex-literal, template-nesting, barrel-of-barrel and strip-only positive controls | tests/moat/p9-rule-of-two.sh | HIGH | bash tests/moat/run.sh | released@2026-10-17T02:57Z | merge 98611351a (includes Q18-03c r2 commits); HIGH APPROVE ec6e0adfd, 4 mutations red, P9 PROVEN. Built on Q18-03c r2 head 2b3421402 (branch q18-03c). HIGH r2 repro payloads: const re = /\/*/; safeGitEnv(process.env, true); // */ and const re = /"/; then const u = "//"; safeGitEnv(...). Fresh review rounds. v11.17.13 npm next 11.17.13 |
-| Q18-03e | P9 allowToken guard: strip helper treats regex literals as opaque (or a regex-aware third pass), so a regex plus a quote inside a comment cannot hide a call from both passes | tests/moat/p9-rule-of-two.sh | HIGH | bash tests/moat/run.sh | released v11.17.54 | Pre-existing gap found by Q18-03d HIGH review (also on main): after the safe_git import, const re = /\/*/; safeGitEnv(process.env /* ' */, true); is MISSED and runs under node. Add it as a positive control. |
-| Q18-05b | AI-BOM filter gaps: secret filter misses github_pat_, glpat-, AIza, npm_, hf_, ASIA, sk_live_ and is case-sensitive; SAFE_NAME drops provider/model ids with one interior slash; hooks.sealed receives the live receipt (pass a frozen clone) | loki-ts/src/engine10/ai_bom.ts, loki-ts/src/engine10/stages/seal.ts, loki-ts/tests/engine10/ai_bom.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/ai_bom.test.ts tests/engine10/seal.test.ts | released@2026-10-17T02:57Z | merge ae90c2875 dist 0eb48d905; TL APPROVE 82058ff97 (102 pass, 4 mutations red). Test file is tests/features/ai_bom.test.ts. Source: Q18-05 HIGH review notes. Keep engine10 core net zero. v11.17.13 npm next 11.17.13 |
-| COST-WALL-f | Partial cost read as complete outside benchmarks: trust_trajectory cost_per_accepted_usd ignores cost.cost_partial; check cost-summary.py and proof-generator.py the same way, routing through one partial check | autonomy/lib/trust_trajectory.py, autonomy/lib/cost-summary.py, autonomy/lib/proof-generator.py, tests/test_efficiency_cost_availability.py | HIGH | python3 -m pytest tests/test_efficiency_cost_availability.py -q | released@2026-10-17T02:57Z | merge 3d0587f4f dist 7919f31ca; HIGH r2 APPROVE ef9979ad8 (53 pytest, 11 cost-cli, 33 bun pass; 5 of 6 mutations red). Follow-ups: template costIsPartial JS harness, dashboard series partial marker, cost-summary Avg/iter label. r1 BLOCK (HIGH), r2 fix in progress. Source: COST-WALL-e HIGH r1 note 4 (FC-COST-PARTIAL-b siblings). v11.17.13 npm next 11.17.13 |
-| Q17-06 | COST-6 offline half: `attribution.py` dry-run prints a cost-per-accepted-task table with the ratio against raw Claude Code and against the 0.5x target, using existing result files, so the paid `--execute` run only has to plug in numbers. | benchmarks/bench/attribution.py, benchmarks/bench/test_attribution.py | MEDIUM | `python3 -I benchmarks/bench/attribution.py --dry-run`; `python3 -m pytest benchmarks/bench -k attribution -q` | released@2026-10-17T03:50Z | Merged fe3a4e252 (6b9bd03d6; line-828 mutation caught: 1 failed 93 passed, restored 94 passed). COST-6 is parked as a paid eval needing a spend go. This re-slice needs no spend. Cost audit 2026-10-16: best measured run is 0.68x of raw, none reaches 0.5x. Report both floors (attribution.py:778). Confirm the test file name by `ls`. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| COST-HARN | C-F1 benchmark reports loki truthfully: real rc and stderr tail, origin remote for multi-unit seeds, v10 evidence readers, per-run evidence kept | benchmarks/bench/attribution.py, benchmarks/bench/adapters/loki.py, benchmarks/bench/adapters/_base.py | MEDIUM | python3 -m pytest benchmarks | released@2026-10-17T03:50Z | Source: run3 diagnosis (PROGRESS 23:37Z). Round 1 BLOCK (fake origin let single-unit runs reach the PR stage); round 2 d1bb70593 APPROVED, pytest 86 passed rc=0. Ships in 11.17.7. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| COST-WALL | v10 child sessions (Wall stage and every other engine10 child spawn) append to .loki/metrics/child-sessions.jsonl so loki cost is not undercounted | loki-ts/src (shared spawn helper), autonomy/lib/efficiency_cost.py | HIGH | cd loki-ts && bun test | released@2026-10-17T03:50Z | HIGH r1 APPROVE 10c040a70: 4 test files 180 pass 1 skip 0 fail, pytest 14 passed, ledger-write mutation red 2 tests, Wall counted once by stub test; merged, dist rebuilt. Follow-ups COST-WALL-b (reader F1) and COST-WALL-c (F2 wiring tests). F3: run3 Wall diagnosis unexplained, replay before any 2x claim. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| COST-WALL-b | FC-COST-PARTIAL: efficiency_cost reader marks cost_partial true when main records exist with tokens but no dollar figure, so a ledger-only total never reads as complete | autonomy/lib/efficiency_cost.py, tests/test_efficiency_cost_availability.py | HIGH | `python3 -m pytest tests/test_efficiency_cost_availability.py -q`; `bash tests/test-sigpipe-guard.sh` | released@2026-10-17T03:50Z | HIGH APPROVE ddab3e714 (pytest 15 passed, mutation caught); follow-ups: C-F1 adapter ignores cost_partial (COST-WALL-d), unpriced count omits main records Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| COST-WALL-c | Guard the child-ledger wiring: tests fail when quality_gates withChildLedger wrappers or the SDK ledger param are removed, and internal_sdk_judge cliLedger gets a test; record a ledger line when SDK messages.create throws after spending | loki-ts/src/commands/internal_sdk_judge.ts, loki-ts/tests/runner/quality_gates.test.ts, loki-ts/tests/runner/sdk_invoker.test.ts | MEDIUM | `cd loki-ts && bun test tests/runner/`; `cd loki-ts && bunx tsc --noEmit` | released@2026-10-17T03:50Z | merge of e0a88304 after TL APPROVE: 219 pass rc=0, 2 mutations red Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| COST-WALL-d | C-F1 benchmark honours cost_partial: the loki adapter passes cost_partial through and compute_metrics/row_true_spend treat it as a partial lower bound, never a complete measured cost | benchmarks/bench/adapters/loki.py, benchmarks/bench/attribution.py, its existing test file | HIGH | python3 -m pytest benchmarks -q -k attribution | released@2026-10-17T03:50Z | merge of eef4e38b5 after HIGH r2 APPROVE: pytest 114 passed rc=0, fix revert turns test red; follow-ups in COST-WALL-e Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| COST-WALL-e | One partial-cost helper used by every cost consumer (FC-COST-PARTIAL-b): equivalence_report.py and report.py honour cost_partial; row_spend_is_partial true for null cost with true cost set; invalid ledger lines and cost below ledger mark partial | benchmarks/bench/attribution.py, benchmarks/bench/equivalence_report.py, benchmarks/bench/report.py, autonomy/lib/efficiency_cost.py, benchmarks/bench/tests/test_attribution.py, tests/test_efficiency_cost_availability.py | HIGH | python3 -m pytest benchmarks/bench/tests/ tests/test_efficiency_cost_availability.py -q | released@2026-10-17T01:58Z | v11.17.11 (npm next 11.17.11, Tests and Release green on df98addc8). HIGH r2 APPROVE 439ed90e3 (132 passed); merged into v11.17.11. Follow-ups in COST-WALL-f. |
-| M-30 | User docs for loki modernize, no dashes, commands match USAGE | docs/v10/GUIDE-MODERNIZE.md, tests/test-modernize-docs.sh | LOW | bash tests/test-modernize-docs.sh | released@2026-09-28T21:01Z | Source: MODERNIZE.md (D30). Depends on M-07. Dispatched 18:58Z, sonnet engineer. Tech Lead REJECT r1 (--resume id failed MID_RE), APPROVE r2 5035984d; merged 8d568c66; test-modernize-docs.sh 25/0, shard coverage 19/0, durations drift 6/0. Released in v10.5.0 (merge 8d568c66 is an ancestor of v10.5.0). |
-| E-66 | "Already implemented" outcome: evidence search in code, tests, docs, CHANGELOG; no change needed verdict, receipt, issue comment, no PR | loki-ts/src/engine10 (intake or plan, implement marker path, seal, pr) | HIGH | fixture with the feature ends no change needed, no implement session; fixture without proceeds | released@2026-09-28T16:03Z | Source: D32 (augmentiq #52). Opus REJECT (reproduced): no test that ALREADY_SATISFIED opens no PR; evidence search matched 652 hits for an unrelated task on this repo; confirmation need not cite files. Rework dispatched. Rework 1c7e1b09 (branch worktree-wf_b707f4ab-24f-1): all 3 blockers fixed (no-PR test F5, 0 hits for both review sentences on this repo, citation must name an existing code or test hit; evidence in receipt). Opus CONCERN: the real-repo test uses listRepoFiles capped at 2000 of 4784 files, so removing STOP_WORDS still passes; the existsSync branch of the citation check is untested. Next: small fix (full file list in that test, one existsSync test). Wave E18 small fix (uncapped file list, existsSync test), branch slice-E-66-test-fixes. Opus APPROVE of 0a64ea98 (uncapped list, existsSync test). Merge onto main conflicts in seal.ts, supervisor.ts, types.ts, rule_of_two.test.ts after E-68/E-69; rebase dispatched (wave E19). D33: states its net core line delta; core must stay under 5,000 (92 lines of headroom shared by E-67, E-66, E-61, M-14, merge order E-67, E-66, E-61); offset any excess by deleting dead core code. Rework 135ba06b Opus APPROVE, but merged it takes core to 5,189 (D33 cap 5,000; `bun test tests/engine10/budget.test.ts`). Not merged. Next: offset about 190 core lines in the same slice (dead or duplicated core code), then merge. Wave E21 (wf_39ab3f7d-8f3). r3: D33 offset. Rework r3 605f33b0 Opus APPROVE (core under 5,000 after offset); merged into train E22 (9042e964): `bun test tests/engine10/` 547 pass 0 fail, tsc 0, `bash tests/test-v10-pulse.sh` 107 passed, `bash eval/loki10/test-harness.sh` 108 passed. Released in v10.2.1 (npm publish 2026-09-28T16:03Z; every cited commit is an ancestor of the v10.2.1 tag; `git merge-base --is-ancestor`). |
-| EV-13 | Eval expected_outcome no_change_needed; aiq-52 set to it | eval/loki10/harness.py, eval/loki10/tasks/aiq-52-searchbar, test-harness.sh | HIGH | bash eval/loki10/test-harness.sh | released@2026-09-28T05:00Z | Source: D32. Opus CONCERN: a correct v10 no-change run on aiq-52 is graded as a source change. Rework dispatched. Rework APPROVE (branch worktree-wf_b707f4ab-24f-5: 19224201, e0264724): v10 Wall side effect excluded from the diff check. Not merged yet. Merged c9c15f38 (trainE18); `bash eval/loki10/test-harness.sh` 103 passed 0 failed. Released in v10.1.0 (npm publish 2026-09-28T05:00Z; every cited commit is an ancestor of the v10.1.0 tag; `git merge-base --is-ancestor`). |
-| E-67 | No pause state: unfinishable runs end as a draft PR or an issue comment with the reason within the cap; stdin never read | loki-ts/src/engine10 (machine, supervisor, worker, escalate, session) | HIGH | a stub provider that asks for input ends within the cap with a draft-PR or comment argv | released@2026-09-28T21:01Z | Source: D32. Opus REJECT (reproduced): a hung worker ended FAILED with no draft PR and no comment, after the cap. Rework dispatched. Rework ba679f4e (branch worktree-wf_b707f4ab-24f-2). Opus REJECT: at the default cap the supervisor backstop fires before the worker cap can seal; concern: the diff check misses untracked files and uncommitted work never reaches a PR. Next: rework. Held, no builder since 03:20Z (row was stale, not running). Dispatch after E-61 (session.ts) and the E-66 rebase (supervisor.ts) merge, from rework ba679f4e plus the Opus findings above. D33: states its net core line delta; core must stay under 5,000 (92 lines of headroom shared by E-67, E-66, E-61, M-14, merge order E-67, E-66, E-61); offset any excess by deleting dead core code. D33 update 14:50Z: E-66 and E-61 merged first, core is 4,998 (1 line of headroom); E-67 must be net core negative. r3 Opus REJECT (reproduced): backstopMs = max(0, capS-30)*1000 is 0 when capS <= 30, so the worker is killed at spawn. Next: rework. Wave E26 (wf_9ba5fcaf-75a). Round 5. r5 3e38cd13 opus CONCERN with no blocking: file set widened by the CoS to include autonomy/lib/engine10-push.sh, tests/test-engine10-push.sh and loki-ts/src/engine10/types.ts (earlier opus-reviewed rounds); behaviour note: caps under about 24.8s now go straight to commit, seal and PR. Merged d4a2c620: `bun test tests/engine10/` 632 pass 0 fail, tsc 0, dist 18 passed, push 40 passed; core 4,976 (escalate.ts deleted). Released in v10.5.0 (merge d4a2c620 is an ancestor of v10.5.0). |
-| E-68 | Per-call deadline at the stage limit, progress every 30s, every exit code classified (125, 143 included), never "cause not classified" | loki-ts/src/engine10/session.ts, failures.ts | HIGH | per-code tests plus a grep test | released@2026-09-28T05:00Z | Source: D32. Opus REJECT (reproduced): a real limit kill reports "exit 143 (SIGTERM)" because the session child traps SIGTERM; the stub test missed it. Rework dispatched. Rework APPROVE (branch worktree-wf_b707f4ab-24f-3: 4dd05bf9, 922bd923): a limit kill is classified from the engine, not the child exit code. Not merged yet. Merged c9c15f38 (trainE18); engine10 `bun test tests/engine10/` 444 pass 0 fail. Released in v10.1.0 (npm publish 2026-09-28T05:00Z; every cited commit is an ancestor of the v10.1.0 tag; `git merge-base --is-ancestor`). |
-| E-69 | Cost shows "not measured" (or partial), never $0 when unmeasured | output.ts, pr_body.ts, seal.ts, status.ts, dashboard/page.ts, cost.ts | MEDIUM | output and receipt tests for measured, partial, unmeasured | released@2026-09-28T05:00Z | Source: D32 (EV-8 printed $0.00 with 0 tokens). TL CONCERN: genuine-zero test never exercises it; partialCost bypasses the tamper guard; dashboard lacks the partial detail. Rework dispatched. Rework APPROVE (branch worktree-wf_b707f4ab-24f-4: b9825c4c, f42a2aee, 5c66dc55). Not merged yet. Merged c9c15f38 (trainE18); engine10 `bun test tests/engine10/` 444 pass 0 fail. Released in v10.1.0 (npm publish 2026-09-28T05:00Z; every cited commit is an ancestor of the v10.1.0 tag; `git merge-base --is-ancestor`). |
-| E-70 | Dashboard shows its and the CLI's version, warns on mismatch; loki dashboard replaces an older Loki dashboard on its port, leaves a non-Loki listener alone | loki-ts/src/engine10/dashboard/ | MEDIUM | version, mismatch, replace and refuse tests | released@2026-10-03T09:21Z | on main 9d0e7b04d; first tag v10.0.0 (drift audit 09:24Z) |
-| E-71 | Pulse UNEVIDENCED_CLAIM treats M-NN rows like S/E/EV rows (only status and notes cells can claim), so an M row's spec cell never flags | scripts/v10-pulse.sh (the row-id regex in check_unevidenced_claims only), tests/test-v10-pulse.sh | LOW | bash tests/test-v10-pulse.sh; a case with an M row whose Wall cell says "green" is not flagged, and its notes cell still is | released@2026-09-28T05:00Z | Source: pulse flagged M-14 (8f4dc965) for its title "green base is an error", a spec, not a claim. TL APPROVE (sonnet): red without the fix (95 passed 1 failed), `bash tests/test-v10-pulse.sh` 96 passed 0 failed on main. Released in v10.1.0 (npm publish 2026-09-28T05:00Z; merge commit 172bec99 is an ancestor of the v10.1.0 tag, not of v10.0.1). |
-| E-72 | release.sh --bump-only leaves a dist bundle unchanged when only its debugId differs (no churn in cockpit.js on a version bump) | scripts/release.sh (dist step only), tests/test-release-bump-only.sh | LOW | bash tests/test-release-bump-only.sh | released@2026-09-28T16:03Z | Source: v10.0.1 bump rewrote cockpit.js and .map with only a new debugId; the Release Manager reverted them by hand. TL APPROVE (sonnet): red on pre-fix release.sh (3 passed 3 failed), `bash tests/test-release-bump-only.sh` 6 passed 0 failed on main; registered in run-all-tests. Released in v10.2.1 (npm publish 2026-09-28T16:03Z; every cited commit is an ancestor of the v10.2.1 tag; `git merge-base --is-ancestor`). |
-| E-73 | Guard (D26): no test writes a hardcoded "far-future" latest version that the current VERSION can overtake; derive it from VERSION instead | tests/test-no-stale-future-version.sh, docs/v10/GUARDS.md (one entry) | LOW | bash tests/test-no-stale-future-version.sh; red on a fixture test that writes latest 9.99.0 against VERSION 10.0.1 | released@2026-09-28T05:00Z | Source: incident 898fa081, v10.0.0 blocked from npm by latest=9.99.0 in tests/test-start-update-hint.sh (fixed 306b6b0c). TL APPROVE (sonnet); `bash tests/test-no-stale-future-version.sh` RESULT: PASS on main; registered in run-all-tests. Released in v10.1.0 (npm publish 2026-09-28T05:00Z; merged with E-71 in train 983dda58, an ancestor of v10.1.0, not of v10.0.1). |
-| E-74 | release.sh run_bump_only actually calls the debugId restore helper (end-to-end test of the call site, not only the helper) | tests/test-release-bump-only.sh (one leg) | LOW | bash tests/test-release-bump-only.sh; deleting the call site in run_bump_only turns the new leg red | released@2026-09-28T16:03Z | Source: E-72 TL non-blocking note on 1b06bc61: removing the call site does not turn the E-72 test red. Wave E21 (wf_39ab3f7d-8f3). TL APPROVE; merged into train E22 (9042e964): `bun test tests/engine10/` 547 pass 0 fail, tsc 0, `bash tests/test-v10-pulse.sh` 107 passed, `bash eval/loki10/test-harness.sh` 108 passed. Released in v10.2.1 (npm publish 2026-09-28T16:03Z; every cited commit is an ancestor of the v10.2.1 tag; `git merge-base --is-ancestor`). |
-| E-75 | Pulse main-CI check never reads UNKNOWN for a completed Tests run: fall back to `gh run list --commit <sha> --workflow Tests` when the cached check fails, and report RED with the run id | scripts/v10-pulse.sh (main CI check only), tests/test-v10-pulse.sh | MEDIUM | bash tests/test-v10-pulse.sh; a stubbed gh whose check call fails but whose run list says failure yields CI_RED, not UNKNOWN | released@2026-09-28T16:03Z | Source: main red at 5404b0c6, e26bf52b, 983dda58 (Tests run 36377688703) while the pulse printed Main CI UNKNOWN each turn. Wave E21 (wf_39ab3f7d-8f3). TL APPROVE of 8e989837; merged into train E22 (9042e964): `bun test tests/engine10/` 547 pass 0 fail, tsc 0, `bash tests/test-v10-pulse.sh` 107 passed, `bash eval/loki10/test-harness.sh` 108 passed. Released in v10.2.1 (npm publish 2026-09-28T16:03Z; every cited commit is an ancestor of the v10.2.1 tag; `git merge-base --is-ancestor`). |
-| E-76 | Split the engine10 budget test per D33: core under 5,000, modernize/ under 4,000, core never imports modernize | loki-ts/tests/engine10/budget.test.ts | LOW | cd loki-ts && bun test tests/engine10/budget.test.ts; core limit 4900 turns test 1 red | released@2026-09-28T05:00Z | Source: D33 (CTO). Main red since 5404b0c6 on the combined 5,288 count. TL APPROVE (sonnet) on 797705bc: `bun test tests/engine10/budget.test.ts` 3 pass exit 0, core 4907, modernize 381, core limit 4900 goes red; merged 84fbf9b4, full `bun test tests/engine10/` 474 pass 0 fail. Released in v10.1.0 (npm publish 2026-09-28T05:00Z; every cited commit is an ancestor of the v10.1.0 tag; `git merge-base --is-ancestor`). |
-| E-77 | Pulse SESSION_STALLED violation: no assistant turn for more than 20 minutes while the /loop is active (armed wakeup or live workflow), reading the newest session transcript mtime | scripts/v10-pulse.sh (one new check), tests/test-v10-pulse.sh | MEDIUM | bash tests/test-v10-pulse.sh; a fixture transcript 25 minutes old with an active-loop marker yields SESSION_STALLED, 10 minutes old does not, no marker does not | released@2026-09-28T16:03Z | Source: founder 14:00Z; session stalled 04:48Z to about 14:00Z on "organization has disabled Claude subscription access", pulse raised nothing. Wave E21 (wf_39ab3f7d-8f3). TL APPROVE of 409adb68; merged into train E22 (9042e964): `bun test tests/engine10/` 547 pass 0 fail, tsc 0, `bash tests/test-v10-pulse.sh` 107 passed, `bash eval/loki10/test-harness.sh` 108 passed. Marker .loki/state/loop-active. Released in v10.2.1 (npm publish 2026-09-28T16:03Z; every cited commit is an ancestor of the v10.2.1 tag; `git merge-base --is-ancestor`). |
-| EV-14 | v10 against raw on the medium and large tiers (same model, same tasks, both arms), gate table per tier for the default-flip decision (E-31) | eval/loki10 results, docs/v10/METRICS.md (one section) | HIGH | eval/loki10/run.sh per tier for arms raw and v10; every task has a row in both arms, none arm_unavailable; METRICS.md table cites the result files | released@2026-09-28T21:01Z | Source: founder priority 14:00Z (flip v10 to default once it beats raw on the measured tiers). Depends on EV-11 and EV-12 merged; paid run, one tier at a time. D34: may run on 5 real large tasks, 2 runs per arm; flip only if v10 is at or better than raw on completions, cost per completed and p50. D38: runs now on medium (small already measured), 2 runs per arm; claim limited to small plus medium, medium labelled not shortcut audited. Wave E25 (wf_46137a6b-367). Medium measurement running. Medium measured (0afef9e4, harness at 8f2179cd, claude-opus-5-5, 7 tasks x 2 runs): raw 12/14 (85.7%), $0.5119 per completed, p50 70s; v10 10/14 (71.4%), $0.5395, p50 83s. v10 worse on all three axes; default stays legacy (D38). Result files lost in the 17:36Z worktree incident; EV-15 re-runs with persisted results. Released in v10.5.0 (merge 3d682dcb is an ancestor of v10.5.0). |
-| E-78 | v10-guard also blocks moving main without a checkout: `git branch -f main`, `git update-ref refs/heads/main` and `git checkout -B main` | scripts/v10-guard.sh (RULE2 only), tests/test-v10-guard.sh | MEDIUM | bash tests/test-v10-guard.sh; each spelling is refused while on another branch, `git branch -f other` still allowed | released@2026-09-28T16:03Z | Source: 14:12Z the Chief of Staff realigned local main with `git branch -f main origin/main` after RULE2 refused `git reset --hard`; the guard did not see it (harmless there: only an unpushed local merge was dropped, work kept on slice-E-66-r2). First build CONCERN (sonnet TL): update-ref check matches refs/heads/main anywhere in the args, blocking `git update-ref refs/heads/other refs/heads/main`. Next: match the target ref position only. r2 b6e5b389 TL APPROVE; `bash tests/test-v10-guard.sh` ALL TESTS PASSED. Released in v10.2.1 (npm publish 2026-09-28T16:03Z; every cited commit is an ancestor of the v10.2.1 tag; `git merge-base --is-ancestor`). |
-| E-79 | Pulse LOW_READY counts M-NN rows whose Depends-on slices are all merged or released as ready, and names the ones blocked by dependencies | scripts/v10-pulse.sh (ready count only), tests/test-v10-pulse.sh | LOW | bash tests/test-v10-pulse.sh; an M row ready with deps merged counts, one with an unmerged dep does not | released@2026-09-28T21:01Z | Source: pulse reported 3 to 4 ready while M-08, M-30 and other M rows were ready (14:12Z). E-79..E-81 branch REJECT (reproduced): widening ID_RE makes M rows visible, so IDLE_BUILDERS names dependency-blocked M rows as dispatch targets. Next: IDLE_BUILDERS reuses LOW_READY dependency filter. branch slice-E-79-81-r2 TL APPROVE; merged dc827b80 (on top of v10.2.2): full `cd loki-ts && bun test` 2277 pass 0 fail, `bash tests/test-engine10-dist.sh` 18 passed, `bash tests/test-v10-pulse.sh` 117 passed. Released in v10.5.0 (merge c33b0c7c is an ancestor of v10.5.0). |
-| E-80 | Pulse PROGRESS.md age never negative: parse the entry timestamp as UTC and clamp future timestamps to a FUTURE_TIMESTAMP note | scripts/v10-pulse.sh (PROGRESS age only), tests/test-v10-pulse.sh | LOW | bash tests/test-v10-pulse.sh; an entry stamped 10 minutes ahead reads a note, not "-10 min ago" | released@2026-09-28T21:01Z | Source: pulse printed "PROGRESS.md last entry: -6 min ago" at 04:39Z. branch slice-E-79-81-r2 TL APPROVE; merged dc827b80 (on top of v10.2.2): full `cd loki-ts && bun test` 2277 pass 0 fail, `bash tests/test-engine10-dist.sh` 18 passed, `bash tests/test-v10-pulse.sh` 117 passed. Released in v10.5.0 (merge dc827b80 is an ancestor of v10.5.0). |
-| E-81 | Pulse flags a git worktree registered inside the repo root outside .claude/worktrees (a reviewer created m16-review/ at the root) | scripts/v10-pulse.sh (one check), tests/test-v10-pulse.sh | LOW | bash tests/test-v10-pulse.sh; a fixture worktree at <repo>/x yields STRAY_WORKTREE, one under .claude/worktrees does not | released@2026-09-28T21:01Z | Source: 04:45Z m16-review/ at the repo root blocked the release bump clean-tree check. branch slice-E-79-81-r2 TL APPROVE; merged dc827b80 (on top of v10.2.2): full `cd loki-ts && bun test` 2277 pass 0 fail, `bash tests/test-engine10-dist.sh` 18 passed, `bash tests/test-v10-pulse.sh` 117 passed. Released in v10.5.0 (merge dc827b80 is an ancestor of v10.5.0). |
-| E-82 | budget.test.ts computes the file lists inside a named test so a read error surfaces as a failed test, not a describe-time throw | loki-ts/tests/engine10/budget.test.ts | LOW | cd loki-ts && bun test tests/engine10/budget.test.ts | released@2026-09-28T16:03Z | Source: E-76 TL non-blocking note (797705bc). TL APPROVE; merged 9042e964, budget test 3 pass. Released in v10.2.1 (npm publish 2026-09-28T16:03Z; every cited commit is an ancestor of the v10.2.1 tag; `git merge-base --is-ancestor`). |
-| EV-12S | Size gate: eval/loki10/measure-size.py (files = touched non-test .py, lines = added non-blank; medium at least 2 files; large at least 4 files, at least 150 lines, above medium max), refdiffs for the medium tasks, run in test-harness.sh | eval/loki10/measure-size.py, eval/loki10/refdiff/pub-*.diff, eval/loki10/test-harness.sh (new section only) | LOW | rc=0 on the medium tasks (attrs-1313 reads 4 files, 74 lines); rc=1 on a 3-file 149-line large fixture, a missing refdiff, and --online with an unreachable source | parked@2026-09-28T22:22Z | Source: D34.  Drift audit 22:22Z: no live agent, wave E27 stopped 18:37Z (founder, over budget); parked until restaffed. |
-| EV-12A | Large tasks from real upstream PRs, pool pallets/* (werkzeug incl. #3005/#3006, flask, jinja, click): at least 2 | eval/loki10/tasks/lg-<repo>-<issue>/, eval/loki10/refdiff/lg-<repo>-<issue>.diff (own tasks only) | MEDIUM | per task: measure-size --online rc=0; RED at ref, GREEN at merge_sha via run.sh; no-op not completed; full revert and leave-one-file-out mutants fail; validate rc=0 | parked@2026-09-28T22:22Z | Source: D34.  Drift audit 22:22Z: no live agent, wave E27 stopped 18:37Z (founder, over budget); parked until restaffed. |
-| EV-12B | Large tasks from real upstream PRs, pool attrs, more-itertools, packaging, jsonschema, humanize, faker, arrow: at least 2 | same pattern, own tasks only | MEDIUM | as EV-12A | parked@2026-09-28T22:22Z | Source: D34.  Drift audit 22:22Z: no live agent, wave E27 stopped 18:37Z (founder, over budget); parked until restaffed. |
-| EV-12C | Large tasks from real upstream PRs, pool httpx, rich, marshmallow, requests: at least 2 | same pattern, own tasks only | MEDIUM | as EV-12A | parked@2026-09-28T22:22Z | Source: D34.  Drift audit 22:22Z: no live agent, wave E27 stopped 18:37Z (founder, over budget); parked until restaffed. |
-| EV-12D | INDEX.md large rows and counts; synthetic lg-* noted rejected (D34), legacy moved to M-27 | eval/loki10/tasks/INDEX.md | LOW | measure-size rc=0 over all tiers; large count at least 5 on main; validate rc=0 | blocked@2026-10-03T08:33Z | Builder stopped, no commit: main has 0 large tasks (14 medium, 8 speed); measure-size rc=0, validate rc=0. Needs EV-12F/EV-12G. INDEX Counts line is also stale (omits 8 speed tasks) |
-| E-83 | P0 fix-forward: main Tests red on 9d483688 (run 36438012977): modernize codemod spawn without env (spawn env guard) and the prStage bundle marker deleted by the E-66 line offset (dist test) | loki-ts/src/engine10/modernize/codemod.ts, loki-ts/src/engine10/stages/pr.ts | HIGH | `bun test tests/runner/spawn_env_guard.test.ts`; `bash tests/test-engine10-dist.sh` | released@2026-09-28T16:03Z | TL APPROVE (sonnet) on 10391f4a, both reverts reproduce red; merged c5ace6e1: full `cd loki-ts && bun test` 2239 pass 0 fail, dist test 18 passed 0 failed, core 4,999. Released in v10.2.1 (npm publish 2026-09-28T16:03Z; every cited commit is an ancestor of the v10.2.1 tag; `git merge-base --is-ancestor`). |
-| E-84 | Pulse TRAIN_LATE reads the last train push from the reflog of refs/remotes/origin/main (moves on every push and on fetches of others' pushes), then push-*.log, then UNKNOWN | scripts/v10-pulse.sh (last_train_push_epoch only), tests/test-v10-pulse.sh | MEDIUM | bash tests/test-v10-pulse.sh; fixture: temp repo plus bare remote, a real `git push` makes the check read under 1 min with no push-*.log present; no reflog and no logs reads UNKNOWN | released@2026-09-28T16:03Z | Source: founder 15:09Z; TRAIN_LATE read 681.9 min while trains were pushed at 14:42Z and later, because plain `git push` writes no push-*.log. TL APPROVE (sonnet) on eeace3f6: `bash tests/test-v10-pulse.sh` 109 passed 0 failed; against the old pulse 106 passed 3 failed; live pulse after merge reads "Minutes since last train push: 12.1". Released in v10.2.1 (npm publish 2026-09-28T16:03Z; every cited commit is an ancestor of the v10.2.1 tag; `git merge-base --is-ancestor`). |
-| E-85 | Security Audit: a narrowly scoped gitleaks allow rule for 40-hex commit pins in eval task.json (repo.ref, merge_sha) so pinned upstream SHAs stop tripping sourcegraph-access-token; CTO approval required (posture: no blanket suppressions) | .gitleaks.toml (or the workflow config), .github/workflows/security-audit.yml | HIGH | a fixture task.json with a 40-hex ref passes; the same string in any other file or key still fails | parked@2026-09-28T21:14Z | Source: v10.2.0 Release 36440534050 blocked by a pinned werkzeug SHA; EV-11b and EV-12A/B/C add more pins. Wave E27 (wf_bcacb1d1-e76). CTO-level opus review. Wave E27 stopped 18:37Z (founder: over budget, load 50). Build 1 commit on slice-E-85-gitleaks-pins, never reviewed. Parked 21:14Z: a regex allow rule for commit-pin shapes conflicts with the exact-fingerprint-only allowlist policy (security rule: no path or rule suppression). Pins are allowlisted per fingerprint with a reason, as done for werkzeug (82e39c29) and E-101 (6358e0a6). |
-| DEP-01 | Dependency inventory (D35): docs/v10/DEPS.md lists every manifest (all package.json incl. @anthropic-ai/sdk and claude-agent-sdk; every requirements*.txt and pyproject.toml; every uses: in .github/workflows and .github/actions; Node, Python, Bun matrices; Docker bases, Helm images, Terraform providers, Homebrew formula) with current and latest stable, patch/minor/MAJOR, and runtime EOL; no upgrades | docs/v10/DEPS.md, scripts/dep-inventory.py | LOW | python3 scripts/dep-inventory.py regenerates DEPS.md byte-identically on a second run (network results cached); every manifest found by `git ls-files` appears | released@2026-09-28T17:16Z | Source: founder directive 15:20Z (D35). DEP workstream: max 3 builders, never ahead of E/EV/M. Round 3 2794574b TL APPROVE (sonnet) after two REJECT rounds (bump column mismatch, Node 20 claim, 0.x class, Helm drift; then a missing helm/loki-mode chart and unverified floating tags); `bash tests/test-dep-inventory.sh` 5/5, `--self-test` 23/23. Released in v10.2.2 (npm gitHead 9a59750d). |
-| E-87 | Release dispatch path: required-ci also accepts a completed workflow_dispatch Security Audit run at the exact SHA (Tests and Bun Parity stay push-only), so a tree whose VERSION is already bumped can publish after an audit fix | .github/workflows/release.yml (required-ci only), a test that runs the extracted step against a fixture run list | HIGH | fixture: dispatched audit success at the SHA counts; a dispatched audit at another SHA does not; Tests via dispatch still does not | released@2026-09-30T19:22Z | Source: v10.2.0 Release 36443541666 waited on an audit it could never count. CTO approval required (release gate). Wave E27 (wf_bcacb1d1-e76). CTO-level opus review. Wave E27 stopped 18:37Z (founder: over budget, load 50). REJECT (reproduced): tests pass with the completed-and-success condition removed from the dispatched-audit check. Branch kept. Released in v10.5.8 (merge b1be2085 is an ancestor of v10.5.8). |
-| E-88 | Release notes fully written (D36): scripts/release-notes.sh extracts the CHANGELOG section literally (dated headings), fails on a missing, empty, heading-only or placeholder section; release.yml fails instead of falling back and checks the published body; pre-push refuses a VERSION bump without a full section | scripts/release-notes.sh, .github/workflows/release.yml (extract step), .githooks/pre-push, docs/dev/release-checklist.md, tests/test-release-notes.sh | HIGH | bash tests/test-release-notes.sh; failing first against the old awk pattern | released@2026-09-28T21:01Z | Source: founder directive 16:05Z; six releases published with "Release vX.Y.Z" bodies (backfilled). Founder 17:22Z: stopped at 70 min and re-sliced as E-88a (auto-carry removed, explicit --include only). Wave E27 (wf_bcacb1d1-e76). Wave E27 stopped 18:37Z (founder: over budget, load 50). E-88a opus APPROVE (branch slice-E-88a); merge conflicts with E-86 in .githooks/pre-push; rebase after E-99 lands (same file). E-88a rebased onto E-99 as slice-E-88a-r2 62774912; opus APPROVE (pre-push diff purely additive, E-99 gitleaks steps byte-identical, stdin read once, gate main-only and fail-closed, release.yml exits 1 instead of a placeholder); merged 60ce7620; release-notes 41/0, pre-push-hook 13/0, pre-push-gitleaks 43/0. Non-blocking: gate runs the working tree release-notes.sh; _cl_tmp not in the EXIT trap. Released in v10.5.0 (merge 60ce7620 is an ancestor of v10.5.0). |
-| E-89 | Pulse RELEASE_CADENCE (D37): violation when more than 25 minutes pass with main green (Tests and Bun Parity success at HEAD) and at least one merged-unreleased slice commit (not an ancestor of the latest published tag, docs-only commits excluded) | scripts/v10-pulse.sh (one check), tests/test-v10-pulse.sh | MEDIUM | bash tests/test-v10-pulse.sh; fixtures: green plus unreleased slice commit 26 min old fires; red main does not; docs-only commits do not; 24 min does not | released@2026-09-28T22:02Z | Source: founder directive 16:20Z. Founder 17:22Z: stopped at 58 min; salvaged commit cce8f48a re-sliced as its own slice plus UNDERSTAFFED. Wave E27 (wf_bcacb1d1-e76). Wave E27 stopped 18:37Z (founder: over budget, load 50). TL APPROVE (sonnet) on the salvaged cce8f48a plus UNDERSTAFFED; merged locally; `bash tests/test-v10-pulse.sh` 129 passed 0 failed. Released in v10.5.2 (merge bd7d75f7 is an ancestor of v10.5.2). |
-| E-90 | Release Manager marks BOARD rows released after publish: scripts/board-mark-released.sh <tag> flips every merged row whose merge commit is an ancestor of <tag> to released@ with the tag and the ancestry evidence; pulse MERGED_NOT_RELEASED_STALE when a merged row is already in a published tag | scripts/board-mark-released.sh, scripts/v10-pulse.sh (one check), tests/test-board-mark-released.sh | MEDIUM | bash tests/test-board-mark-released.sh; a merged row in the tag flips, one not in it stays; BOARD line count unchanged | released@2026-09-28T22:02Z | Source: 16:20Z the BOARD showed 20 merged slices that had all shipped in v10.1.0 to v10.2.1, which read as a 20-slice release backlog. Founder 17:22Z: stopped; salvaged commit 1d9dfae7 re-sliced after E-89. Wave E27 (wf_bcacb1d1-e76). Wave E27 stopped 18:37Z (founder: over budget, load 50). Build on slice-E-90-r2 (5 commits) never reviewed; re-review as its own slice. Dispatched 21:14Z sonnet (fresh; the E27 branch was never reviewed). Tech Lead APPROVE bd7d75f7 (anchored slice grep, ancestry-only flips, atomic write); merged 7b1f7e3d; run for v10.5.0 flipped 42 rows (c62f3cb0). Released in v10.5.2 (merge 7b1f7e3d is an ancestor of v10.5.2). |
-| DEP-02 | actions/checkout v4 (runs on deprecated node20) to latest major v7, SHA-pinned with a "# v7.x.y" comment in every workflow and composite action; read the v5, v6, v7 release notes and fix breaking changes (fetch-depth, persist-credentials defaults) | .github/workflows/*.yml, .github/actions/**/action.yml (uses: actions/checkout lines, plus any input the migration requires) | MEDIUM | `grep -rn "actions/checkout@" .github` shows only full-SHA pins with a v7 comment; actionlint clean; a PR run of Tests, Bun Parity and Security Audit on the slice concludes success (run id cited) | parked@2026-09-28T19:52Z | Source: DEP-01 inventory (D35). A release containing workflow changes needs the tag pushed by the Release Manager (GITHUB_TOKEN lacks the workflows permission; release.yml prints the workaround). Parked 19:52Z: no agent holds it; PR #218 open (gh pr view 218: OPEN, no checks reported). Merge after the E-98 fix train per D35/D40 (DEP never ahead of E/EV/M). |
-| DEP-03 | actions/setup-node v4 (node20) to latest major v7, SHA-pinned with a version comment; read the v5..v7 release notes (cache and package-manager detection defaults) and fix breaking changes | .github/workflows/*.yml, .github/actions/**/action.yml (setup-node lines and required inputs) | MEDIUM | only SHA pins with a v7 comment; actionlint rc=0; PR run conclusion success (run id cited) | parked@2026-09-28T19:52Z | Source: DEP-01 inventory (D35). Parked 19:52Z: same as DEP-02 (PR #218). |
-| DEP-04 | Runtime matrix: drop Node 20 (EOL 2026-04-30) from every workflow matrix, keep 22 (previous supported, users still run it) and 24, add the current stable line if the inventory shows one newer and supported; update package.json engines and docs that name Node 20 | .github/workflows/*.yml (node-version values), package.json (engines only), docs naming the Node version | MEDIUM | no node 20 left in any matrix; engines matches; PR run conclusion success on every remaining version (run id cited) | parked@2026-09-28T19:52Z | Source: DEP-01 inventory (D35). Parked 19:52Z: no agent holds the rework; resumes after the E-98 fix train per D40. |
-| E-91 | Pulse UNEVIDENCED_CLAIM and every row parser accept any slice id prefix ([A-Z]+-\d+, e.g. DEP-02, GF-1, PF-3), not a hardcoded S/E/EV/M list | scripts/v10-pulse.sh (row-id regexes only), tests/test-v10-pulse.sh | LOW | bash tests/test-v10-pulse.sh; a DEP row with "green" only in its Wall cell is not flagged, its notes cell still is | released@2026-09-28T21:01Z | Source: pulse flagged DEP-03/DEP-04 Wall cells (df7dc134), the E-71 bug class again. Serialize after E-89/E-90 and E-79..81 (same file). Wave E27 (wf_bcacb1d1-e76). After E-90 (same file). Wave E27 stopped 18:37Z (founder: over budget, load 50). Not started. Tech Lead APPROVE e311b47e; merged 039f8af2; test-v10-pulse.sh 131/0. Revealed DEP-02..04 stale building rows (parked). Released in v10.5.0 (merge 039f8af2 is an ancestor of v10.5.0). |
-| E-92 | P0 fix-forward: dep-inventory --self-test reached the real gh floating-tag resolver (actions/setup-node@v4), so CI without gh auth read bump unknown (Tests red since df7dc134, run 36451439320) | scripts/dep-inventory.py (self-test fixture) | HIGH | `env -u GH_TOKEN -u GITHUB_TOKEN PATH=/usr/bin:/bin python3 scripts/dep-inventory.py --self-test` rc=0; rc=1 on the previous version | released@2026-09-28T17:16Z | TL APPROVE (sonnet) on 81cdba4d: stripped-env self-test 23/23 rc=0, origin/main rc=1, fixture mutation goes red, no second network path in self_test(); merged 4f7f1487. Guard: E-93. Released in v10.2.2 (npm gitHead 9a59750d, Release run 36455687013). |
-| E-93 | Guard (D37 same-class-never-twice): tests/test-dep-inventory.sh runs --self-test under a stripped environment (no GH_TOKEN/GITHUB_TOKEN, PATH=/usr/bin:/bin, empty HOME) so a network-dependent self-test fails locally, not only in CI; GUARDS.md entry | tests/test-dep-inventory.sh, docs/v10/GUARDS.md | LOW | a self-test that calls an unstubbed fetcher fails the leg locally | released@2026-09-28T21:01Z | Source: E-92 incident. Wave E25 (wf_46137a6b-367). TL APPROVE (sonnet); merged on main 18:00Z; `bash tests/test-dep-inventory.sh` 6 passed 0 failed. Released in v10.5.0 (merge 76086e8f is an ancestor of v10.5.0). |
-| EV-12E | Upstream-first hidden-test enforcement (D38 criteria 1, 3, 4, 7, 9): validate requires hidden.provenance, hidden.sha256 and requirements[] on lg-* tasks; measure-size excludes typing-examples/, examples/, docs/; a test-harness leg applies every tasks/lg-*/shortcuts/*.patch and asserts not completed, and RED at ref is not collection-only; run.sh rows gain hidden_subset | eval/loki10/harness.py (validate only), eval/loki10/measure-size.py, eval/loki10/test-harness.sh (new section) | HIGH | fixture with a wrong sha256 fails validate rc=1; a passing shortcut fixture fails the leg; an attrs-602-shaped fixture reads medium | released@2026-09-30T20:08Z | Source: D38. Needs EV-12S merged first (measure-size). Wave E27 (wf_bcacb1d1-e76). Wave E27 stopped 18:37Z (founder: over budget, load 50). REJECT (reproduced): RED at ref must be by assertion (criterion 7) is untested. Branch slice-EV-12E kept (4 commits). Released in v10.5.10 (merge 3162d655 is an ancestor of v10.5.10). |
-| EV-12F | Retrofit lg-werkzeug-1513, 1680, 1769 and lg-httpx-1522 to D38 criteria 1-9 (requirements map, upstream-later tests first, authored public-API tests, sha256 freeze, saved shortcuts as must-fail fixtures from ~/loki-ci-logs/ev12-shortcuts/) | eval/loki10/tasks/lg-werkzeug-{1513,1680,1769}/, lg-httpx-1522/, their refdiffs | HIGH | per task: RED by assertion, GREEN at merge, every Ri-omission mutant fails, every shortcut fails, regression files pass, validate rc=0; independent opus 45-minute shortcut attempt passes nothing | parked@2026-09-30T20:04Z | Source: D38. Two engineers (task pairs). Wave E25 (wf_46137a6b-367). Two engineers (task pairs). Wave E25 opus REJECT on every retrofitted task (requirements not covering the sized refdiff, -k deselecting the only Ri test, deprecation requirements untested, shortcuts that omit stated requirements still passing). Deprioritized at 18:00Z behind EV-15 and E-98: the flip is blocked by the medium-tier result regardless of the large tier. BLOCKED 19:50Z on the D34 size rule (decision in PROGRESS 19:45Z): slice-EV-12F-a2 9ec3ac0b retrofits lg-werkzeug-1513/1680/1769 (validate ok, 4 shortcuts fail at ref, 1513 omission mutants R1-R3 rc=1) but measures below pub-faker-2206 (1032 added lines, declared medium). Also carries an emoji-scan exclusion for tasks/*/hidden/** (needs TL review). PARKED 20:05Z by the adoption directive (docs/v10/PROGRESS.md 20:05Z); resumes after Tier 0 is green. |
-| EV-12G | Retrofit lg-httpx-1550, lg-httpx-3319, lg-attrs-660 to D38, then new upstream PRs (with later upstream tests first) until the large tier holds 10 | eval/loki10/tasks/lg-httpx-{1550,3319}/, lg-attrs-660/, new lg-* dirs, their refdiffs | HIGH | as EV-12F; at least 5 passing on main before the EV-14 large runs | parked@2026-09-30T20:04Z | Source: D38. Wave E25 (wf_46137a6b-367). Wave E25 opus REJECT on every retrofitted task (requirements not covering the sized refdiff, -k deselecting the only Ri test, deprecation requirements untested, shortcuts that omit stated requirements still passing). Deprioritized at 18:00Z behind EV-15 and E-98: the flip is blocked by the medium-tier result regardless of the large tier. BLOCKED 19:50Z on the same D34 rule: slice-EV-12G 91884218 retrofits lg-httpx-1550, lg-httpx-3319, lg-attrs-660 (validate ok; mutants 20/20, 13/13, 11/11; 9 shortcut patches fail at ref). Growing the large tier to 10 not started. PARKED 20:05Z by the adoption directive (docs/v10/PROGRESS.md 20:05Z); resumes after Tier 0 is green. |
-| E-94 | Guard for red main df7dc134 (a test passed locally only because gh was authenticated): local-ci fast tier re-runs every changed test file under a stripped environment (no GH_TOKEN, gh or network credentials) and fails on a difference | scripts/local-ci.sh (one check), tests/test-local-ci-hermetic.sh, docs/v10/GUARDS.md | MEDIUM | a fixture test that calls gh fails the check; the pre-E-92 dep-inventory.py is caught | released@2026-09-28T21:01Z | Source: founder 17:22Z (each red main becomes a pre-merge guard). Wave E27 (wf_bcacb1d1-e76). Wave E27 stopped 18:37Z (founder: over budget, load 50). TL APPROVE; merged locally; `bash tests/test-local-ci-hermetic.sh` 18 passed 0 failed. Released in v10.5.0 (merge 82c22684 is an ancestor of v10.5.0). |
-| E-95 | Guard for red main 8f2179cd (App Runner Watchdog Health fixture server never came up; rerun 36453069628 passed): free port by binding 0, readiness poll up to 10s with a clear message; 20/20 under parallel load | tests/test-app-runner-watchdog-health.sh, docs/v10/GUARDS.md | LOW | 20 consecutive passes while 4 parallel pulse suites run | released@2026-09-28T21:01Z | Source: founder 17:22Z. Wave E27 (wf_bcacb1d1-e76). Wave E27 stopped 18:37Z (founder: over budget, load 50). TL APPROVE; merged locally; `bash tests/test-app-runner-watchdog-health.sh` 12 passed 0 failed. Released in v10.5.0 (merge 08dd38f4 is an ancestor of v10.5.0). |
-| E-86 | Pre-push gitleaks for eval task fixtures (founder 15:16Z): pinned v8.30.0 with hardcoded checksums, every pushed commit scanned in dir mode from the pushed commit (not the working tree), refusal names file, line and rule, never the secret | .githooks/pre-push, scripts/install-gitleaks.sh, tests/test-pre-push-gitleaks.sh, .gitleaksignore | HIGH | real-push fixtures: a sourcegraph URL plus 40-hex pin is refused; opus security review | released@2026-09-28T21:01Z | Source: v10.2.0 blocked by gitleaks. Rounds 1-3 opus REJECT with reproduced fail-opens (non-ASCII dirs, unfetched force-push, working-tree scan, checksum bypass; intermediate commits; root commits, history leak, case collisions). Round 4 building as one squashed commit off main. Round 4 8f9baace opus APPROVE (every earlier reproduction refuses; fresh-clone Security Audit gitleaks rc=0 with the branch merged); merged on main; `bash tests/test-pre-push-gitleaks.sh` 40 passed 0 failed. Follow-ups in E-99. Released in v10.5.0 (merge d7ce074b is an ancestor of v10.5.0). |
-| E-96 | Safe worktree pruning: scripts/prune-worktrees.sh removes a .claude/worktrees entry only when it is not locked, has no process with a cwd inside it (lsof), and its branch has no commit or file change in the last 30 minutes measured with git and stat (never find -newermt), refusing when any check cannot run; the pulse WORKTREE_COUNT NEXT ACTION names the script | scripts/prune-worktrees.sh, tests/test-prune-worktrees.sh, scripts/v10-pulse.sh (NEXT ACTION text only) | MEDIUM | fixture: a worktree with a live process inside is kept; an idle one is removed; an unsupported check refuses | parked@2026-09-28T18:58Z | Source: 17:36Z incident: the Chief of Staff pruned by `find -newermt "-25 minutes"` (unsupported on BSD find, matched nothing) and force-removed 7 live builder worktrees (M-07 r4, M-11 r3, EV-14, EV-12F-a, EV-12G, E-95, E-87); every branch had its work committed, uncommitted edits since the last commit were lost. Superseded by E-101 (same prune-worktrees.sh scope). |
-| DEP-05 | npm/bun patch and minor batch from docs/v10/DEPS.md (web-app, legacy-ui, vscode-extension, root; lockfiles regenerated and committed; 0.x packages excluded) | the package.json and lockfiles DEPS.md names for patch/minor only | LOW | npm audit: no new high or critical; hallucinated-dependency guard rc=0; full Tier B plus the moat suite on a PR run | released@2026-09-28T22:02Z | Source: DEP-01 inventory (D35). Dispatched 21:18Z sonnet (founder 17:10 staffing directive). Tech Lead REJECT 82e35ffa: @types/vscode ^1.138 with engines.vscode ^1.85 (types expose APIs older users lack); rework drops that bump. r2 31c06cc2 restores @types/vscode ^1.85.0 (extension compile passes); merged cdec9666. web-app high audit findings 2 to 0. Released in v10.5.2 (merge cdec9666 is an ancestor of v10.5.2). |
-| DEP-06 | Python patch and minor batch from docs/v10/DEPS.md (dashboard, mcp, web-app requirements, sdk/python pyproject; 0.x excluded) | those requirements*.txt and pyproject.toml | LOW | pip-audit: no new high or critical; guard rc=0; PR run of Tests conclusion success (run id cited) | released@2026-09-28T22:02Z | Source: DEP-01 (D35). Dispatched 21:18Z sonnet (founder 17:10 staffing directive). Tech Lead APPROVE ecb628bd (no SQLAlchemy 2.1 removals used; tests mcp 59/0, web-app 164/0, dashboard 39/0; 5 pip-audit findings pre-existing, no fix). Merged 4b009c21. Released in v10.5.2 (merge 4b009c21 is an ancestor of v10.5.2). |
-| DEP-07 | SHA-pin every remaining tag-pinned action already on its latest major (anchore/sbom-action, anthropics/claude-code-action, contributor-assistant/github-action, oven-sh/setup-bun) with a version comment | .github/workflows/*.yml (those uses: lines only) | LOW | every uses: is a full SHA with a vX comment; actionlint rc=0; PR run | released@2026-09-28T22:02Z | Source: DEP-01 (D35). Serialize after DEP-02/DEP-03 merge (same files). Dispatched 21:18Z sonnet (founder 17:10 staffing directive). Tech Lead APPROVE b2c49a12 (4 SHAs match current tag targets; only uses lines changed). Merged 3da32438. Released in v10.5.2 (merge 3da32438 is an ancestor of v10.5.2). |
-| G-01 | Usage governor (D39): scripts/usage-governor.py sums usage (output, input, cache read, cache write) from ~/.claude/projects/**/*.jsonl per model, role (from workflow labels and agent types where recorded) and hour; stores founder plan-percentage readings (docs/v10/usage-readings.tsv) and fits tokens-per-percent as a labelled estimate; projects 5-hour window and weekly usage; outputs max engineers for the next hour; checks and records whether Claude Code exposes plan usage directly (statusline input rate-limit fields, /usage) and uses it when it does | scripts/usage-governor.py, docs/v10/usage-readings.tsv, tests/test-usage-governor.sh | HIGH | fixture jsonl plus readings gives a stated projection and max-engineer number; missing readings reads "uncalibrated", never a number presented as fact | released@2026-09-28T21:01Z | Source: founder 17:44Z. First in the queue; everything obeys it. r2 de8e1f76 opus REJECT: weekly reset 1h off across DST; fixes 2 and 4 unguarded. r3 dispatched 19:00Z. r3 fa279532 opus APPROVE (DST reset fixed; fixes 2 and 4 mutation-guarded by T14/T15); merged c2ae4347; governor 25/0, logger 16/0, run-shellcheck.sh passes, shard coverage 19/0, drift 6/0. Open non-blocking: weekly tokens counted from computed Wednesday not live resets_at-7d; no test for live-reset preference; "uncalibrated" label when idle. Released in v10.5.0 (merge c2ae4347 is an ancestor of v10.5.0). |
-| G-02 | Pulse BUDGET_BURN and OPUS_SHARE violations plus an hourly METRICS.md usage section (tokens per role and model, cost per merged slice, window and weekly projections, max engineers, releases per hour, merged slices per hour and per million tokens), all from G-01 | scripts/v10-pulse.sh (two checks), tests/test-v10-pulse.sh, docs/v10/METRICS.md (section header only) | MEDIUM | fixtures: opus 31% fires OPUS_SHARE; a projection of 86% fires BUDGET_BURN; uncalibrated reads UNKNOWN | released@2026-09-28T21:01Z | Source: founder 17:44Z. Depends on G-01. Serialize after E-89..E-91 (same file). Dispatched 19:09Z, sonnet engineer (G-01 merged; goes before E-90/E-91, which rebase after). Built f172b9b6 (rebased onto E-91), test-v10-pulse.sh 138/0, 7 T48 subtests red on unmodified pulse first; 46 min vs 30 budget (large pulse file). Tech Lead review 19:55Z. Tech Lead APPROVE (pulse 0.61s wall, governor keys match usage-governor.py:562-591, null max is UNKNOWN); merged. Released in v10.5.0 (merge 8f93cb9f is an ancestor of v10.5.0). |
-| G-03 | docs/v10/SCALE.md: what the Max 20x plan sustains around the clock (from G-01 measurements and calibration), what 50 parallel engineers need (API pay-as-you-go with a rate-limit tier, or Team/Enterprise), cost per day estimates labelled as estimates, and the ramp gates (governor allows, merged slices per hour rising, merged work per token not falling) | docs/v10/SCALE.md | HIGH | every number cites a measurement or is labelled an estimate with its basis | released@2026-09-28T21:01Z | Source: founder 17:44Z. CTO (opus) authors. Billing is the founder decision. Merged as 4708cee1 (row status was stale). Released in v10.5.0 (merge 62b495a5 is an ancestor of v10.5.0). |
-| G-04 | Cloud fan-out (HIGH, CTO-owned): dispatch ready slices with no file overlap with in-flight work as Claude Code cloud sessions that open PRs from their own branches; the Release Manager merges PRs whose checks concluded success with gh pr merge; every dispatch recorded in BOARD.md with its cloud session id; ramp 25 to 50 only when the governor allows and merged slices per hour rose | scripts/cloud-dispatch.sh, docs/v10/SWARM.md (one section), tests/test-cloud-dispatch.sh | HIGH | dry-run dispatch prints the exact command and the BOARD row it would write; refuses when the governor max is reached or file sets overlap | released@2026-10-16T00:49Z | Built 0a90538a8: dry-run default, --live needs verified `claude --cloud` (no cloud subcommand in 2.1.288), refusals 10/11/12; test 25/0, overlap mutation 3 red. Governor uncalibrated so every dispatch refuses (fail safe). Opus HIGH review running. First real --live is a founder probe. r2 building (F1-F6 + A1/A6/A7/A8). r2 11b6e1b73 (62/62 /bin/bash, red 51/62 on r1); opus re-review running. r2 opus BLOCK (R2-1: paths inside parentheses dropped from overlap). r3 building: R2-1 + leader-ancestor check, --live stub tests, mode preserve. r3 e99768c74 opus APPROVE (9 mutants red, 85/0). Merged 7982bb471..4321d1665; on main 85/0 /bin/bash, shard coverage 19/0. Advisories carded: --live is a session check not an agent check (policy: RM/CoS only); paren prose like e.g becomes a token; A2/A3/A7; after/range dependency wording. |
-| G-05 | The same fan-out as loki modernize remote-worker mode (POST /jobs kind unit, Helm worker.engine v10): align G-04 with M-23 | (design note in docs/v10/MODERNIZE.md, one section) | MEDIUM | the note maps G-04 dispatch fields to the M-23 job schema | released@2026-10-16T02:04Z | Source: founder 17:44Z. Depends on G-04 and M-17. |
-| EV-15 | Re-run the medium tier (7 tasks, raw and v10, 2 runs each, same model) with every result file written under ~/loki-ci-logs/eval/ev15-<arm>-r<n>/ (outside any worktree) and a per-task table of which runs failed and why (hidden-test failure, timeout, no PR, cost) | eval/loki10 results (outside the repo), docs/v10/METRICS.md (one section) | HIGH | 28 rows, 0 arm_unavailable; per-task failure reasons cited from the result files | released@2026-10-16T00:49Z | Source: EV-14 evidence lost (17:36Z incident) and v10 lost on all three medium axes. Governor-gated (paid run). D40 priority 1: running (wf_4af22d00-9fb), results under ~/loki-ci-logs/eval. Done 19:19Z: raw 10/14 $0.5085 p50 56s; v10 9/14, cost at least $0.788 (E-98 correction) p50 128s. Files durable under ~/loki-ci-logs/eval/ev15-*. |
-| E-98 | Diagnose why v10 loses to raw on medium (EV-15 per-task failures): for each task v10 failed and raw completed, read the v10 run log and name the stage and cause (plan, Wall, implement, verify, fix rounds, cap), then cut fix slices | docs/v10/ENGINE.md (findings section) | HIGH | each finding cites a result file path and a log line | released@2026-09-28T21:01Z | Source: EV-14. Depends on EV-15. CTO (opus) analysis. D40 priority 1: CTO analysis runs after EV-15 in the same workflow. docs/v10/MEDIUM-ANALYSIS.md merged d496db89. Top cause: verify hard-codes python, so 27/27 pytest checks were not_run and no fix round ever fired. Cards E-98a..f below. Released in v10.5.0 (merge 8b41ad40 is an ancestor of v10.5.0). |
-| E-98a | verify uses the project interpreter (.venv, venv, $VIRTUAL_ENV, python3, python); a check on a system interpreter adds a not_proven line | loki-ts/src/engine10/stages/verify.ts, loki-ts/tests/engine10/verify*.test.ts | HIGH | fixture red then green (.venv shim, no python on PATH); core +12 max | released@2026-09-28T21:01Z | Source: MEDIUM-ANALYSIS.md. Dispatched 19:40Z sonnet; opus review. r1 31af475c opus REJECT: seal.ts never reads verify not_proven (git grep "verify?.not_proven" rc=1), so a system-interpreter pass still seals VERIFIED; $VIRTUAL_ENV trusted outside the repo. r2 dispatched 19:53Z with seal.ts added to the file set, plus ruff resolution and a behavioral red. r2 cabf16ef opus APPROVE (seal PARTIAL on verify not_proven, receipts byte-stable without the flag, realpath-scoped VIRTUAL_ENV); merged 5cdd611d; verify+seal 36/0. Combined with E-98b/c/d the core is 5003 (budget.test.ts FAIL, Received 5003): fix-forward E-111. Released in v10.5.0 (merge 5cdd611d is an ancestor of v10.5.0). |
-| E-111 | P0 (local main red): engine10 core is 5003 lines after E-98a/b/c/d merged (budget.test.ts Received 5003, cap 5000). Cut at least 25 lines of dead or duplicated code from loki-ts/src/engine10 (outside modernize/) with no behavior change, leaving room for E-98e (+10) | loki-ts/src/engine10 (non-modernize), no test changes except budget | MEDIUM | budget.test.ts passes at 4978 or less; cd loki-ts && bun test tests/engine10 has no new failures vs main | released@2026-09-28T21:01Z | Source: merge of E-98a at 20:10Z. Dispatched sonnet. opus REJECT r1 (deleted prStage/intakeStage, test-engine10-dist 16/2); APPROVE r2 f286f6ec; merged f059c87a, dist rebuilt e1363c67; core 4976, engine10 668/0, dist 18/0. Released in v10.5.0 (merge f059c87a is an ancestor of v10.5.0). |
-| E-112 | v10-guard: refuse a path-wide `git checkout <ref> -- .` (or `git restore --source <ref> .`) when cwd is the main checkout, so a read-only reviewer cannot overwrite the shared tree; allowed inside .claude/worktrees/* | scripts/v10-guard.sh, tests/test-v10-guard.sh | LOW | fixture: the command in the main checkout is blocked, the same in a worktree is allowed, a single-file checkout is allowed (red first) | released@2026-09-28T21:01Z | Source: E-98e Tech Lead review 20:19Z ran `git checkout slice-E-98e -- .` then `git checkout main -- .` in the main checkout (tree restored clean, but it could have clobbered concurrent merges). Built f4515ec9 (6 new block cases red on the old guard); Tech Lead APPROVE (7 allow probes incl. single-file checkout, branch switch, heredoc text all exit 0); merged; test-v10-guard.sh 170/0. Released in v10.5.0 (merge 06c01b6c is an ancestor of v10.5.0). |
-| E-113 | P0 (main red at a4623675): tests/test-release-notes.sh T9l/T9n/--include fixtures build padding with yes piped to head under pipefail; on the Linux runner only the 34-byte header was written. Generate padding without a pipe | tests/test-release-notes.sh | LOW | passes locally and under the CI condition (SIGPIPE ignored); old version shown red there | released@2026-09-28T21:01Z | Source: Tests run on a4623675 shard 4/8: "[FAIL] T9n fixture is not in the intended size band ... 34 bytes". Passes 41/0 on macOS. Dispatched 20:39Z. Built 74ffd928 (pipe-free printf loops; macOS could not reproduce the Linux drop even under trap PIPE, so CI is the proof). Tech Lead APPROVE (bytes identical: T9l 132034, T9n 98034, T9o 224089). Merged; 41/0 locally. Released in v10.5.0 (merge f6c3add4 is an ancestor of v10.5.0). |
-| E-114 | CI Security Audit gitleaks must not trust a pushed .gitleaks.toml or new .gitleaksignore entries: scan with the default rules plus the config from the previous release tag (or refuse the job when the pushed range changes .gitleaks.toml), and report any .gitleaksignore line added in the range for review | .github/workflows/security-audit.yml, tests/test-security-audit-config.sh | HIGH | a workflow-level test (act or a script that runs the same step) shows a range that adds a zero-rule .gitleaks.toml plus a secret fails the job (red first) | released@2026-09-28T22:26Z | Source: E-110 opus review 21:09Z: the gitleaks step (security-audit.yml:276) loads the checkout own .gitleaks.toml, so the same zero-rule config trick that bypassed the pre-push scan works against CI (no --config at security-audit.yml:276). CTO-level change to a release gate. Dispatched 21:11Z sonnet; opus review before merge. opus REJECT r1 (event.before chain from an ungated push, repro "no leaks found"), REJECT r2 (no-tag fallback to origin/main~1 fails open), APPROVE r3 b30c2870 (base = last release tag; no tag: default rules and any tip .gitleaks.toml refused); also fixed the scan-coverage baseline shape broken by 6358e0a6. Merged; audit-config 15/0, scan-coverage 31/0. Released in v10.5.3 (merge 8b62cd2b is an ancestor of v10.5.3). |
-| E-115 | Verify: a passing lint on a system ruff adds its own not_proven line ("lint ran on the system ruff") instead of reusing "tests ran on the system interpreter" | loki-ts/src/engine10/stages/verify.ts, loki-ts/tests/engine10/verify.test.ts | LOW | unit test: system ruff pass gives the lint line, not the tests line (red first); core stays under 5000 | released@2026-10-16T00:49Z | Source: E-98a r2 opus review (advisory). Held 21:31Z: worktree cap (15). Held 22:01Z: touches core verify.ts while S41-16 has core at 4997/5000. |
-| E-116 | seal.test.ts has no SPEC_CONFLICT case: add real-seal tests (not a copy of seal.ts:110) proving SPEC_CONFLICT survives verify pass, verify fail plus fix, and never upgrades to VERIFIED | loki-ts/tests/engine10/seal.test.ts | LOW | new cases red on a mutated seal.ts that drops the spec_conflict branch | released@2026-09-28T22:02Z | Source: E-98b opus review note 4. Built fbc79ac9 (4 real-seal tests; red when seal.ts:109 removed); Tech Lead review 21:30Z. Tech Lead APPROVE fbc79ac9 (imports the real sealStage; gap test honest); merged; seal.test.ts 18/0. Released in v10.5.2 (merge f4087942 is an ancestor of v10.5.2). |
-| E-117 | Pulse DEPENDS_ON parsing: expand range shorthand ("Depends on E-98a..e", "M-20..M-23") into each id so a dependency on b..e is not silently dropped | scripts/v10-pulse.sh (dependency parse only), tests/test-v10-pulse.sh | LOW | fixture: "Depends on E-98a..c" with E-98b unmerged is blocked (red first) | released@2026-09-28T22:02Z | Source: E-91 Tech Lead review. Dispatched 21:31Z sonnet. Tech Lead REJECT 5f59bfed: numeric range uncapped (M-1..M-9999 expands to 9999 ids into the injected pulse); r2 caps at 50. r2 d99963e3 caps numeric spans at 50 (the Tech Lead blocker); merged; test-v10-pulse.sh 146/0. Released in v10.5.2 (merge ab909f95 is an ancestor of v10.5.2). |
-| E-118 | Usage governor leftovers from G-01 review: a non-numeric used_percentage or a non-dict rate_limits in a live reading must be ignored, not crash; the "uncalibrated" label must not show when calibration exists but no engineers were active | scripts/usage-governor.py, tests/test-usage-governor.sh | LOW | fixtures for each case (red first); 30/30 existing still pass | released@2026-09-28T23:18Z | Source: G-01 r2/r3 opus review non-blocking notes. Held 21:31Z: worktree cap (15). Dispatched 22:01Z. Built 7ef9183a (TypeError and AttributeError reproduced first); Tech Lead APPROVE (bad reading degrades to uncalibrated, never a healthy 0%; E-109 cache untouched); merged; 36/0. Released in v10.5.5 (merge 66ef537d is an ancestor of v10.5.5). |
-| E-119 | pre-push: the pushed-range .gitleaks.toml check (pre-push:319) swallows a git rev-list error with an or-true, which reads as "config unchanged" and restores the tip config; fail closed on a non-zero rc | .githooks/pre-push, tests/test-pre-push-gitleaks.sh | LOW | a stubbed git rev-list failure refuses the push (red first) | released@2026-09-28T22:26Z | Source: E-110 r2 opus review nit 4. Built 22bc9931 (case 35 red on the pre-fix hook: push succeeded rc=0); opus APPROVE (one code path changed; case 28 still refuses the corrupted range); merged; pre-push-gitleaks 54/0, pre-push-hook 13/0. Released in v10.5.3 (merge b6360142 is an ancestor of v10.5.3). |
-| E-120 | Seal: carry implement.spec_conflict_reason into receipt.json and receipt.md so a SPEC_CONFLICT verdict states why | loki-ts/src/engine10/stages/seal.ts, loki-ts/tests/engine10/seal.test.ts | LOW | the E-116 documenting test flips to asserting the reason is present (red first); core stays under 5000 | released@2026-09-28T22:02Z | Source: E-116 engineer finding (seal.ts reads only implement.exit and tests_reverted). Dispatched 21:31Z sonnet. opus REJECT b0f0dce3: reason rendered raw into receipt.md (a newline plus heading forges VERIFIED); r2 46eeb56d neutralizes it; core 4982; opus re-review 21:42Z. opus APPROVE r2 46eeb56d (injection repro stays on one inline-code line; backticks neutralized; key omitted when absent); merged; seal+budget 23/0. Released in v10.5.2 (merge 4792e911 is an ancestor of v10.5.2). |
-| E-121 | Pulse ID_RE and DEPENDS_ON_ID_RE reject ids with digits in the prefix (S41-01), so all 16 S41 rows are invisible to the building/ready counts and budgets; accept [A-Z]+[0-9]*-[0-9]+[a-z]? | scripts/v10-pulse.sh (id regexes only), tests/test-v10-pulse.sh | LOW | fixture: a building S41-01 row is counted and a "Depends on S41-06" is honored (red first) | released@2026-09-28T22:26Z | Source: 21:50Z pulse showed building=0 while S41-01, S41-02, S41-16 were building. Dispatched 21:51Z. Built f94ab0da (T52/T53 red first); Tech Lead APPROVE (full-match on cell 0 and Depends clause only); merged; test-v10-pulse.sh 149/0. Released in v10.5.3 (merge aecf6daa is an ancestor of v10.5.3). |
-| E-122 | Scorecard headline pair (loki on sonnet vs raw opus) is green on cost only at 0.5x raw or less, per D41; add the rule and a test | eval/loki10/scorecard, eval/loki10/test-scorecard.sh | LOW | fixture at 0.6x raw cost is red on the headline pair, 0.5x is green (red first) | released@2026-09-28T23:18Z | Source: S41-02 Tech Lead review note 5. Depends on S41-02. Dispatched 22:01Z. Built a4bc79b9 (0.6x headline red on the old script); Tech Lead APPROVE (label-matched pair, inclusive 0.5x, null stays red); merged; test-scorecard 27/0. Released in v10.5.5 (merge 901466ef is an ancestor of v10.5.5). |
-| E-123 | tests/test-security-scan-coverage.sh runs only in local-ci.sh, never in CI, so its .gitleaksignore baseline drifted unnoticed (6358e0a6); register it in tests/run-all-tests.sh and shard-durations so CI Tests run it | tests/run-all-tests.sh, tests/shard-durations.tsv | LOW | test-shard-coverage.sh lists it; the suite passes on main (31/0) | released@2026-09-28T23:18Z | Source: E-114 opus review item 4. Depends on E-114. Dispatched 22:01Z. Built fc3e17b1; Tech Lead APPROVE (self-contained text checks, rows match format); merged; scan-coverage 31/0, shard coverage 19/0. Released in v10.5.5 (merge a553be40 is an ancestor of v10.5.5). |
-| E-124 | verifyPreSealedWall cross-checks the carried oracle_normalizers_sha256 against the current oracle seal (today only cases and coverage hashes are checked) | loki-ts/src/engine10/modernize/presealed_wall.ts, its test | LOW | a Wall sealed against one normalizer hash fails verify after the oracle normalizers change (red first) | released@2026-09-28T23:18Z | Source: M-14 r3 opus review advisory. Dispatched 22:09Z. Released in v10.5.5 (merge 8a99554c is an ancestor of v10.5.5). |
-| E-125 | Wall red classification: real pytest prints collection-time AttributeError/NameError frames as "path.py:N: in <module>", not "File ...", so wall.ts never classifies them red (always not_run, fail-safe but the D42 red class cannot fire); parse both frame shapes and replace the B3 test fixtures with real pytest output | loki-ts/src/engine10/stages/wall.ts, loki-ts/tests/engine10/wall.test.ts | MEDIUM | a real pytest run (captured fixture) with an in-repo AttributeError classifies red; third-party frame stays not_run; core stays under 5000 | released@2026-09-30T21:23Z | Source: S41-16 r2 opus review (ran real pytest 9.0.2).  WIND-DOWN 2026-09-28: opus r1 REJECT (B1 owner of missing attribute, B2 space in frame path, B3 captured-stdout injection, B4 chained exception) fixed at 845c9231 on slice-E-125: classifies on the pytest short-summary ERROR line, requires module '<name>' has no attribute with <name> under the repo; wall.test.ts 26/0, r3-B1 to B4 red on e6d2ddec then green. Core 4,998 (cap 4,999). Full engine10 suite not re-run after r3. NEXT: run tests/engine10 plus seal and budget, then opus r2 review, then merge. Released in v10.5.11 (merge 191fdc5b is an ancestor of v10.5.11). |
-| E-126 | D41 item 3: repo memory, record the verified build and test command, flaky list and failure causes per repo, cold vs warm | loki-ts/src/e10ext/repomemory.ts, loki-ts/tests/e10ext/repomemory.test.ts | MEDIUM | cd loki-ts and bun test tests/e10ext/repomemory.test.ts | released@2026-09-30T18:50Z | Source: D41 item 3, SCORECARD-PLAN section 7. Evidence: engine10/cache.ts:87 recordFlaky and :108 topFailures exist, the verified command is not captured. Data only per D42. Released in v10.5.7 (merge fab5d59e is an ancestor of v10.5.7). |
-| E-127 | D41 item 5 (backlog throughput): fetch N issues for a label or milestone as pure data | loki-ts/src/e10ext/issues.ts, loki-ts/tests/e10ext/issues.test.ts | MEDIUM | cd loki-ts and bun test tests/e10ext/issues.test.ts | released@2026-09-30T18:50Z | Source: D41 item 5. Evidence: engine10/fetch_issue.ts:35 takes one ref only. Released in v10.5.7 (merge 0c6fa258 is an ancestor of v10.5.7). |
-| E-128 | BACKLOG 147: P7 scanner misses a useMemo factory that calls an already-registered fabricator instead of returning a literal | tests/moat/p7-no-fabricated-data.sh | HIGH | bash tests/moat/p7-no-fabricated-data.sh | released@2026-09-30T18:50Z | Source: BACKLOG 147; the file's own comment at p7-no-fabricated-data.sh:987 names the gap. Same file as E-131: one engineer takes both. Released in v10.5.7 (merge 8a4e1510 is an ancestor of v10.5.7). |
-| E-129 | BACKLOG 117 remainder: WhatsNew.tsx hardcodes a stale CURRENT_VERSION (9.55.0) that drifts from the shipped release | web-app/src/components/WhatsNew.tsx, tests/test-whatsnew-version-sync.sh | LOW | bash tests/test-whatsnew-version-sync.sh | released@2026-09-30T18:50Z | Source: BACKLOG 117. Evidence: WhatsNew.tsx:5 against VERSION 10.5.3. Released in v10.5.7 (merge 0c9daffc is an ancestor of v10.5.7). |
-| E-130 | D41 item 4 (speed): cache dependency install by lockfile hash in the bash parallel-worktree bootstrap | autonomy/run.sh (create_worktree only), tests/test-worktree-install-cache.sh | MEDIUM | bash tests/test-worktree-install-cache.sh | released@2026-09-30T18:50Z | Source: D41 item 4. Evidence: run.sh:6298-6304 installs unconditionally on every worktree. Released in v10.5.7 (merge 17af0439 is an ancestor of v10.5.7). |
-| E-131 | BACKLOG 146: P7 sink regex misses a computed or bracket-indexed sink name, for example window[sinkName](rows) | tests/moat/p7-no-fabricated-data.sh | HIGH | bash tests/moat/p7-no-fabricated-data.sh | released@2026-10-16T00:49Z | Source: BACKLOG 146. Evidence: SETTER regex at p7-no-fabricated-data.sh:771 matches only literal names. Same engineer as E-128. |
-| E-132 | Wall classifier: a missing test runner (python -m pytest exits 1 with No module named pytest) reads as red, not not_run; D42 red requires the runner to start and at least one test to fail, so require a pytest summary line with failed before red | loki-ts/src/engine10/stages/wall.ts, loki-ts/tests/engine10/wall.test.ts | HIGH | cd loki-ts and bun test tests/engine10/wall.test.ts with a pytest-less python first on PATH | released@2026-10-16T00:49Z | Source: main red on 04d3ac9c and 708c2907 (CI Bun job had no pytest); reproduced locally with a pytest-less venv, tests (3b) and (4) read fail 1. Seal still refuses later (not_run), so no false VERIFIED, but the Wall mis-seals. Coordinate with E-125 (same classifier). Core budget binds. |
-| E-133 | release.sh guard: refuse to commit dist maps that contain an absolute path (a node_modules symlink in a release worktree wrote 133 /Users paths into loki.js.map and one into cockpit.js.map at v10.5.4) | scripts/release.sh, tests/test-release-dist-guard.sh | MEDIUM | bash tests/test-release-dist-guard.sh | released@2026-09-30T18:50Z | Source: v10.5.4 cut 2026-09-28, caught by hand before commit (paths rewritten to ../node_modules/). Guard: grep the dist maps for an absolute or home-directory path after the bump and exit nonzero. Released in v10.5.7 (merge 53918a30 is an ancestor of v10.5.7). |
-| E-134 | spawn_env_fsmonitor.test.ts positive control fails on Bun 1.4.2 (Nightly red 2026-09-29 and 09-30, both OSes): Bun no longer inherits the START env for a spawn with no env option, so the bare control call stops leaking the canary and the test proves nothing there. Keep the product assertions unconditional; add a control that passes the canary explicitly so the hook is proven to record env on any Bun; report which inheritance mode the running Bun has | loki-ts/tests/runner/spawn_env_fsmonitor.test.ts | HIGH | cd loki-ts and bun test tests/runner/spawn_env_fsmonitor.test.ts on Bun 1.3.13 and on latest | released@2026-09-30T18:50Z | Source: Nightly run 36719756873 job 109901555421 (bun-v1.4.2): control record held the withheld sentinel, not the canary. Product calls still did not leak. Security guard, opus review. Released in v10.5.7 (merge f0ba0d4d is an ancestor of v10.5.7). |
-| E-135 | Post-Release Smoke PyPI install gives up after about 10.5 min (6 attempts, 30s steps) while the published version is still propagating; v10.5.5 failed this way though PyPI now has it. Add --no-cache-dir and widen the window | .github/workflows/post-release-smoke.yml | LOW | bash -n on the step script; a rerun of the smoke on the next release | released@2026-09-30T18:50Z | Source: Post-Release Smoke run 36497082408 job 109179083720 (FATAL loki-mode-sdk==10.5.5 not installable after retries); PyPI shows 10.5.5 on 2026-09-30. Rerun of the failed jobs requested. Released in v10.5.7 (merge 1d4975a1 is an ancestor of v10.5.7). |
-| E-136 | measure-size.py counts any touched non-test .py file, so a docstring-only or typing-only second file makes a one-file fix read as medium (click-3449 utils.py, marshmallow-2170, pluggy-442); count only files whose change alters code, not comments or docstrings | eval/loki10/measure-size.py, its test | MEDIUM | the measure-size self test plus a fixture diff with a docstring-only second file reading small | released@2026-09-30T18:50Z | Source: S41-20a opus review 2026-09-30 (criterion 7 cannot stand in for criterion 1). Use the Python ast module to compare function bodies with docstrings stripped. Released in v10.5.7 (merge d116c91b is an ancestor of v10.5.7). |
-| E-137 | S41-18 interrupt test (legA in eval/loki10/test-scorecard-run.sh) leaks an orphaned run.sh plus harness.py (tasks rt1,rt2) when the run is torn down: two groups found reparented to PID 1 after 18 and 32 min on 2026-09-30, from a removed worktree and a reviewer probe dir | eval/loki10/test-scorecard-run.sh | MEDIUM | bash eval/loki10/test-scorecard-run.sh twice, then no run.sh or harness.py with --tasks rt1,rt2 remains | released@2026-09-30T19:22Z | Source: pulse Orphan worktree/run.sh processes 2 at 17:30Z; PIDs 56770/56781 and 96302/96310 stopped by literal PID after inspection (the python harness ignored SIGTERM). Fix: trap EXIT in the test that stops the recorded group, and assert no survivors. Released in v10.5.8 (merge 030cd521 is an ancestor of v10.5.8). |
-| E-138 | P7 scanner misses optional-call sinks and one-hop aliasing: setRows?.([...]), window[k]?.(rows), const s = setRows; s(rows), and a memo or local that forwards a fabricator result; accept an optional ?. before the call in the three sink heads and follow one alias hop | tests/moat/p7-no-fabricated-data.sh | HIGH | bash tests/moat/p7-no-fabricated-data.sh with red and green fixtures per form | parked@2026-09-30T20:04Z | Source: E-128/E-131 opus review 2026-09-30 (lines 776, 1067, 1172 use a (?=[(<]) or \s*\( lookahead); pre-existing at base, not opened by E-131. PARKED 20:05Z by the adoption directive (docs/v10/PROGRESS.md 20:05Z); resumes after Tier 0 is green. |
-| E-139 | spawn_env_fsmonitor.test.ts follow-ups from E-134 review: comments at lines 16-17 and 114 overstate Bun 1.4.2 (Bun.spawn and Bun.spawnSync with no env still inherit the START env; only node:child_process inherits current), name spawn_env_guard.test.ts as the guard for them; line 94 driver should run process.execPath, not the bun on PATH | loki-ts/tests/runner/spawn_env_fsmonitor.test.ts | LOW | cd loki-ts and bun test tests/runner/spawn_env_fsmonitor.test.ts | released@2026-09-30T23:00Z | Source: E-134 opus review 2026-09-30 (probe: Bun.spawn on 1.4.2 printed START env). |
-| E-140 | Something deletes run-owned loki-run.* directories under TMPDIR while another agent is using them (an opus reviewer's dir and its Bun 1.4.2 binary vanished mid-review on 2026-09-30; unfamiliar dirs with e10ext subdirs appeared inside). Find the sweeper (a test cleanup, a trap, or a script removing loki-run.* by pattern) and make it remove only its own validated dir | the offending script or test (to locate), plus a guard test | HIGH | a guard that plants two run-owned dirs and runs the suspected cleanup, asserting the foreign one survives | released@2026-09-30T19:22Z | Source: E-134 opus review cleanup note 2026-09-30. CLAUDE.md forbids sweeping TMPDIR by pattern. Released in v10.5.8 (merge 98eadf90 is an ancestor of v10.5.8). |
-| E-141 | treeswap passes an explicit env to its git spawns (spawn_env_guard, BACKLOG 149) | loki-ts/src/e10ext/treeswap.ts and its test | MEDIUM | bun test tests/e10ext | released@2026-09-30T18:50Z | Merged c2305c99 via 0bf98fd0. S41-13 binding note records the scrubbed-env requirement. Released in v10.5.7 (merge 0bf98fd0 is an ancestor of v10.5.7). |
-| E-142 | D44-C follow-ups: structural-checks changed_chars diffs against the merge-base (committed dashes/emoji caught), typecheck prints SKIP without node_modules, register test-v10-ops.sh and fix the IGNORE comment (slow, not hanging) | scripts/structural-checks.sh, tests/test-structural-checks.sh, tests/test-registration-coverage.sh, tests/run-all-tests.sh, tests/shard-durations.tsv | LOW | bash tests/test-structural-checks.sh; each check under 10s | released@2026-10-16T00:49Z | Source: D44-C TL review (APPROVE with notes). |
-| E-143 | Follow-ups from E-87/E-140 reviews: pin audit_verdict created_at tie-to-failure with a test; test-no-tmp-sweep static scan also flags find -delete and find -exec rm shapes; move hardcoded /tmp fixtures (test-stop-process-group, test-audit-chain-cross-file, test-memory-cli, test-lsp-diagnostics-regression, test-watch-command, test-provider-source-cli, test-issue-providers) under loki_run_tmp_create | tests/test_release_required_ci.py, tests/test-no-tmp-sweep.sh, the listed tests | LOW | each named suite passes; a tie fixture expects rc 1 | released@2026-10-16T00:49Z | Source: E-87 and E-140 TL reviews (both APPROVE). |
-| E-144 | tests/test-v10-ops.sh hardcodes the live docs/v10/BOARD.md path (line ~589) and md5-checks it, so a concurrent board edit fails it and it breaks the no-home-path rule; point it at a fixture copy under a run-owned temp dir | tests/test-v10-ops.sh | LOW | bash tests/test-v10-ops.sh rc=0 while BOARD.md is edited concurrently; tests/test-no-hardcoded-paths.sh | released@2026-09-30T19:46Z | Source: E-142 TL review (v10-ops failed 2 checks once on a live board edit, passed on rerun). Released in v10.5.9 (merge 86e11caf is an ancestor of v10.5.9). |
-| E-145 | tests/test-watch-command.sh leaves an orphaned run.sh (bash /tmp/loki-run-*.sh .../test-once/prd.md, reparented to launchd, sleep 300 loop) when the suite is killed by a timeout; two found and stopped by literal PID at 18:44Z (40 and 30 min old). Trap EXIT/TERM in the suite to stop its own recorded child PIDs, and move its /tmp paths under loki_run_tmp_create | tests/test-watch-command.sh | LOW | kill the suite with timeout 20; no orphan survives (check by recorded PID) | released@2026-10-16T00:49Z | Source: pulse ORPHAN_WORKTREE twice. Coordinate with E-143 (same file, /tmp fixture move). |
-| E-146 | structural-checks follow-ups from E-142 review: print a stderr warning when no base ref resolves (today it silently scans only the working tree, so committed violations pass); the added-line pattern ^\+[^+] skips an added line whose content starts with +; drop the unused SC variable in tests/test-structural-checks.sh:9 (SC2034) | scripts/structural-checks.sh, tests/test-structural-checks.sh | LOW | test cases for no-base-ref warning and a ++ added line, red first | released@2026-10-16T00:49Z | Source: E-142 TL review (APPROVE with notes). |
-| E-147 | tests/test-trust-core-probe-isolation.sh:37 wraps tests/test-trust-core-tests-detect.sh in `timeout 50`; on a loaded CI runner it hit rc=124 after all 9 visible cases passed (main Tests run 36760845105, shard 3/8, SHA 2b0d2e4d; the same SHA passed on train/4 run 36760063079). Measure the inner suite on CI, set the budget from the measurement with margin, and report the case that was running at the kill so a real hang still fails loudly | tests/test-trust-core-probe-isolation.sh, tests/shard-durations.tsv if its row changes | LOW | inner suite under a 3x load stressor passes; a planted hang still fails with the case name | released@2026-09-30T19:22Z | Source: D44 MAIN_RED on 2b0d2e4d (timeout flake). Rerun of the failed job in flight. Released in v10.5.8 (merge 2b0d2e4d is an ancestor of v10.5.8). |
-| E-148 | Review follow-ups: test-stop-process-group.sh still kills by `pkill -f "loki-$PGTEST_TAG"` (pattern kill, forbidden by CLAUDE.md): replace with recorded PIDs or a process-group kill; test-audit-chain-cross-file.sh test 1 reads the real ~/.loki/dashboard/audit (fails on hosts with old tampered data): make it hermetic; E-147 timeout message says "after all cases passed" when there was zero output: say "no PASS output (possible hang before the first case)" | tests/test-stop-process-group.sh, tests/test-audit-chain-cross-file.sh, tests/test-trust-core-probe-isolation.sh | LOW | each suite passes on a host with a tampered ~/.loki audit file; no pkill -f remains | released@2026-10-16T00:49Z | Source: E-143 and E-147 TL reviews (APPROVE with notes). |
-| E-149 | loki-ts/tests/engine10/modernize/java_capture.test.ts "unitClassesFromGraph (M-04 integration)" times out at bun's 5s default under CI load (5169ms, Coverage run 36764748814 on train/5 1cd5feac; also failed on train/2 and in a local full run): measure, make it cheaper or set an explicit measured timeout; sweep modernize tests over 2.5s | loki-ts/tests/engine10/modernize/*.test.ts | LOW | before/after durations under 3x load; bun test tests/engine10/modernize 0 fail | released@2026-09-30T20:08Z | Source: D44 train/5 red (Coverage). Rerun of the failed job in flight. Released in v10.5.10 (merge 2394dc4a is an ancestor of v10.5.10). |
-| E-151 | Release blocker guard: v10.5.10 (69ebc03e) shipped loki-ts/dist/loki.js.map stale because the bump changed it (version literal 10.5.9 to 10.5.10 changed length, shifting mappings) and the release commit staged a fixed file list. scripts/release.sh --bump-only should print every file it changed (including dist maps), and a check (in release.sh or a pre-push rule for "release: v*" commits) should refuse a release commit that leaves a stamped tracked file modified in the worktree | scripts/release.sh, tests/test-release-dist-guard.sh | LOW | fixture: a bump that changes the map, commit without it, check refuses; with it, passes | released@2026-09-30T21:23Z | Source: v10.5.10 release; interim procedure: assert `git status --porcelain` is empty after the release commit before pushing. Map corrected on the next train. Released in v10.5.11 (merge bd5834a9 is an ancestor of v10.5.11). |
-| E-152 | release.sh --bump-only "stage these files:" list must print a copy-paste command that works: loki-ts/dist is gitignored, so `git add loki-ts/dist/loki.js` refuses (seen 19:58Z on train/7); print `git add -f` for paths under an ignored directory (git check-ignore) and plain `git add` otherwise | scripts/release.sh, tests/test-release-dist-guard.sh | LOW | fixture with an ignored-but-tracked dist file: the printed command stages it | released@2026-10-01T06:40Z | Source: first live use of E-151 --check-clean caught the unstaged dist (rc=1). |
-| E-153 | Incident 20:16Z: a reviewer's fixture setup ran `git commit` with the MAIN CHECKOUT as cwd, committing author `t <t@t>` "init" that replaced the real package.json with a fixture and added sum.js/sum.test.js (local only, never pushed; undone with `git reset --keep 1c96ab16`). Guard: a pre-commit hook in .githooks refusing any commit in this repository whose author email is not the repo-local identity (git config user.email) unless LOKI_ALLOW_FOREIGN_AUTHOR=1, so fixture commits made in the wrong cwd fail loudly; fixture commits in real temp repos are unaffected | .githooks/pre-commit, tests/test-pre-commit-author-guard.sh | LOW | red first: in a scratch clone with the hook installed, `git -c user.email=t@t commit` is refused; the repo identity commits | released@2026-10-16T00:49Z | Source: loki-seal r2 review fixture (agent stopped at 20:17Z). Reviewer prompts now require `git -C "$FIXTURE"` and a pwd check under LOKI_RUN_TMP. |
-| S41-10b | Static-first fixed-rules block for the implement and fix briefs (S41-10 card remainder): a byte-identical rules block in the cache-stable prefix, per-task context after it; drive-letter and ~ plan paths filtered like absolute ones | loki-ts/src/engine10/stages/implement.ts, fix.ts (prefix only), loki-ts/src/e10ext/context.ts and tests | MEDIUM | red first: two different tasks produce byte-identical prefix bytes; core net-zero lines | released@2026-10-16T00:49Z | Source: S41-10 reviews (APPROVE r2, remainder). |
-| S41-20h | Medium-task MINING pass (no task building): shortlist 12 candidate merged PRs whose shape survives the one-file probe (a semantic or signature change in file A that an independently tested caller in file B must match; not helper extraction, parameter threading, moved classes or typing-only files), each with a written one-file-fix attempt run against the upstream tests and its result | eval/loki10/tasks/CANDIDATES.md (new) | MEDIUM | every shortlisted PR has a failing one-file attempt recorded with command and rc | released@2026-10-16T00:49Z | Source: S41-20b/c/d/e/f: 11 of 16 candidates fell to a reviewer one-file fix; S41-20f built 0. |
-| D44-A | Green main by construction: scripts/train-promote.sh fast-forwards main only to a train SHA with green Tests, Bun Parity and Coverage; pre-push refuses a push to main unless it is Tier B green, a VERSION-only bump on a green parent, or docs-only (LOKI_D44_EMERGENCY override logged) | scripts/train-promote.sh, .githooks/pre-push, tests/test-train-promote.sh, docs/v10/TRAINS.md | HIGH | bash tests/test-train-promote.sh | parked@2026-09-30T20:04Z | Source: D44 item 1. PARKED 20:05Z by the adoption directive (docs/v10/PROGRESS.md 20:05Z); resumes after Tier 0 is green. |
-| D44-B | Pulse RELEASE_CADENCE (green unreleased main commit older than 20 min) and MAIN_RED_BY_MERGE; hourly releases per hour into METRICS.md | scripts/v10-pulse.sh, scripts/metrics-releases-append.py, pulse tests | MEDIUM | the pulse test file plus the metrics script self-test | parked@2026-10-03T09:21Z | drift audit 09:22Z: building since 2026-09-30 with no live builder or commit; parked, re-slice if still wanted |
-| D44-C | Structural checks under 10 s each (shard rows, hardcoded paths, registration, doc drift, line budgets) as scripts/structural-checks.sh, run first in Tier A (also on train/** push) and in the local-ci fast tier | scripts/structural-checks.sh, .github/workflows/tier-a.yml, scripts/local-ci.sh, tests/test-structural-checks.sh | MEDIUM | bash tests/test-structural-checks.sh | released@2026-10-17T03:50Z | Source: D44 item 3; four red mains on 2026-09-30. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| S41-20d | Medium tier growth batch d: 4 new tasks from unused repos under the 2026-09-30 opus criteria (2 behavioral files, not fixed at ref, wrong-fix rejected, solvable from issue, refdiff, provenance) | eval/loki10/tasks/pub-* (new), refdiff, INDEX.md | HIGH | measure-size rc 0 and validate rc 0 on the new tasks | rejected@2026-09-30T18:49Z | Source: D43 item 2 (medium at 12 of 20). |
-| S41-20e | Medium tier growth batch e: 4 more tasks, repos disjoint from S41-20d | eval/loki10/tasks/pub-* (new), refdiff, INDEX.md | HIGH | as S41-20d | released@2026-09-30T19:22Z | Source: D43 item 2. Released in v10.5.8 (merge 5cdbdc7b is an ancestor of v10.5.8). |
-| S41-16 | P0: Wall red-on-base is vacuous without python (launch error counted as failed on base) | see docs/v10/SCORECARD-PLAN.md | HIGH | per SCORECARD-PLAN.md card | released@2026-09-28T23:18Z | Source: D41, Architect plan 7f671f5c. Depends on D42. D42 (3) confirmed P0; merges before any wave-1 card touching wall, verify or Seal. Dispatched 21:42Z. r1 55e427ab opus REJECT: not_run never reaches seal (seal.ts:117 ignores not_run, so pass 1 fail 0 not_run 1 seals ALREADY_SATISFIED: a new false verdict); jest/vitest/bun non-zero exit without a parsed count read as red; AttributeError/NameError anywhere counted as repo red; system-interpreter results must be not_run. r2 dispatched 21:58Z. r2 d5bb05bd (seal refuses not_run; per-runner red rules; traceback path under repo; system interpreter not_run); core 4997; opus re-review 22:10Z. opus APPROVE r2 d5bb05bd (seal refuses not_run: real-seal test; receipts byte-stable when not_run 0; per-runner red rules; system interpreter not_run). Merged, dist rebuilt. Follow-up E-125. Released in v10.5.5 (merge 8788d54d is an ancestor of v10.5.5). |
-| S41-01 | Harness: accept partial-stream cost, allowlist LOKI_E10_CASCADE, new row fields | see docs/v10/SCORECARD-PLAN.md | HIGH | per SCORECARD-PLAN.md card | released@2026-09-30T18:50Z | Source: D41, Architect plan 7f671f5c. Depends on none. Dispatched 21:41Z.  WIND-DOWN 2026-09-28: built at 68d1fc28 on slice-S41-01 (test-harness.sh 126/0; red vs its merge-base 0fe549a0 119/7, the 7 S41-01 legs; positive control provider_cost on e98f default-r1 pub-werkzeug-3121 gives 0.37101 with partial 0.0628). Sonnet TL APPROVE on content (af2109d7): partial-stream cost, never-silently-0, 7-knob allowlist, row fields, repriced files beside untouched originals. The 2 nocascade nulls are killed sessions with no partial-usage file and must stay null (E-98e engine gap). NOT MERGED: (1) rebase onto main conflicts in harness.py V10_ENGINE_ENV_ALLOWLIST (S41-09 and S41-11 added LOKI_E10_PREFIX and LOKI_E10_TRIM), keep one of each and rerun test-harness.sh; (2) SCORECARD-PLAN tags the card HIGH, so D12 needs an opus review before merge (this row said MEDIUM). WEDNESDAY STEP 1. Released in v10.5.7 (merge 9e815035 is an ancestor of v10.5.7). |
-| S41-02 | Scorecard tool: per-tier completion, cost per completed, p50, raw vs loki, into METRICS.md | see docs/v10/SCORECARD-PLAN.md | LOW | per SCORECARD-PLAN.md card | released@2026-09-28T22:26Z | Source: D41, Architect plan 7f671f5c. Depends on none. Dispatched 21:41Z. Built 42c0d88d (21/0; null-cost mutation flips n/a red to green, caught); replay reproduces E-98f exactly; EV-15 medium red on all 3 columns. Tech Lead review 21:51Z. Tech Lead APPROVE (definitions match section 2; replayed all 3 E-98f arms exactly). Merged. Released in v10.5.3 (merge a4cdb78f is an ancestor of v10.5.3). |
-| S41-03 | Arm runner for raw sonnet, raw opus, loki on sonnet (LOKI_EVAL_MODEL) plus OAuth auth guard | see docs/v10/SCORECARD-PLAN.md | MEDIUM | per SCORECARD-PLAN.md card | released@2026-09-28T23:18Z | Source: D41, Architect plan 7f671f5c. Depends on none. Dispatched 21:51Z. Built de741f04 (dry-run for 3 arms; red evidence only proved file existence); Tech Lead review 22:00Z checks the auth guard decision itself. Tech Lead APPROVE de741f04 (guard branches exercised with stubbed security/claude: near-expiry refresh, unreadable keychain, refresh failure; no token output; LOKI_EVAL_MODEL honored by both arms; mid-batch stop keeps prior results); merged; 7/7. Released in v10.5.5 (merge f76810ec is an ancestor of v10.5.5). |
-| S41-04 | First-turn prefix measurement (tokens by type per stage) | see docs/v10/SCORECARD-PLAN.md | LOW | per SCORECARD-PLAN.md card | released@2026-09-28T22:26Z | Source: D41, Architect plan 7f671f5c. Depends on none. Dispatched 21:51Z. Built 71a0d28d; Tech Lead APPROVE (implement row re-derived from 58 impl.json files: mean 982,144, p50 654,959 cache_read, exact); merged. Implement is the re-reading hotspot (982K cache read per task vs 45-68K for intake, plan, Wall). Released in v10.5.3 (merge 926c0371 is an ancestor of v10.5.3). |
-| S41-05 | Attempt-selection rule (pure function in e10ext/select.ts) | see docs/v10/SCORECARD-PLAN.md | HIGH | per SCORECARD-PLAN.md card | released@2026-09-30T18:50Z | Source: D41, Architect plan 7f671f5c. Depends on D42.   WIND-DOWN 2026-09-28: opus r2 REJECT (R1 Wall outside S uncounted, R2 key swaps 2-3 and 5-6 survived, R3 multi-line import passed fence) addressed at 34c44c99 on slice-S41-05 (50/0): R1 done red then green incl. M1'; R3, E3, require() done. LEFT: R2 pair tests 2-3, 4-5, 5-6, 6-7 are written and green but their mutation red-proof was not re-run. NEXT: run those 4 swap mutations, then opus r3 review. Released in v10.5.7 (merge f97079b8 is an ancestor of v10.5.7). |
-| S41-12 | Tree swap helper for parallel attempts | see docs/v10/SCORECARD-PLAN.md | HIGH | per SCORECARD-PLAN.md card | released@2026-09-30T18:50Z | Source: D41, Architect plan 7f671f5c. Depends on D42.  WIND-DOWN 2026-09-28: opus REJECT at 7a3fbe53, 5 blocking, all reproduced: B1 resetToBase deletes user untracked files on a successful swap (treeswap.ts:240-243); B2 symlinked attempts dir lets cleanup delete the primary (:301, :312-314); B3 type-changed path (T status) never reset (:228-229); B4 segment-anywhere excludes drop winner changes under src/venv (:109-113 vs :65); B5 base .gitignore restored before listing untracked deletes an ignored .env (:231, :240). Non-blocking N1 to N4 (index rewrite, undo not persisted, .git symlink, O_NOFOLLOW). Resume from branch slice-S41-12. Released in v10.5.7 (merge b8f269b7 is an ancestor of v10.5.7). |
-| S41-06 | Baseline scorecard (eval only) on small and medium, all arms | see docs/v10/SCORECARD-PLAN.md | HIGH | per SCORECARD-PLAN.md card | ready@2026-09-28T21:41Z | Source: D41, Architect plan 7f671f5c. Depends on S41-01, S41-02, S41-03, S41-04. |
-| S41-07 | Plan on the cheap model | see docs/v10/SCORECARD-PLAN.md | MEDIUM | per SCORECARD-PLAN.md card | ready@2026-09-28T21:41Z | Source: D41, Architect plan 7f671f5c. Depends on S41-06. |
-| S41-08 | Top model and deterministic-failure escalation | see docs/v10/SCORECARD-PLAN.md | HIGH | per SCORECARD-PLAN.md card | ready@2026-09-28T21:41Z | Source: D41, Architect plan 7f671f5c. Depends on S41-06. |
-| S41-09 | Lean stable prefix (flag) | see docs/v10/SCORECARD-PLAN.md | MEDIUM | per SCORECARD-PLAN.md card | released@2026-09-28T23:18Z | Source: D41, Architect plan 7f671f5c. Depends on S41-04. Dispatched 22:01Z. Released in v10.5.5 (merge ebb16a62 is an ancestor of v10.5.5). |
-| S41-14 | Wall in parallel with implement (item 4, target p50 not worse) | see docs/v10/SCORECARD-PLAN.md | HIGH | per SCORECARD-PLAN.md card | parked@2026-09-28T21:42Z | Source: D41, Architect plan 7f671f5c. Depends on D42, S41-16. D42 (2): deferred; E-98f shows no speed win (Wall-off p50 214s vs 209s) and it touches the moat. Reopen only if Wall is at least 15% of p50, with the Wall sealed and proven red on a clean base before any implement diff. |
-| S41-10 | Relevant context and a static-first brief | see docs/v10/SCORECARD-PLAN.md | MEDIUM | per SCORECARD-PLAN.md card | released@2026-09-30T19:46Z | Source: D41, Architect plan 7f671f5c. Depends on S41-09. TL r1 REJECT: empty brief when plan has no relevant_files and selection matches nothing; rework adds a capped head fallback, drops absolute or .. plan paths, quotes test paths. Released in v10.5.9 (merge 635f5488 is an ancestor of v10.5.9). |
-| S41-11 | Rule-based trajectory trimming (flag) | see docs/v10/SCORECARD-PLAN.md | MEDIUM | per SCORECARD-PLAN.md card | released@2026-09-30T18:50Z | Source: D41, Architect plan 7f671f5c. Depends on S41-09.  WIND-DOWN 2026-09-28: built at 8aafe341 on slice-S41-11 (trim.ts plus providers.ts wiring, 35/0; SDK exposes no Bash exit code to PostToolUse, sdk.d.ts:2677, so nonzero-exit uses a fail-safe heuristic). NEXT: TL review, then merge (rebase onto main: providers.ts and harness.py also changed). Released in v10.5.7 (merge 5e8c0eb2 is an ancestor of v10.5.7). |
-| S41-13 | Two parallel attempts for medium and large (flag) | see docs/v10/SCORECARD-PLAN.md | HIGH | per SCORECARD-PLAN.md card | ready@2026-09-28T21:41Z | Source: D41, Architect plan 7f671f5c. Depends on S41-05, S41-12. BINDING (E-141 opus review 2026-09-30): treeswap passes { ...process.env } to its git calls, so its caller must run where process.env is already scrubbed. engine10/supervisor.ts:200-201 scrubs only a workerEnv copy; if S41-13 calls treeswap from the supervisor it must pass the scrubbed env in as a parameter or run withholdGithubTokens on a copy inside treeswap, and its reviewer must check this. Drift audit 13:12Z: the card also depends on S41-08 (needs S41-06, eval-only, real-model leg parked) and S41-10; not dispatchable. |
-| S41-15 | After-scorecard and defaults (flip only when green on small and medium) | see docs/v10/SCORECARD-PLAN.md | HIGH | per SCORECARD-PLAN.md card | ready@2026-09-28T21:41Z | Source: D41, Architect plan 7f671f5c. Depends on S41-13, S41-10, S41-11. |
-| S41-17 | Scorecard 95% intervals: bootstrap (seeded, 10000 resamples, per-task clustered over reps) CIs on completion, cost per completed and p50 for each arm and for the Loki minus raw difference; a mark is green or red only when the difference CI excludes 0, else inconclusive, and inconclusive blocks the tier verdict | eval/loki10/scorecard, eval/loki10/test-scorecard.sh | HIGH | bash eval/loki10/test-scorecard.sh | released@2026-09-30T18:50Z | Source: D43 item 2. Deterministic seed; a fixture where arms differ by noise only must read inconclusive, a clear gap must read green or red. Stdlib only.  WIND-DOWN 2026-09-28: built at f3f1d985 on slice-S41-17 (test-scorecard.sh 43/43; new cases a to e are 27 pass 16 fail on the old scorecard). Seeded (41) 10000-resample percentile bootstrap clustered by task; marks need the difference CI strictly outside 0; headline cost uses the ratio against 0.5; over 2.5 percent undefined replicates downgrades to inconclusive. Not benchmarked at real-eval scale. NEXT: opus review (HIGH, flip gate), then merge. Released in v10.5.7 (merge 446a1c7f is an ancestor of v10.5.7). |
-| S41-18 | scorecard-run.sh resume: before each arm and rep, read that rep's --out file and pass the harness only tasks with no status ok row; a rerun after an interrupt or auth stop finishes the missing rows and never repeats done ones; auth_guard still runs before every rep | eval/loki10/scorecard-run.sh, eval/loki10/test-scorecard-run.sh | MEDIUM | bash eval/loki10/test-scorecard-run.sh | released@2026-09-30T18:50Z | Source: D43 item 4. Do not change auth_guard logic or harness.py (S41-01 owns it). Test with the stub arm: kill mid-rep, rerun, assert each task row appears exactly once per rep.  WIND-DOWN 2026-09-28: built at 66cc1882 on slice-S41-18 (scorecard-run.sh resume; test-scorecard-run.sh 11/11, legs a to d red on the old script then green). LEFT: leg (a) seeds via a clean run, not a real SIGTERM mid-rep; no assertion for a capped (timeout) row; missing_tasks tier filter does not fail loud on an invalid tier; an empty tier now exits 0 instead of erroring. NEXT: close those 4, then TL review. Released in v10.5.7 (merge cad4615f is an ancestor of v10.5.7). |
-| S41-19 | Stage wall-clock profile: derive per-stage seconds (intake, plan, wall, implement, verify, fix, seal) per run from the preserved E-98f engine10 journals, publish a per-arm p50 and p90 table in METRICS.md and name the slowest stage | eval/loki10/stage-profile.py, docs/v10/METRICS.md | MEDIUM | python3 eval/loki10/stage-profile.py --self-test | released@2026-09-30T18:50Z | Source: D43 item 3. Read only on run data. If the journals lack stage timestamps, say so with evidence and propose the minimal event field instead of guessing. The cut slice is cut from its result.  WIND-DOWN 2026-09-28: built at e06fa612 on slice-S41-19 (eval/loki10/stage-profile.py with --self-test, METRICS section over all 63 E-98f runs). Result: implement is 72.5 to 85.7 percent of wall-clock in every arm; wall is 23 to 29 percent and hits its own 90s timeout in 9/21 (default) and 11/21 (nocascade) runs, directly on the critical path, which clears D42 item 2's 15 percent revival bar for S41-14. NEXT: TL review and merge, then CTO call on reopening S41-14 (wall off the critical path) and an implement token/turn cut. Released in v10.5.7 (merge cf4360ed is an ancestor of v10.5.7). |
-| S41-20a | Medium tier growth, batch a: add 5 new pub-* medium tasks from pallets repos (click, flask, jinja, itsdangerous, markupsafe) meeting the D30 medium criteria in INDEX.md | eval/loki10/tasks/pub-* (new dirs only) | HIGH | measure-size.py and validate rc=0 on the new tasks; RED at base and GREEN with the merged upstream fix for each | released@2026-09-30T19:22Z | Source: D43 item 2 (medium to 20). Return the INDEX.md lines in the report, do not edit INDEX.md (merge appends). No task whose issue is already present.  WIND-DOWN 2026-09-28: 2 of 5 tasks built and self-verified at d8d8d41e on slice-S41-20a: pub-flask-6093 (fix flask#6096) and pub-click-3449 (fix click#3533), RED rc=1, GREEN rc=0, deletion mutant red, no-op baseline not completed; INDEX lines in the engineer report (not yet in INDEX.md). Stopped mid-screen: flask#5736 (asserts span 2 test files), flask#5526, itsdangerous#151. Rejected: click#2836 (emoji in issue body). NEXT: opus review of the 2 tasks, append INDEX lines, then resume the 3 candidates. Released in v10.5.8 (merge 03db8ab4 is an ancestor of v10.5.8). |
-| S41-20b | Medium tier growth, batch b: add 5 new pub-* medium tasks from attrs, more-itertools, packaging, humanize, faker meeting D30 | eval/loki10/tasks/pub-* (new dirs only) | HIGH | as S41-20a | released@2026-09-30T19:46Z | Source: D43 item 2. Same rules as S41-20a.  WIND-DOWN 2026-09-28: 3 of 5 tasks built at 881126a0 on slice-S41-20b: pub-attrs-1327 (fix attrs#1328), pub-packaging-1162 (fix packaging#1163, hidden test trimmed, pins pytest<9), pub-humanize-103 (fix humanize#110), each RED rc=1, GREEN rc=0, deletion mutant red; D30 no-op baseline NOT run for any. INDEX lines in the engineer report. Stopped: faker#2206 (fix #2211) venv installed, RED/GREEN not run. more-itertools has no 2-source-file fixes (rejected). NEXT: run the no-op baseline on the 3, opus review, append INDEX lines, then finish faker#2206. Released in v10.5.9 (merge a11addb6 is an ancestor of v10.5.9). |
-| S41-20c | Medium tier growth, batch c: add 5 new pub-* medium tasks from werkzeug, jsonschema, and other pure-Python repos with pytest suites (for example marshmallow, httpx, pluggy) meeting D30 | eval/loki10/tasks/pub-* (new dirs only) | HIGH | as S41-20a | rejected@2026-09-30T18:27Z | Source: D43 item 2. Same rules as S41-20a.  WIND-DOWN 2026-09-28: 1 of 5 tasks built at f6ea1d02 on slice-S41-20c: pub-httpx-2536 (fix httpx#2543; hidden test trimmed to test_url_query_encoding), RED 1 failed, GREEN 1 passed, deletion mutant red; D30 no-op baseline NOT run. Stopped: marshmallow#2170 (fix #2792, 3 source files) cloned only. jsonschema, pluggy, most httpx fixes are single-file (rejected); httpx#1850 needs Python below 3.13 (cgi). NEXT: no-op baseline, opus review, INDEX line, then marshmallow#2170. Medium tier after 20a/b/c: 7 plus 6 candidates = 13, still short of 20. |
-| E-98b | a spec_conflict implement exit still runs verify and fix; receipt keeps SPEC_CONFLICT | loki-ts/src/engine10/machine.ts, loki-ts/tests/engine10/machine*.test.ts | HIGH | fake-stage test red on main; core +3 max | released@2026-09-28T21:01Z | Source: MEDIUM-ANALYSIS.md. Dispatched 19:40Z sonnet; opus review. opus APPROVE 214b8dd2 (seal stays SPEC_CONFLICT through verify and fix; empty diff fails verify, no false pass); merged 97b80ca4; machine+budget 26/0. Released in v10.5.0 (merge 97b80ca4 is an ancestor of v10.5.0). |
-| E-98c | existing test files append-only in the implement brief; impactedTests falls back to named files when relevant_files is empty | loki-ts/src/engine10/stages/implement.ts, its test | MEDIUM | unit test red then green; core +2 max | released@2026-09-28T21:01Z | Source: MEDIUM-ANALYSIS.md. Dispatched 19:40Z sonnet. Tech Lead APPROVE b24f4da2; merged f4606246; implement+machine+budget 37/0. Released in v10.5.0 (merge f4606246 is an ancestor of v10.5.0). |
-| E-98d | repo map extracts Python top-level def and class names | loki-ts/src/engine10/repomap.ts, loki-ts/tests/engine10/repomap*.test.ts | MEDIUM | unit test red then green; core +4 max | released@2026-09-28T21:01Z | Source: MEDIUM-ANALYSIS.md. Dispatched 19:40Z sonnet. Offline 7-repo check runs after merge. Tech Lead APPROVE ba31cca4 plus async def fix a1e8dc4b; merged 15859bef; 41/0 across repomap, implement, machine, budget. Offline 4/7 repos rank the upstream file in the top 8 (was 0/7; card bar 5/7, keyword-tie ceiling). Released in v10.5.0 (merge 15859bef is an ancestor of v10.5.0). |
-| E-98e | a session killed at its stage limit writes a partial-stream cost record, never cost_usd null | loki-ts/src/engine10/session.ts, loki-ts/src/engine10/cost.ts, a test | MEDIUM | fake killed stream test red then green; core +10 max | released@2026-09-28T21:01Z | Source: MEDIUM-ANALYSIS.md. Dispatched 19:40Z sonnet. r1 blocked honestly (no per-message usage persisted before result; a fixture-only test would not be wired to a real killed session). Re-sized: sdk_stream_parser.ts running usage file plus session.ts pricing via calculateCostFromRecords; r2 dispatched 19:50Z. r2 86d7eea4: logic moved to runner/budget.ts, core -12; full bun test failure sets byte-identical to main (55 fail, 13 errors both, zero new). Tech Lead APPROVE (max-per-id dedupe test, result file wins, partial-usage- matches no result-cost- consumer, opus/sonnet priced by family). Merged 8b41ad40; 153/0 across cost, session, parser, budget, seal, verify; budget.test.ts passes again. Process note: the reviewer ran git checkout in the main checkout (read-only breach, tree restored clean). Released in v10.5.0 (merge 8b41ad40 is an ancestor of v10.5.0). |
-| E-98f | A/B eval of Wall and cascade on medium (default, WALL=0, CASCADE=0, n=3 each), then a sizing default only if a knob wins on completions without losing on cost | eval run; loki-ts/src/engine10/sizing.ts | HIGH | chosen default at or above raw 71.4% and below $0.5085 per completed; after table published in MEDIUM-ANALYSIS.md | released@2026-09-28T22:02Z | Source: MEDIUM-ANALYSIS.md. Depends on E-98a..e merged. One combined re-run replaces the per-card re-runs (D40 cost). Dispatched 20:20Z (sonnet eval runner): E-98a..e merged locally; default, WALL=0, CASCADE=0 arms at n=3 on the 7 medium tasks, raw baseline from EV-15. d3c906fa merged eca3e8ef. n=3 x 21: default 15/21 (71.4%) p50 209s; WALL=0 16/21 (76.2%) p50 214s; CASCADE=0 15/21 p50 138s. No arm has a clean cost (null rows 10/2/11: harness provider_cost rejects partial-stream). pytest not_run 0 in all arms; jinja-1413 9/9. No flip (bar 85.7% and $0.5085). Results ~/loki-ci-logs/eval/e98f-*. Released in v10.5.2 (merge eca3e8ef is an ancestor of v10.5.2). |
-| E-99 | E-86 follow-ups (opus non-blocking): scan every pushed commit with the pushed tip's .gitleaksignore (what CI does) so a self-suppressing line added and removed in one push is refused; unset GITLEAKS_CONFIG and GITLEAKS_CONFIG_TOML in the hook; refuse a .gitleaks.toml change in any push (not only eval-touching ones) without LOKI_ALLOW_GITLEAKS_CONFIG_CHANGE=1; pin the installed binary sha256 in the hook | .githooks/pre-push, tests/test-pre-push-gitleaks.sh | MEDIUM | real-push fixtures for each case, failing first | released@2026-09-28T21:01Z | Source: E-86 round-4 review C1-C3 and the forged-sidecar boundary. Opus APPROVE; merged 5ee5a630 (conflict with E-100 case 20 resolved: guard kept, E-99 message taken; gitleaks test 43/0 with binary, 19/0/24 skipped without; pre-push hook 13/0). Released in v10.5.0 (merge 5ee5a630 is an ancestor of v10.5.0). |
-| E-100 | P0: main Tests red on cc4992ed (run 36465466283): tests/test-pre-push-gitleaks.sh case 20 asserted a pass without the pinned gitleaks binary, which the CI runner does not have | tests/test-pre-push-gitleaks.sh | HIGH | `HOME=<empty> bash tests/test-pre-push-gitleaks.sh` 18 passed 0 failed 22 skipped; with the binary 40 passed | released@2026-09-28T21:01Z | Built 91a47f52; the class is guarded by E-94 (changed tests re-run with an empty HOME). Released in v10.5.0 (merge 0716ec41 is an ancestor of v10.5.0). |
-| E-101 | Eval results durable (D40 priority 4): run.sh and harness.py write results.jsonl to ~/loki-ci-logs/eval/<run> and a redacted copy to eval/loki10/archive/; scripts/prune-worktrees.sh never removes a worktree with a live process, a commit in the last 30 minutes, or un-archived eval results | eval/loki10/run.sh, eval/loki10/harness.py, scripts/prune-worktrees.sh, tests/test-eval-archive.sh, tests/test-prune-worktrees.sh | HIGH | fixtures: live-process and un-archived worktrees kept; a planted token never reaches the in-repo archive | released@2026-09-28T21:01Z | Source: EV-14 results lost 17:36Z. Supersedes E-96. Reviewer APPROVE bbe83c7a (mutation-checked all 3 prune checks and redact_row); merged 21df7d4a; prune-worktrees 26/0, eval-archive 5/0. Used at 19:40Z to prune 6 finished worktrees. Released in v10.5.0 (merge 21df7d4a is an ancestor of v10.5.0). |
-| E-102 | release.sh --bump-only must never leave a tree without its tracked dist: if the loki-ts build fails (for example no node_modules in a fresh worktree), exit non-zero and restore loki-ts/dist from HEAD; when the only source change is VERSION, patch the version literal in dist instead of rebuilding (no debugId or source-map path churn) | scripts/release.sh, tests/test-release-bump-dist.sh | MEDIUM | fixture: a worktree with no node_modules gives a non-zero exit with dist unchanged; a VERSION-only bump changes exactly the version literal in dist/loki.js | released@2026-09-28T21:01Z | Source: 19:20 cut of v10.3.1: in a fresh worktree the build failed (@anthropic-ai/sdk unresolved) and deleted 4 tracked dist files; a node_modules symlink then rewrote source-map paths. Shipped by hand-patching the version literal (d811e5c3). Tech Lead APPROVE c83a07e2; merged c35d3fa7; bump-dist 7/0 (red first 3/4), bump-only 8/0, release-sh 29/0, shard coverage 19/0, drift 6/0. Released in v10.5.0 (merge c35d3fa7 is an ancestor of v10.5.0). |
-| E-103 | release.sh --bump-only: when the build exits 0 but dist/loki.js does not embed the new version (release.sh:475-479), restore loki-ts/dist from HEAD and exit non-zero, as the build-failure path already does | scripts/release.sh, tests/test-release-bump-dist.sh | LOW | fixture: a stub build that exits 0 without writing the version gives a non-zero exit with dist byte-identical to HEAD | released@2026-09-28T21:01Z | Source: E-102 Tech Lead review (non-blocking note). Tech Lead APPROVE 1150af81 (shared release_bump_only_fail, no duplicated restore); bump-dist 10/0 (red 9/10 first), bump-only 8/0, release-sh 29/0. Released in v10.5.0 (merge cd3d3d26 is an ancestor of v10.5.0). |
-| E-104 | tests/test-verify.sh scenario 3 plants AKIAIOSFODNN7EXAMPLE, which gitleaks (8.30.1 on a dev Mac) allowlists as the AWS doc example, so the test goes VERIFIED/0 wherever gitleaks is installed and passes only where loki verify falls back to its regex scanner (CI). Plant a non-example secret shape and assert BLOCKED on both scanner paths | tests/test-verify.sh | LOW | run with gitleaks on PATH and with PATH stripped of it: BLOCKED/2 both ways | released@2026-09-28T21:01Z | Source: 19:40 train fast tier: FAIL planted secret -> expected BLOCKED/2, got VERIFIED/0, reproduced on origin/main (CI green there). Env-conditional assertion class. Dispatched 19:56Z sonnet. Tech Lead APPROVE 4df867d2 (runtime-built key, gitleaks dir clean); merged f6b4865e; test-verify.sh 25/0 with gitleaks on PATH (was 24/1). Released in v10.5.0 (merge f6b4865e is an ancestor of v10.5.0). |
-| E-105 | tests/check-heredoc-dollar-digit.sh flags autonomy/run.sh:5548 (`local _var="$1" _had="$2" _val="$3"`), a function body, not a python3 -c body: false positive that keeps the fast tier red on main | tests/check-heredoc-dollar-digit.sh | LOW | the run.sh:5548 shape passes; a real $1 inside python3 -c "..." still fails (red first) | released@2026-09-28T21:01Z | Source: 19:40 train fast tier; line unchanged for 27h, identical on origin/main. Dispatched 19:56Z sonnet. Tech Lead APPROVE 685a9dd6 (closing quote may be mid-line; same 2 files scanned as main); merged 81c25e5d; checker OK on the real tree, new test PASS=2 FAIL=0. Released in v10.5.0 (merge 81c25e5d is an ancestor of v10.5.0). |
-| E-106 | P0: claude-agent-sdk version drift. loki-ts/package.json is 0.3.283 (9db2a4ed) but root package.json and package-lock.json pin 0.3.267 and Dockerfile:160 installs 0.3.208, so the published package resolves an SDK older than the one the engine was evaluated on. Align all pins; add tests/test-sdk-version-sync.sh so CI (not only local-ci.sh) catches drift | package.json, package-lock.json, Dockerfile, tests/test-sdk-version-sync.sh, tests/run-all-tests.sh, tests/shard-durations.tsv | MEDIUM | new test red on main (3 mismatches) then green; npm pack --dry-run succeeds | released@2026-09-28T21:01Z | Source: 19:40 train fast tier FAIL "Agent SDK is a resolvable root dependency"; reproduced on origin/main (root 0.3.267 vs loki-ts 0.3.283). Dispatched 19:45Z sonnet. Tech Lead APPROVE 58c8150c (lock touched only the SDK; integrity matches npm view); r2 1a795932 scans git ls-files only (untracked .claude/worktrees Dockerfiles gave 14 false mismatches). Merged a58c47b6; test-sdk-version-sync.sh PASS 4/4 at 0.3.283. Released in v10.5.0 (merge a58c47b6 is an ancestor of v10.5.0). |
-| E-107 | Pulse SESSION_STALLED derives the Claude transcript directory from the shell cwd, so a session whose shell sits in a subdirectory (loki-ts/) reads a nonexistent project dir and reports a 108182-minute stall; resolve it from the repo root (git rev-parse --show-toplevel) | scripts/v10-pulse.sh (transcript-dir resolution only), tests/test-v10-pulse.sh | LOW | fixture: pulse run from a subdirectory reports the same minutes-since-last-turn as from the root | released@2026-09-28T21:01Z | Source: 19:48Z pulse: SESSION_STALLED 108182.9 min right after a Bash step left cwd at loki-ts/. Serialize after E-91 and G-02 (same file). Tech Lead: logic APPROVE, REJECT for a T48 name collision with G-02; r2 823f91cb renamed to T49/T49a/T49b, merge-tree clean; merged; test-v10-pulse.sh 140/0. Released in v10.5.0 (merge 697c6e55 is an ancestor of v10.5.0). |
-| E-108 | release.sh --bump-only: after a rebuild it restores loki.js.map (debugId-only churn, E-72) but leaves the new debugId trailer in dist/loki.js, so the shipped loki.js and loki.js.map disagree on debugId; keep the old trailer too, so a VERSION-only bump changes exactly the version literal | scripts/release.sh, tests/test-release-bump-dist.sh | LOW | fixture: after a VERSION-only bump, git diff of dist/loki.js is exactly the version literal and its debugId equals the map debugId (red first) | released@2026-09-28T21:01Z | Source: v10.4.0 cut 19:50Z: loki.js debugId AE3EFDC8... vs map 93B13628...; fixed by hand in 7895a698. Dispatched 19:56Z sonnet. Tech Lead APPROVE 71f2f944 (restores only the debugId trailer, never the version literal); merged 6b65aaff; bump-dist 15/0, bump-only 8/0. Released in v10.5.0 (merge 6b65aaff is an ancestor of v10.5.0). |
-| E-109 | usage-governor.py takes 115s (real 115.27s, full parse of every transcript) so the pulse background refresh times out and OPUS_SHARE/BUDGET_BURN read UNKNOWN every turn; scan only transcripts modified within the weekly window and cache parsed per-file results by (path, size, mtime) | scripts/usage-governor.py, tests/test-usage-governor.sh | MEDIUM | a second run over unchanged transcripts finishes in under 10s on this host; results identical to a full parse on a fixture | released@2026-09-28T21:01Z | Source: 20:00Z pulse showed "usage governor check failed or timed out" after G-02 merged. Tech Lead REJECT r1 (warm 53s over the 10s Wall) and r2 (mtime cutoff dropped 5h-window rows after a weekly reset: 0 vs 500, reproduced); APPROVE r3 6333b8f9 (reviewer repro now 500; mkstemp cache writes). Merged; test-usage-governor 30/30; cold 12.9s, warm 4.86s (was 115s). Released in v10.5.0 (merge da1832a3 is an ancestor of v10.5.0). |
-| E-110 | P0 guard for the v10.4.0 block: (a) tests/test-eval-archive.sh builds its planted secrets at runtime so the file itself has no secret shape; (b) .githooks/pre-push runs the pinned gitleaks over every pushed commit and path (not only eval fixture changes), matching the CI Security Audit, with the tip .gitleaksignore | tests/test-eval-archive.sh, .githooks/pre-push, tests/test-pre-push-gitleaks.sh | HIGH | a push adding a test file with an AKIA-shaped literal is refused locally (red first); test-eval-archive.sh passes and gitleaks dir on it finds nothing | released@2026-09-28T21:40Z | Source: v10.4.0 Release 36475005937 required-ci failed: Security Audit gitleaks "leaks found: 3", all in bbe83c7a:tests/test-eval-archive.sh (synthetic E-101 fixtures; allowlisted by exact fingerprint in 6358e0a6). The pre-push scan only ran for eval fixture changes. r1 ad35af15 opus REJECT: tip .gitleaks.toml disables the scan under PRE_PUSH_SKIP=1 (reviewer repro: zero-rule config plus AKIA secret landed as 743d143a on a scratch remote). r2 dispatched 21:10Z. r2 01d09027 opus APPROVE (reviewer attack refused with and without the config override; stub timeout exit 124 refuses); merged fd74149f; pre-push-gitleaks 53/0, pre-push-hook 13/0, release-notes 41/0, eval-archive 5/0. Released in v10.5.1 (merge fd74149f is an ancestor of v10.5.1). |
-| E-58 | Issue-ref runs: supervisor creates runDir before the fetch child writes issue.json; makes E-47 green | loki-ts/src/engine10/supervisor.ts (one line before fetchIssueToFile), E-47 test files from 544348a7 | MEDIUM | cd loki-ts && bun test tests/engine10/issue_ref_e2e.test.ts (3 pass) | released@2026-09-28T02:38Z | Source: E-47 finding (TL reproduced). Merged 646a6cd7 (train E13): engine10 388 pass 0 fail, tsc exit 0, test-engine10-dist 18/0, test-engine10-docs 26 passed, test-harness 82/0. APPROVE (6384fff9); issue_ref_e2e 3 pass. Released v9.81.0 (npm view loki-mode time: 2026-09-28T02:38:54Z). |
-| E-59 | Receipt model and summary tokens match the provider: cost.ts takes model from the result-cost file; events.ts fold sums cache read and creation tokens; makes E-50 green | loki-ts/src/engine10/cost.ts, loki-ts/src/engine10/events.ts, E-50 test files from 716618d4 | HIGH | cd loki-ts && bun test tests/engine10/model_report.test.ts tests/engine10/output.test.ts | released@2026-09-28T02:38Z | Source: E-50 finding. Reconcile with E-44 (output.ts already folds cache tokens at render). Opus reviewer (cost numbers feed the gate). Opus CONCERN: writeResultCost writes no model, so real records still use the caller model; summary tokens at supervisor.ts still exclude cache. Rework dispatched. Merged 3ab2a8fa (train E14, rebased on main): engine10 404 pass 0 fail (402 pass 0 fail with claude removed from PATH), tsc exit 0, test-harness 86/0, test-local-ci-gitleaks 6/0, test-engine10-dist 18/0. Released v9.81.0 (npm view loki-mode time: 2026-09-28T02:38:54Z). |
-| EV-8 | v10 cost check on 5 tasks before the full arm (CEO 23:31Z): v10 arm, same model, after E-42 and E-45 merge | eval/loki10 results (gitignored) plus docs/v10/METRICS.md block | HIGH | eval/loki10/run.sh --arm v10 --tasks <5 ids> reports completed, time to PR and provider cost per task | released@2026-09-28T02:38Z | Target cost per completed task at or below $0.2363 (raw claude -p full arm). Depends on E-42, E-45, E-38 (--tasks). Incident 01:38Z: first run 0/5 on both variants measured the wrong code. The harness default arm binary is the global loki (loki --version: v9.78.0), and the main checkout node_modules still had agent SDK 0.3.267 (package.json pins 0.3.283), whose bundled Claude Code 2.1.267 rejects claude-opus-5-5, so every session exited "error" in about 1s with 0 tokens. Fixed in 7c3dea3d: bun install (node_modules 0.3.283), repro with the harness arm_env and arm_auth now completes on claude-opus-5-5 ($0.11, 13s); dist rebuilt. Rerun started with LOKI_EVAL_LOKI_BIN=<repo>/bin/loki. Guards E-61, E-62. Rerun measured (not a code slice): A 4/5 $0.5954, B 5/5 $0.3976, C (all sonnet, no plan, no Wall) 4/5 $0.294, raw 5/5 $0.2161 (~/loki-ci-logs/ev8r-{A,B,C}/results.jsonl). Gate not met on cost; D31 and E-64, E-65 follow. Released v9.81.0 (npm view loki-mode time: 2026-09-28T02:38:54Z). |
-| EV-9 | v10 full arm over the 29 tasks from the shipped entry, then EV-6 publishes the gate report | eval/loki10 results plus docs/v10/METRICS.md and the CHANGELOG block | HIGH | eval/loki10/run.sh --arm v10 --all yields 29 rows, none arm_unavailable; eval/loki10/publish_gate.sh writes the loki10-gate marker | ready@2026-09-27T23:48Z | Depends on EV-8 meeting cost, E-32, E-33, EV-6. |
-| E-46 | Wire --resume end to end through the supervisor (refused today) | loki-ts/src/engine10/supervisor.ts (resume path only), loki-ts/tests/engine10/resume_cli.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/resume_cli.test.ts | released@2026-09-28T02:38Z | Found by E-14 (resume refused). Depends on E-42. Dispatched. Merged 3ab2a8fa (train E14, rebased on main): engine10 404 pass 0 fail (402 pass 0 fail with claude removed from PATH), tsc exit 0, test-harness 86/0, test-local-ci-gitleaks 6/0, test-engine10-dist 18/0. Released v9.81.0 (npm view loki-mode time: 2026-09-28T02:38:54Z). |
-| E-47 | Issue-ref run end to end (owner/repo#N and URL) through the fetch child with a stub gh | loki-ts/tests/engine10/issue_ref_e2e.test.ts, loki-ts/tests/engine10/fixtures/issue-ref/ | MEDIUM | cd loki-ts && bun test tests/engine10/issue_ref_e2e.test.ts | released@2026-09-28T02:38Z | Found by E-14 (issue refs wired but untested). Depends on E-42. Staffed in engine10-tests-e42, based on the E-42 branch. Built 544348a7, TL APPROVE: 3 tests red for one real bug (supervisor.ts fetchIssueToFile before runDir exists, ENOENT exit 2). Held; merges with E-58. Merged 646a6cd7 (train E13): engine10 388 pass 0 fail, tsc exit 0, test-engine10-dist 18/0, test-engine10-docs 26 passed, test-harness 82/0. Merged with E-58. Released v9.81.0 (npm view loki-mode time: 2026-09-28T02:38:54Z). |
-| E-48 | Spawn deep verify detached from the supervisor after pr.opened, and wire adapters notify (Slack) after run.completed | loki-ts/src/engine10/supervisor.ts (post-PR hook only), loki-ts/tests/engine10/deep_wiring.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/deep_wiring.test.ts | released@2026-09-28T02:38Z | E-23 and E-28 exist but nothing calls them. Depends on E-42. Dispatched. Merged 3ab2a8fa (train E14, rebased on main): engine10 404 pass 0 fail (402 pass 0 fail with claude removed from PATH), tsc exit 0, test-harness 86/0, test-local-ci-gitleaks 6/0, test-engine10-dist 18/0. Released v9.81.0 (npm view loki-mode time: 2026-09-28T02:38:54Z). |
-| E-49 | loki dashboard reachable through the real entry: serves a run folded from a fixture event log | loki-ts/tests/engine10/dashboard_entry.test.ts | LOW | cd loki-ts && bun test tests/engine10/dashboard_entry.test.ts | released@2026-09-28T02:38Z | E-24 exists; this proves the cli route reaches it. Depends on E-42. Dispatched. Merged 3ab2a8fa (train E14, rebased on main): engine10 404 pass 0 fail (402 pass 0 fail with claude removed from PATH), tsc exit 0, test-harness 86/0, test-local-ci-gitleaks 6/0, test-engine10-dist 18/0. Released v9.81.0 (npm view loki-mode time: 2026-09-28T02:38:54Z). |
-| E-50 | Receipt model field and summary token count match the provider report on a real SDK session (fixture replay of a recorded result-cost file) | loki-ts/tests/engine10/model_report.test.ts, loki-ts/tests/engine10/fixtures/model-report/ | MEDIUM | cd loki-ts && bun test tests/engine10/model_report.test.ts | released@2026-09-28T02:38Z | Found by E-14 (model "default", 1k tokens shown for 372k used). Depends on E-42, E-44. Staffed in engine10-tests-e42, based on the E-42 branch. Built 716618d4, TL APPROVE: 2 tests red for real bugs (cost.ts writes caller model not provider model; events.ts fold drops cache tokens, 1004 vs 373164). Held; merges with E-59. Merged 3ab2a8fa (train E14, rebased on main): engine10 404 pass 0 fail (402 pass 0 fail with claude removed from PATH), tsc exit 0, test-harness 86/0, test-local-ci-gitleaks 6/0, test-engine10-dist 18/0. Merged with E-59. Released v9.81.0 (npm view loki-mode time: 2026-09-28T02:38:54Z). |
-| E-51 | v10 run passes the pinned origin and the task through to a local-origin PR in the eval harness (regression test of the E-41 plus E-42 path) | loki-ts/tests/engine10/eval_pr_path.test.ts | HIGH | cd loki-ts && bun test tests/engine10/eval_pr_path.test.ts (bare local origin receives the branch; pr.opened url is local://) | released@2026-09-28T01:11Z | Guards the path that lets v10 score in the gate. Depends on E-41, E-42. Staffed in engine10-tests-e42, based on the E-42 branch. Merged (cherry-pick of 018fbcd4 onto main): bun test tests/engine10/eval_pr_path.test.ts 1 pass 0 fail; TL APPROVE with mutation (env scrub removed -> canary leak caught). Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| E-31 | Default flip to v10 with LOKI_ENGINE=legacy override and the loki legacy alias (merge held until the gate marker reads met) | bin/loki, loki-ts/src/engine10/cli.ts (USAGE only), tests/test-engine10-default.sh, tests/test-engine10-dispatch.sh, tests/test-engine10-legacy-contract.sh, README.md and docs/v10/GUIDE.md (marked opt-in line only, after E-34) | HIGH | bash tests/test-engine10-default.sh && bash tests/test-engine10-legacy-contract.sh && bash tests/test-engine10-dispatch.sh (0 failed; legacy contract 0 skipped) | parked@2026-10-03T12:01Z | Source: ENGINE.md 23:00Z cut. Held at approved until the METRICS.md loki10-gate marker reads met; parked if not met by 03:00Z. Depends on E-30, E-32, E-33, E-34, E-35, E-38, EV-6. Staffed in engine10-gate-push (wf_1d47133f-7c7). Built 2caf70e5 (branch e31-default-flip), opus APPROVE. Held: merges only if the gate marker reads met at 03:00Z. Drift audit 12:01Z: no live owner for 5+ days; parked per D68 drop-red. |
-| E-32 | Packaging: engine runs from dist and the npm package (static registry, session child via cli route, REPO_ROOT paths) | loki-ts/src/engine10/registry.ts, loki-ts/src/cli.ts (engine10 arm only), loki-ts/src/engine10/machine.ts, loki-ts/src/engine10/session.ts, loki-ts/src/engine10/output.ts, loki-ts/src/engine10/fetch_issue.ts, loki-ts/src/engine10/stages/pr.ts, loki-ts/tests/engine10/registry.test.ts, tests/test-engine10-dist.sh | HIGH | bash tests/test-engine10-dist.sh && (cd loki-ts && bun test tests/engine10/registry.test.ts) | released@2026-09-28T02:38Z | Source: ENGINE.md 23:00Z cut. Later engine slices add one registry line at merge. Depends on E-14, E-TG. Staffed in engine10-gate-push (wf_1d47133f-7c7). Built f44797bf+0b859361, APPROVE; conflicts with E-42 in session.ts. Rebase dispatched. Merged 646a6cd7 (train E13): engine10 388 pass 0 fail, tsc exit 0, test-engine10-dist 18/0, test-engine10-docs 26 passed, test-harness 82/0. APPROVE (e00cbcd1); squashed with E-58. Released v9.81.0 (npm view loki-mode time: 2026-09-28T02:38:54Z). |
-| E-33 | Gate report generator: METRICS.md and CHANGELOG blocks with every gate number, misses and the loki10-gate marker | eval/loki10/gate_report.py, eval/loki10/test-gate-report.sh, eval/loki10/fixtures/gate/ | HIGH | bash eval/loki10/test-gate-report.sh | released@2026-09-28T01:11Z | Source: ENGINE.md 23:00Z cut. EV-6 runs it on real results and commits METRICS.md. Depends on EV-1. Building in a private clone (worktrees full). Built 06c457b8; review CONCERN (one-model check not covered by a test); fix in engine10-gate-push. Merged 23b20e6f (train E12): shard coverage 19/0, drift 6/0, engine10 349 pass 0 fail, tsc exit 0. Fix 4eb826b2 APPROVE; test-gate-report 34/0. Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| E-34 | v10 user docs: README quickstart and docs/v10/GUIDE.md (5-line summary, NOT PROVEN, receipts), opt-in until the flip | README.md, docs/v10/GUIDE.md, tests/test-engine10-docs.sh | LOW | bash tests/test-engine10-docs.sh | released@2026-09-28T02:38Z | Source: ENGINE.md 23:00Z cut. Depends on E-13, E-22. Building in a private clone (worktrees full). Stopped over budget (CEO 23:31Z); built 9716677f; re-sliced to a 15-minute review in engine10-gate-push. Re-review APPROVE, but README says the run does not execute a build yet, false since E-42 (9db2a4ed). Refresh dispatched. Merged 646a6cd7 (train E13): engine10 388 pass 0 fail, tsc exit 0, test-engine10-dist 18/0, test-engine10-docs 26 passed, test-harness 82/0. APPROVE (7dcae83d). Released v9.81.0 (npm view loki-mode time: 2026-09-28T02:38:54Z). |
-| E-35 | Legacy engine deprecation note for loki legacy help and CHANGELOG (no removal) | autonomy/lib/engine10-legacy-notice.txt, CHANGELOG.md, tests/test-engine10-legacy-notice.sh | LOW | bash tests/test-engine10-legacy-notice.sh | released@2026-09-28T01:11Z | Source: ENGINE.md 23:00Z cut. Depends on none; lands before E-31. Building in a private clone (worktrees full). Review APPROVE (75e732c0); main 39ba4f67 (`bash tests/test-engine10-legacy-notice.sh` 8 passed, 1 skipped). Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| E-36 | First-run preflight: repo, git identity, provider CLI, opencode refusal, host guard, gh auth, UNSIGNED warning | loki-ts/src/engine10/preflight.ts, loki-ts/tests/engine10/preflight.test.ts, loki-ts/src/engine10/supervisor.ts (one call in main) | MEDIUM | cd loki-ts && bun test tests/engine10/preflight.test.ts | released@2026-09-28T02:38Z | Source: ENGINE.md 23:00Z cut. Depends on E-14. Staffed in engine10-gate-push (wf_1d47133f-7c7). Opus REJECT (reproduced): runSupervisor calls preflight without opts.env. Rework dispatched; merges with E-37. Merged 646a6cd7 (train E13): engine10 388 pass 0 fail, tsc exit 0, test-engine10-dist 18/0, test-engine10-docs 26 passed, test-harness 82/0. APPROVE (737b9b67). Released v9.81.0 (npm view loki-mode time: 2026-09-28T02:38:54Z). |
-| E-37 | Non-claude provider paths (codex, cline, aider) through session.ts with cost not measured and NOT PROVEN entries | loki-ts/tests/engine10/providers.test.ts, loki-ts/tests/engine10/fixtures/providers/ | MEDIUM | cd loki-ts && bun test tests/engine10/providers.test.ts | released@2026-09-28T02:38Z | Source: ENGINE.md 23:00Z cut. Test only; a red becomes its own slice. Depends on E-14, E-36. Staffed in engine10-gate-push (wf_1d47133f-7c7). Built 41995357, APPROVE; its opencode group un-skips now that E-42 exports main and fails without E-36. Held; merges with E-36. Merged 646a6cd7 (train E13): engine10 388 pass 0 fail, tsc exit 0, test-engine10-dist 18/0, test-engine10-docs 26 passed, test-harness 82/0. Merged with E-36 (737b9b67). Released v9.81.0 (npm view loki-mode time: 2026-09-28T02:38:54Z). |
-| E-38 | v10 arm gate run over the 29 tasks from dist; legacy arm pinned to LOKI_ENGINE=legacy | eval/loki10/harness.py (legacy arm env), eval/loki10/test-harness.sh (one leg) | HIGH | bash eval/loki10/test-harness.sh && eval/loki10/run.sh --arm v10 --all (29 rows, none arm_unavailable) | released@2026-09-28T01:11Z | Source: ENGINE.md 23:00Z cut. The missing third arm for the gate. Depends on EV-1, E-32, E-36. Staffed in engine10-gate-push (wf_1d47133f-7c7). Merged 23b20e6f (train E12): shard coverage 19/0, drift 6/0, engine10 349 pass 0 fail, tsc exit 0. test-harness 79/0. Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| E-39 | Interrupt and resume end to end (SIGINT, no orphan, resume to seal on the same run) | loki-ts/tests/engine10/resume_e2e.test.ts, loki-ts/tests/engine10/fixtures/resume/ | MEDIUM | cd loki-ts && bun test tests/engine10/resume_e2e.test.ts | released@2026-09-28T01:11Z | Source: ENGINE.md 23:00Z cut. Depends on E-14. Staffed in engine10-gate-push (wf_1d47133f-7c7). Merged 23b20e6f (train E12): shard coverage 19/0, drift 6/0, engine10 349 pass 0 fail, tsc exit 0. Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| E-40 | Live PR smoke on a sandbox GitHub repo from the dist layout | tests/test-engine10-live-pr.sh | HIGH | LOKI_E10_LIVE_REPO=<owner>/<sandbox> bash tests/test-engine10-live-pr.sh | released@2026-09-28T01:11Z | Source: ENGINE.md 23:00Z cut. SKIP without the variable does not count as done. Depends on E-23, E-32, E-36. Staffed in engine10-gate-push (wf_1d47133f-7c7). Merged 23b20e6f (train E12): shard coverage 19/0, drift 6/0, engine10 349 pass 0 fail, tsc exit 0. Live leg SKIPs without LOKI_E10_LIVE_REPO. Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-
-Every slice above: implement with red-then-green tests, run diff-scoped tests
-plus `bash tests/moat/run.sh` in your own worktree, never touch `main`,
-`VERSION`, or a hot file/bundle (see below), and return BLOCKED (never guess
-past your declared file set) if you need a file outside it. `git merge
---ff-only <captain's current main sha>` first; worktrees are cut from
-origin/main. No version bumps, no emojis, no em or en dashes, bash 3.2
-compatible, shellcheck clean at CI flags on changed .sh files. Stage by
-name, conventional commit message, no Co-Authored-By, end with the line:
-Claude-Session: https://claude.ai/code/session_019U6NAdpZyYeCEKzvHfZ4Tq. Do
-not push.
-
-## Hot files (Captain-owned; no builder file set may include these)
-
-`tests/moat/cases.txt`, `tests/moat/pending.txt`, `CHANGELOG.md`,
-`docs/v10/BACKLOG.md`, `docs/v10/BOARD.md`, `docs/v10/PROGRESS.md`,
-`docs/v10/METRICS.md`, `docs/v10/CONTROL.md`, `scripts/local-ci.sh`,
-`tests/run-all-tests.sh`, `VERSION`, `package.json`, `SKILL.md`, `Dockerfile`,
-`Dockerfile.sandbox`, `plugins/loki-mode/.claude-plugin/plugin.json`,
-`server.json`, `dashboard/__init__.py`, `mcp/__init__.py`, `CLAUDE.md`.
-
-## Generated bundles (Captain rebuilds after every merge touching sources)
-
-`loki-ts/dist/loki.js`, `legacy-ui-static/index.html`, `legacy-ui/dist/*`,
-`web-app/dist/*`.
-
-## Wave log
-
-Appended by the Captain after each wave closes. See METRICS.md for the
-numeric rollup.
-
-- **Wave 0 (setup, 2026-09-26):** SWARM.md and BOARD.md written. Council
-  round 4 (pre-swarm, cycle-4-only) killed mid-run: two of three lenses had
-  no pinned model and the session model changed under it (D13). Stray
-  worktrees `agent-a8fad9a6e301fe297` (old, pre-v10, already merged) and a
-  scratch `mutwt` checkout (0 commits ahead of main) removed; four real
-  in-flight worktrees (GF-2, GF-3, GF-4, GF-5) recorded above. GF-5
-  cherry-picked into main directly (it was a small, already-approved fix,
-  not a swarm-cut slice) plus a same-session XSS fix and D8-D13. No release
-  cut yet this wave.
-
-## PF-3: repo-wide kill-by-name scan (severity: same class as PF-1/D14, found in shipped surfaces)
-
-| ID | Owner | Branch | File set | Tier | Status | Notes |
-|---|---|---|---|---|---|---|
-| PF-3 | kill-scan sweep | main @ b539391d | autonomy/loki, autonomy/verify.sh, .github, dashboard harness scripts, scripts/cleanup-test-processes.sh, tests/test-runtime-gate.sh, tests/test-backend-floor.sh, 8 new scoping tests | HIGH | released@2026-09-27T15:00Z | Round 6 fixed the port-overflow bug (narrowed range); unanimous 2/2 APPROVE. Merged to main via --no-ff (b539391d, 21 commits). All 9 new test files verified passing directly and registered in tests/run-all-tests.sh (6560ca95), pushed to origin (5b785b51..6560ca95). No version bump in this push; on main, not yet in a tagged release (latest tag is still v9.54.2 as of this correction). Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-
-
-## Adoption directive (2026-09-30, overrides the backlog above until Tier 0 is green)
-
-Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md. Tier 0 and Tier 1 run in parallel; unrelated rows are parked.
-
-| ID | Goal | File set | Tier | Wall check | Status | Notes |
-|---|---|---|---|---|---|---|
-| A-01 | Release to `next`: both `npm publish` lines in release.yml get `--tag next`; a `promote` workflow (workflow_dispatch, exact version) runs the first-run gate against `loki-mode@<version>` installed from npm and only then runs `npm dist-tag add loki-mode@<version> latest`, moves Docker `:latest` and updates Homebrew; fix every check that assumes latest equals the newest release (E-135 post-release smoke, v10-pulse npm-latest comparison); fold in E-152 | .github/workflows/release.yml, .github/workflows/promote.yml (new), scripts/release.sh, scripts/v10-pulse.sh, tests for each | HIGH | fixture: release path publishes with --tag next; promote refuses without a gate pass on that exact version | released@2026-09-30T21:23Z | Blocks every release until merged (releases held since 20:02Z). Released in v10.5.11 (merge cec20054 is an ancestor of v10.5.11). |
-| A-02 | First-run gate: scripts/first-run-gate.sh (throwaway HOME, bugrepo from firstrun-repro/bugrepo-original, the README's default entry point, stub-provider mode for CI, real-provider mode for promotion) asserting: exit 0 only if npm test fully green; no new files outside the fix except .loki/; printed receipt digest equals what loki verify checks; loki verify OK exit 0; receipt signed; output 15 lines or fewer without --verbose; wall time recorded. Step 1: reproduce each defect from the directive on current main and classify code bug vs machine artifact | scripts/first-run-gate.sh, tests/test-first-run-gate.sh, docs/v10/FIRST-RUN-GATE.md (defect table) | HIGH | gate runs in stub mode in CI as a NON-required job; the defect table cites command and rc per defect | released@2026-09-30T21:23Z | Gates `latest` (via A-01 promote). Released in v10.5.11 (merge 8641dac4 is an ancestor of v10.5.11). |
-| A-03 | Tier 0 architecture split (opus Architect): slice items 1 Seal correctness, 2 clean first run, 3 signed by default, 5 honest outcomes into non-overlapping file sets with Wall checks, one writer per file, shrink-or-flat per D33; Seal correctness builds on slice-E-125 | docs/v10/ADOPTION-PLAN.md | HIGH | every slice card has a file set, a Wall check tied to a gate assertion, and a line budget | released@2026-09-30T21:23Z | Item 4 (one engine) waits until 1 to 3 pass the gate. Released in v10.5.11 (merge 26dd66b8 is an ancestor of v10.5.11). |
-| A-04 | loki-seal: a Claude Code skill plus hook that runs the repo's real test suite on the current diff, refuses done on red or on deleted, skipped, xfailed or weakened tests or CI config (diff scan plus a tree hash of existing tests), prints a 5-line receipt; zero model cost, no dangerous flags; self-contained, no LICENSE file; SUBMIT.md drafts only; a 20-second vhs or asciinema script | packages/loki-seal/** | HIGH | fixture repos: deleting a failing test is blocked; a real fix passes; each weakening class caught | released@2026-10-01T00:52Z | Tier 1 wedge; answers issue #42. Released in v10.5.13 (merge a61e1721 is an ancestor of v10.5.13). |
-| A-04b | loki-seal follow-ups from opus r5: reset the hook-error counter after a successful stop; fall back to stop_hook_active repetition when the tmpdir is read-only or full; tests must write loki-seal-err-* counter files under LOKI_RUN_TMP, not the real os.tmpdir() | packages/loki-seal/** | MEDIUM | package tests plus demo dry-run; no files left in the real tmpdir after the suite | released@2026-10-16T00:49Z | Source: A-04 opus r5 APPROVE notes. |
-| A-09 | README under 150 lines (directive item 9): line 1 "Your agent says done. Loki proves it." (veto pending, founder queue 10); line 2 "An autonomous software factory that knows what it is supposed to deliver, and proves it did." (D45); then the loki-seal 20-second GIF (placeholder until recorded), then two install lines (loki-seal first, `npx loki-mode tour` second); flags, internal paths, version stamps and app-builder comparisons move to docs; remove the commercial-editions sentence from the top and the npm total-downloads and Docker pulls badges; define "Seal" in one sentence or stop using the word; package.json description and SKILL.md description use line 2 verbatim (SKILL.md header and footer version rules still apply) | README.md, docs/ (moved sections), package.json (description only), SKILL.md (description only) | MEDIUM | README <= 150 lines; no retracted claims (directive Never list); structural checks (SKILL.md sync, readme version) pass | released@2026-10-01T00:52Z | Source: directive item 9 plus D45. Released in v10.5.13 (merge 38ffd386 is an ancestor of v10.5.13). |
-| A-04c | loki-seal reads the delivery contract (D45): from the task or issue the user gave the session (prompt text, a linked issue, a spec file), derive the acceptance checks and refuse "done" until the checks tied to that request pass, not only "the suite is green"; when no contract can be derived, say so on the receipt (NOT VERIFIED: no contract) instead of passing on green alone. Design first (how the hook sees the user request: transcript_path from the hook input, first user message), then build; zero model cost stays a constraint | packages/loki-seal/** | HIGH | fixtures: a session asking for behavior X with a green suite that never tests X is NOT VERIFIED; with a test for X passing it PASSes | released@2026-10-16T00:49Z | 25ea817d6..4c597cc35 (5 rounds cherry-picked; CHANGELOG deduped b3f162d61). Opus r5 APPROVE: N1-N7 closed, seal suite 72/72 on main. Advisory A1 forged runner lines and A3 Known-limits gap filed as A-04d. |
-| A-103b | Seal lists each discarded Wall test in not_proven as "wall test discarded: <path> (<class>)" (A-103 kept seal.ts out of its file set; today only a count appears via base_run not_run) | loki-ts/src/engine10/stages/seal.ts, its test | HIGH | fixture: a discarded Wall file appears by path in not_proven | released@2026-10-16T00:49Z | main d34a2d519, opus HIGH APPROVE (2 mutations red, engine10 1166/0); dist rebuilt, guard 13/0, seal 54/0. Non-blocking: filter runDir/wall on WALL_PREFIX; not_run suffix assumes the wall.ts removal rule |
-| A-101 | Receipt canonicalization and verify help (item 1) | see docs/v10/ADOPTION-PLAN.md A-101 | HIGH | first-run-gate assertion per plan card | released@2026-09-30T21:23Z | Wave per plan section 5; one writer per file. Released in v10.5.11 (merge 5ea92836 is an ancestor of v10.5.11). |
-| A-102 | Test-runner detection: node:test plus fixtures for all six runners (item 1) | see plan A-102 | HIGH | first-run-gate assertion per plan card | released@2026-10-01T00:52Z | Wave per plan section 5; one writer per file. Released in v10.5.13 (merge 0990afb8 is an ancestor of v10.5.13). |
-| A-104 | Commit only the fix (items 1 and 2, v10) | see plan A-104 | HIGH | first-run-gate assertion per plan card | released@2026-09-30T21:23Z | Wave per plan section 5; one writer per file. Released in v10.5.11 (merge d86a5817 is an ancestor of v10.5.11). |
-| A-104b | A-104 opus follow-ups: run the unstage reset as `git --literal-pathspecs reset` and check its rc (a path starting with `:(top)` was read as a pathspec and committed); match "manifest changed" per directory in monorepos (a stray lockfile in packages/b rode along with a packages/a manifest change); judge new lockfiles and Wall files against the run base, not HEAD, so files the agent commits during implement are also excluded | loki-ts/src/engine10/stages/seal.ts, loki-ts/tests/engine10/seal.test.ts | HIGH | fixtures for each case red first; seal-then-verify still matches | released@2026-10-16T00:49Z | Source: A-104 opus review (APPROVE with notes). seal.ts writer order: after A-121. |
-| A-104c | A-104b r2 opus follow-up (code reading, not reproduced): a FAILED run now reaches backstopCommit in supervisor.ts (around lines 93-98 and 229), which runs git add -A with hooks off, so a run whose commit stage failed could still commit Wall files, stray lockfiles and the user's pre-run dirty files, and hasDiff could push them as a draft PR (E-67 behaviour). Reproduce first; then make the backstop honor the same exclusions as the commit stage, or skip it when the commit stage itself failed | loki-ts/src/engine10/supervisor.ts, its test | failed-commit run leaves no new commit with Wall files, lockfiles or pre-run dirty files, and opens no PR | HIGH | released@2026-10-16T00:49Z | none |
-| D50-F1 | D50 lift fix 1 (aiq-52, expected no_change_needed): v10 printed ALREADY_SATISFIED but left source changes from implement (harness no_source_diff=false), so it scored not completed; raw sonnet checked first and changed nothing. On ALREADY_SATISFIED, restore source to base before commit, PR or seal; fail closed to FAILED if the restore fails | loki-ts/src/engine10 (outcome path), its tests, dist | fixture with implement edits plus ALREADY_SATISFIED ends with an empty diff, no commit, no PR; VERIFIED runs keep changes | HIGH | released@2026-10-17T03:50Z | none Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| D50-F2 | D50 lift fix 2 (humanize-174): the task changes behaviour that existing tests encode; raw sonnet fixed code and updated the assertions (2/3), v10 BLOCKED as spec conflict or hit the iteration cap (0/3). Needs a design that permits spec-required assertion changes, recorded in the receipt, without opening a test-weakening loophole. Opus architect first | engine10 intake, plan, wall, verify, seal (per design) | humanize-174-shaped fixture completes with the assertion changes listed in NOT PROVEN; a weakening attack still fails | HIGH | rejected@2026-10-01T12:40Z: S1+S2 (71997e6c, a2941555) opus REJECT. Moat holds (any existing-test edit seals PARTIAL). Blocking: the per-spec label fires on any literal swap whose test calls a task word (if True to False, range(10) to range(0), tolerance 1e-3 to 1e3) and drops the weakened-test flag, a false Seal claim. No lift: context.ts:23 still makes tests append-only, so humanize-174 still ends SPEC_CONFLICT. Rework D50-F2r (honest label) building; lift fix D50-F2-S3 needs a CTO call | none |
-| D50-F2r | D50-F2 rework, honest label only: label a test value change only on the expected side of an assert comparison or a parametrize expected value, only when the old or new value appears in the task text; wording 'assertion value changed (not shown to be required by the task): file:line old -> new' and keep the 'weakened test' line beside it; exclude control flow, range, tolerances, approx kwargs, decorators | loki-ts/src/e10ext classifier, engine10 verify and seal wiring, tests, dist | probes C D E F G H K from the F2 review all keep 'weakened test'; A labelled only when 5 appears in the task; verdict PARTIAL in every case | HIGH | parked@2026-10-03T09:21Z | drift audit 09:22Z: r2 rejected, no live builder since 2026-10-01; parked per D68 drop-red; re-open as a fresh slice when D50-F2-S3 is ranked |
-| D50-F2-S3 | humanize-174 lift: let the implement brief edit an existing assertion only when the task text states the new expected value; verdict stays PARTIAL, never VERIFIED (moat). CTO call needed first: does a PARTIAL spec-required test edit count as the right outcome, and does the brief license weaken the append-only rule (context.ts:23) | loki-ts/src/e10ext/context.ts, verify and wall policy, eval fixture through implement | humanize-174 fixture through implement ends with code fixed and the spec value assertion changed, PARTIAL with an honest note | HIGH | ready (D53 ruled 12:39Z: VERIFIED allowed when the new literal is verbatim in the issue, the edit changes only that literal in an existing assert, and Wall plus other tests pass; PARTIAL never scores completed; red bypass tests for tolerance, if True to False, deleted assert, literal not in issue) | needs D50-F2r |
-| D50-F4b | D50-F4 hardening from the opus review (non-blocking): validate base from the worker-written event log as ^[0-9a-f]{40,64}$ before any git call, and skip the backstop when log.verify() fails | loki-ts/src/engine10/supervisor.ts or e10ext/commit_filter.ts, tests | a base of --output=x is refused with no git call; a tampered log runs no backstop | merged@2026-10-03T05:14Z | TL APPROVE (3 mutations red, engine10 net 0); cherry-picked cff3d4ab8, dist 159abf6d6, e10ext+supervisor 122/0. Follow-up (non-blocking): invalid raw base records no notProven reason in the supervisor path | none |
-| NPM-LAG | CORRECTED 16:14Z: v10.5.34 (ceb6942a) was accepted by npm at 15:37Z with the notice that it was being processed, and appeared in the registry only at 16:05:58Z (about 29 min; gitHead ceb6942a correct). Not a lost publish, a long npm processing delay, while the Release run already showed success. Guard: publish-npm, post-release-smoke and promote wait up to 45 min for the version (registry, no cache) before declaring it missing, and promote re-triggers when it appears, so a delay is never read as a failure or a pass (10.5.34 smoke failed ETARGET during the lag and skipped promote; rerun 16:30Z); train-cycle merges origin/main back into local main after each release (it stalled at 16:20Z with local main behind its own release) and waits on previous version visible; the release captain (train-cycle.sh) refuses the next release while the previous version is missing from npm | .github/workflows/release.yml publish-npm, scripts/train-cycle.sh, tests | a stubbed npm that never lists the version fails the step; train-cycle logs PREV_NOT_ON_NPM and waits | MEDIUM | released@2026-10-17T03:50Z | opus APPROVE both halves (fail-open probes all fail-closed); b=release.yml npm wait, a=train-cycle PREV_NOT_ON_NPM + sync_local_main; suites 68/0, 67/0, 31/0, 63/0 on main. Note: a failed pre-publish Release now halts later releases until acted on (STALE after 45 min) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| D53-Q1 | CTO call before D50-F2-S3: under D53(a) a bug-report task ('Expected 200, got 404') lets a test change to the buggy value pass the literal-only gate; only Wall coverage of that behaviour stops it. Options: require the new literal to sit on the expected side of an expected/should phrase in the task, or require Wall coverage of the edited assertion | docs/v10/DECISIONS.md D53 | ruling recorded | HIGH | released@2026-10-01T14:20Z (ruled in DECISIONS D53 amendment: literal must be the EXPECTED value in the acceptance criteria with a source span; Wall must cover the behaviour; unclassifiable stays PARTIAL) | none |
-| D50-F4 | aiq-52 diagnosis: on FAILED, backstopCommit runs git add -A and re-stages the commit stage's exclusions (pre-existing dirt, Wall files, stray lockfiles), so a PR with only setup dirt is pushed. Backstop applies the same exclusions; nothing left means no commit and no PR | loki-ts/src/engine10/supervisor.ts, e10ext helper, tests, dist | preexisting-dirty fixture with FAILED: HEAD equals base and no PR; with a run edit the backstop commit holds only that edit; Wall and stray lockfile never committed | HIGH | released@2026-10-17T03:50Z | none Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| D50-F5 | aiq-52 lift: already_done.ts findEvidence misses compound task keywords (searchbar vs search-command); add deterministic compound-token matching and a same-stem source plus referencing-test category pair; confirmation still must cite a real hit | loki-ts/src/e10ext/already_done.ts, tests, dist | aiq-52-shaped fixture yields a candidate; unrelated keyword, source without referencing test and short prefix yield none | HIGH | parked@2026-10-03T09:21Z | drift audit 09:22Z: r2 rejected, no live builder since 2026-10-01; parked per D68 drop-red |
-| D50-W1 | CTO call (aiq-52 diagnosis): Wall runs in an empty temp cwd (wall.ts:156-169) with a 90s cap, so on brownfield tasks it writes blind tests and was killed twice; options are read-only repo access for Wall, or a longer cap, each weighed against Wall's from-spec independence (moat) | loki-ts/src/engine10/stages/wall.ts | decision recorded in DECISIONS | HIGH | released@2026-10-17T03:50Z | none Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| W1-S1 | D77 manifest builder: pure buildWallManifest returning signatures-only text from the base tree | loki-ts/src/engine10/wall_manifest.ts (new), loki-ts/tests/engine10/wall_manifest.test.ts | TS and Python fixtures: every exported signature present, body canary absent; style example never imports a named module; output 400 lines or fewer; byte-identical for the same tree | HIGH | released@2026-10-17T03:50Z | d7285daa3..9da5c123f on main (opus APPROVE r7, 51/0, tsc 0); library only, flag not wired; advisory: invalid-TS keyword after decorator leaks, fold into W1-S2 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| W1-S2 | D77 wire manifest into Wall cwd and brief; manifest_sha256 on wall.sealed | loki-ts/src/engine10/stages/wall.ts, loki-ts/tests/engine10/wall.test.ts | cwd holds only task.md, repomap.txt, wall_manifest.txt; body and implement-diff canaries never reach cwd or brief; E-54 and D42(3) tests green | HIGH | released@2026-10-17T03:50Z | r1-r15 cherry-picked (6acdb8476..f9dc7d67b), opus HIGH r15 APPROVE (211/0, tsc 0). Combined with D61-11 it breaks the e10ext/features size budgets; P0-SIZE-BUDGET trim in flight, train held. Advisory: add a johab cookie test row. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| P0-SIZE-BUDGET | Trim e10ext (1505/1500) and features (3041/3000) under budget with no behaviour change after D61-11 + W1-S2 merged | loki-ts/src/engine10/stages/wall.ts, loki-ts/tests/engine10/wall.test.ts | cwd holds only task.md, repomap.txt, wall_manifest.txt; body and implement-diff canaries never reach cwd or brief; E-54 and D42(3) tests green | HIGH | released@2026-10-17T03:50Z | Merged 87f256642: e10ext 1433/1500, features 2931/3000; budget.test.ts 27/0, dist guard 13/0. Whitespace/comment only. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| P0-T99-ROUTING | train/99 Tests red on shards 3/4/7 twice (run 37124003039 + full rerun): test-issue-to-pr acceptance import includes heading lines, test_start_run_unified URL start says no provider CLI, test-start-repo-directory (PO4) fails in 1s; all pass locally with provider CLIs | tests/cli/test-issue-to-pr.sh, tests/cli/test_start_run_unified.sh, tests/cli/test-start-repo-directory.sh, cause TBD | MEDIUM | three suites green under a CI-like PATH with no provider CLI, red before the fix | released@2026-10-17T03:50Z | Root cause: train/99 af6b616fa+2db6d1358 registered 4 orphan tests/cli suites; GNU sed range in issue-parser.sh extract_acceptance_criteria keeps heading lines (BSD falls back, so green on macOS); 2 suites silently needed a claude CLI. Fix 060a5794c red/green under env -i and ubuntu:24.04. Tier corrected HIGH->MEDIUM (parser, not moat). TL review running. TL APPROVE (5 suites green macOS+ubuntu docker). Merged ec5cc3398. Advisory carded: switch sed \s to [[:space:]] at the root. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| P0-P9-DEFAULT-PUSH | train/100 Tests red only on moat P9.injection-cannot-reach-token [default] leg: Loki post-session push never ran on the CI runner (push log: provider rejected x2). Intermittent on 8+ CI runs since 10-01. | tests/moat/p9-rule-of-two.sh, post-session push path (autonomy/run.sh or loki-ts) | HIGH | Root cause found and fixed, red before green under CI-like docker repro (M>=5); full moat run clean; pending.txt untouched | released@2026-10-17T03:50Z | Sonnet engineer in a worktree. Opus HIGH review follows (moat). One full rerun of run 37125941522 started per D68. Root cause: printf piped to grep -q under pipefail SIGPIPE 141 refused the post-session push under load (docker 5/18 -> 0/10). opus HIGH APPROVE (equivalence 18/20, the 2 diffs are literal-correct; P2/P7 FAILs pre-existing, missing typescript prereq). On main as 84e2b585e, engine10-push 40/0, P9 4/4 PASS. Advisory: add a "drops one function, keeps anchors" rc-3 case to test-engine10-push.sh. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| ADV-PUSH-RC3 | engine10-push guard testable alone: run.sh keeps its anchors but drops one of the four trusted-push functions; assert rc 3, 'region lacks', no gh, no push | tests/test-engine10-push.sh | MEDIUM | new case red when the guard is forced to pass, green on main; suite 41/0 under /bin/bash | released@2026-10-17T03:50Z | TL sonnet APPROVE (43/0; mutations true-match and loop-delete each 41/2; no-push via pre-receive log with positive control); main 511937aec Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| ADV-T99-SED | issue-parser root fix: GNU-only `\s` in sed and grep patterns becomes `[[:space:]]` so BSD and GNU agree | autonomy/issue-parser.sh, issue-parser tests | MEDIUM | a case with an indented list item and a heading parses the same on macOS and ubuntu docker; existing issue-parser suites green | released@2026-10-17T03:50Z | TL sonnet APPROVE (22/0 macOS; ubuntu docker commit vs parent logs identical; one-extractor BRE revert goes red 21/1; scope grew to sed -E for BSD alternation); main 4eb538b27 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| ADV-SEAL-JEST-E2E | loki-seal: E2E proof that a jest or vitest red still counts while coverage is NOT VERIFIED, via a stub runner bin | packages/loki-seal/test/seal.test.js | MEDIUM | stub jest exits 1: result is red with the specific reason; a mutant that ignores the exit code goes red; suite 135+/0 | released@2026-10-17T03:50Z | merged 036a05281 (TL APPROVE 138/138) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| T101-G04-DUPROW | train/101 shard 3 R2-3 red on GNU: test hook appended a file to itself, GNU grep refuses, so no duplicate row existed | tests/test-cloud-dispatch.sh, CHANGELOG.md | MEDIUM | R2-3 red on Linux and macOS when the writer uniqueness check is weakened | released@2026-10-17T03:50Z | D81; test-only; TL sonnet APPROVE (mutation len(hits)<1 gives 83/2 on ubuntu docker and macOS; 85/0 green both); main 8b314af87 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| T101-SEAL-NODEFLAG | train/101 shard 2: seal.test.js:1031 fixture uses node --test-isolation=none, rejected by CI Node | packages/loki-seal/test/seal.test.js (product only if it passes the flag), CHANGELOG.md | MEDIUM | the r7 no-newline honest-run test green on the CI Node and local Node, fail-closed unchanged | released@2026-10-17T03:50Z | merged def612303 (TL APPROVE: node:22 127/0/7skip env-only, parent fails r7; mutation red) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| W1-S3 | D77 size-tied Wall cap: 90s small, 180s normal, env override clamped to 300s | loki-ts/src/engine10/sizing.ts, loki-ts/src/engine10/stages/wall.ts, loki-ts/tests/engine10/sizing.test.ts | small 90, normal 180, 999 clamps to 300, garbage falls back; killed session copies no file; timeout never already_satisfied | MEDIUM | released@2026-10-17T03:50Z | TL MEDIUM BLOCK: wiring test uses a small task so limitS 90 equals old value; wall.ts:168 mutation survived. r2 test-only fix requested (normal task -> 180, env 240 reaches session). Code itself passed: 300 stage ceiling safe, env parse ok. Merged 916f2d99d..615fd4745 + dist f0ece075d; engine10 1199/0, tsc 0, dist guard 13/0. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| W1-S4 | D77 lift row: manifest off versus on | docs/v10/METRICS.md | augmentiq#52 plus 2 brownfield tasks, both arms; Wall timeouts, red-on-base count, completion, cost; logs under ~/loki-ci-logs | MEDIUM | ready@2026-10-03T08:52Z | Source: D77. Depends on W1-S2, W1-S3. Real-model leg: parked until Loki confirms key use. |
-| P0-backstop-refused | A run refused at intake (dirty tracked tree) still runs backstopCommit (git add -A plus commit) on the user's own branch, landing their dirty and untracked files on main; found by the D50-F1b opus review on base 151aa563 | loki-ts/src/engine10/supervisor.ts, its tests, dist | dirty-README fixture: refusal exit, no new commit on main, README still dirty byte-identical, notes.txt untracked | HIGH | released@2026-10-17T03:50Z | none Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| D50-F1c | Re-decision 12:35Z: D50-F1 stays in place (r5, released 10.5.30); B (worktree per run, D50-F1b) stays parked until a dependency strategy exists, because a worktree without node_modules or .venv lost a VERIFIED fixture. This slice fixes the in-place gap the F1b review reproduced: SIGINT or SIGTERM leaves the user's checkout on the loki/e10 run branch and can orphan the worker | loki-ts/src/engine10 supervisor (signal path), e10ext helper if needed, tests, dist | SIGINT and SIGTERM mid-run: original branch checked out, worker PID gone, run branch kept; never reset or discard user files | MEDIUM | released@2026-10-17T03:50Z | none Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| D51-B01 | D51 Phase B B01 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): Test harness: register `tests/test-workspace.sh`, which sources `tests/workspace/*.sh` parts (each later slice adds only its own part) | tests/test-workspace.sh, tests/run-all-tests.sh, scripts/local-ci.sh, tests/workspace/00-smoke.sh | runner lists the suite; an empty part dir passes 1/0; shellcheck clean | LOW | released@2026-10-17T03:50Z | none Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| D51-B02 | D51 Phase B B02 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): Schema plus validator for `workspaces` (repos, path, setup, after, integration, integration_files); `after` cycle and unknown-repo rejection | schemas/loki-yaml.schema.json, autonomy/lib/loki_yaml.py, tests/workspace/10-schema.sh | a valid sample passes; a cycle, an unknown `after` and a non-ignored integration file are each rejected with a named error | MEDIUM | parked | needs B01 Superseded 04:45Z: delivered by D65-MULTI 5d9e6b341, C8 089ca0e9e, D61-07 6bf2c7799 (workspace.py runner/after/SKIPPED/killpg/integration.json/task_for, worktree_prep lock+deps, cmd_workspace). |
-| D51-B03 | D51 Phase B B03 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): worktree_prep core: start ref, per-base lock, left-out-edits line, stamped dirs, never delete a kept tree | autonomy/lib/worktree_prep.py, tests/workspace/20-prep.sh | a dirty source fixture yields a worktree tree equal to base; 4 parallel preps on one base all succeed; a relaunch keeps the old dir | HIGH | parked | needs B01 Superseded 04:45Z: delivered by D65-MULTI 5d9e6b341, C8 089ca0e9e, D61-07 6bf2c7799 (workspace.py runner/after/SKIPPED/killpg/integration.json/task_for, worktree_prep lock+deps, cmd_workspace). |
-| D51-B04 | D51 Phase B B04 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): Dependency strategy: setup, CoW copy, ignore check, escape detection | autonomy/lib/worktree_deps.py, tests/workspace/30-deps.sh | editable-install venv fixture: copy refused, setup path imports worktree code; absolute-symlink node_modules refused; a non-ignored dir is never copied | HIGH | parked | needs B02/B03 Superseded 04:45Z: delivered by D65-MULTI 5d9e6b341, C8 089ca0e9e, D61-07 6bf2c7799 (workspace.py runner/after/SKIPPED/killpg/integration.json/task_for, worktree_prep lock+deps, cmd_workspace). |
-| D51-B05 | D51 Phase B B05 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): Adopt worktree_prep in backlog.py behind the flag (also closes A3b relaunch) | autonomy/lib/backlog.py, tests/test-backlog.sh | flag off: backlog 47/0 unchanged; flag on: a JS fixture issue reaches VERIFIED with node_modules present | MEDIUM | released@2026-10-17T03:50Z | needs B04 04:45Z: deps met by worktree_prep.py (D61-07) and workspace.py (D65-MULTI); still unbuilt. c1095889f; TL APPROVE; backlog 49/0 on and off, api_start_prep 2/0. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| D51-B06 | D51 Phase B B06 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): Adopt worktree_prep in api_start._prepare_workdir behind the flag | dashboard/api_start.py, tests/dashboard/test_api_start_prep.py | flag on: the UI path uses the same lock and deps; flag off: byte-identical behavior | MEDIUM | released@2026-10-17T03:50Z | needs B04 04:45Z: deps met by worktree_prep.py (D61-07) and workspace.py (D65-MULTI); still unbuilt. c1095889f; TL APPROVE; backlog 49/0 on and off, api_start_prep 2/0. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| D51-B07 | D51 Phase B B07 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): group.json store: atomic write, single writer, reader API | autonomy/lib/workspace_state.py, tests/workspace/40-state.sh | a killed writer never leaves a partial file; a second writer pid is refused | MEDIUM | parked | needs B01 Superseded 04:45Z: delivered by D65-MULTI 5d9e6b341, C8 089ca0e9e, D61-07 6bf2c7799 (workspace.py runner/after/SKIPPED/killpg/integration.json/task_for, worktree_prep lock+deps, cmd_workspace). |
-| D51-B08 | D51 Phase B B08 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): Runner: fan-out per repo, `after` ordering, SKIPPED on predecessor failure, killpg on SIGTERM, exit codes | autonomy/lib/workspace.py, tests/workspace/50-run.sh | stub launcher: parallel repos overlap, the dependent starts after the predecessor, a failing predecessor marks the dependent SKIPPED, SIGTERM leaves no child alive | HIGH | parked | needs B07/B03/B04 Superseded 04:45Z: delivered by D65-MULTI 5d9e6b341, C8 089ca0e9e, D61-07 6bf2c7799 (workspace.py runner/after/SKIPPED/killpg/integration.json/task_for, worktree_prep lock+deps, cmd_workspace). |
-| D51-B09 | D51 Phase B B09 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): Per-repo task text: section split, preamble, `LOKI_E10_TASK_TEXT` only (no issue.json in the run) | autonomy/lib/workspace_task.py, tests/workspace/60-task.sh | a 2-section issue gives each repo only its section; no issue.json exists in either run dir; untrusted text is never placed in argv | HIGH | parked | needs B08 Superseded 04:45Z: delivered by D65-MULTI 5d9e6b341, C8 089ca0e9e, D61-07 6bf2c7799 (workspace.py runner/after/SKIPPED/killpg/integration.json/task_for, worktree_prep lock+deps, cmd_workspace). |
-| D51-B10 | D51 Phase B B10 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): Integration runner plus evidence.json (not a Seal) | autonomy/lib/workspace_integration.py, tests/workspace/70-integration.sh | a passing compose stub gives exit 0 and matching SHAs; a timeout is FAILED, never passed; integration_files absent from every engine worktree | HIGH | parked | needs B08 Superseded 04:45Z: delivered by D65-MULTI 5d9e6b341, C8 089ca0e9e, D61-07 6bf2c7799 (workspace.py runner/after/SKIPPED/killpg/integration.json/task_for, worktree_prep lock+deps, cmd_workspace). |
-| D51-B11 | D51 Phase B B11 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): PR comment with the integration result, via the existing gh token path (no LLM in the step) | autonomy/lib/workspace_comment.py, tests/workspace/80-comment.sh | stub gh receives one comment per PR; the token appears in no log or argv | MEDIUM | released@2026-10-17T03:50Z | needs B09/B10 04:45Z: deps met by worktree_prep.py (D61-07) and workspace.py (D65-MULTI); still unbuilt. Built c09dfd1eb+933ecc9fc; TL APPROVE r2 (r1 BLOCK: CHANGELOG x279, body perms); test-workspace 14/0 on main. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| D51-B12 | D51 Phase B B12 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): CLI `loki workspace` subcommand (list, show, run, status, clean) | autonomy/loki, tests/workspace/90-cli.sh | flag off: the command says it is disabled; `clean` never removes a worktree whose branch has an open PR | MEDIUM | parked | needs B08 Superseded 04:45Z: delivered by D65-MULTI 5d9e6b341, C8 089ca0e9e, D61-07 6bf2c7799 (workspace.py runner/after/SKIPPED/killpg/integration.json/task_for, worktree_prep lock+deps, cmd_workspace). |
-| D51-B13 | D51 Phase B B13 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): Dashboard endpoints reading group.json; run launches a detached runner | dashboard/api_workspaces.py, dashboard/server.py, tests/dashboard/test_api_workspaces.py | the group survives an app restart; non-loopback Host gets 403; control scope required for run | HIGH | parked@2026-10-03T09:52Z | superseded by D51-B13r (integration.json, no group.json) |
-| D51-B14 | D51 Phase B B14 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): Dashboard group card (per-repo rows, integration row, stale-evidence badge) | legacy-ui-static/start.html | Playwright: a fixture group renders 2 repo rows plus integration; a mismatched head SHA shows stale | LOW | parked@2026-10-03T09:52Z | superseded by D51-B14r |
-| D51-B15 | D51 Phase B B15 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): 10x metric: PRs per wall-clock hour and per attention minute from group.json timestamps | autonomy/lib/workspace_metrics.py, tests/workspace/95-metrics.sh | a fixture group gives the hand-computed rate; unmeasured runs are reported, not counted as zero | LOW | parked@2026-10-03T09:40Z | Superseded by PO-WS-METRICS-1 (624b5d964, merged): integration.json timestamps plus workspace_metrics.py. |
-| D51-B16 | D51 Phase B B16 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): Docs plus flag flip after the whole-feature Wall: a 2-repo fixture (lib and app) ends with 2 PRs and integration passed | docs/WORKSPACES.md, tests/workspace/99-e2e.sh | the e2e part passes on CI with the stub provider; one real run is recorded in METRICS.md | MEDIUM | parked@2026-10-03T09:52Z | superseded by D51-B16r (flag flip already landed, D63 C8) |
-| INTEL-1 | Standards-based receipts (competitive intel 2026-10-01): emit the Seal as an in-toto Statement in a DSSE envelope, verifiable by stock tools (in-toto verify, cosign verify-blob) as well as loki verify; V10-VISION names this stack | loki-ts/src/engine10 seal and receipt export, loki keys, tests, dist | a stock tool verifies a real receipt in a test; a tampered envelope fails both the stock tool and loki verify | HIGH | released@2026-10-16T00:49Z | main c3031c9aa, opus APPROVE (14 probes, dsse+verify_cmd 44/0); dist rebuilt, guard 13/0; follow-ups in INTEL-1b |
-| INTEL-1b | INTEL-1 opus non-blocking follow-ups: (1) all-unknown-keyid multi-sig envelope returns UNCHECKED rc 2 not TAMPERED, and document threshold-of-1; (2) export refuses unless outcome VERIFIED or ALREADY_SATISFIED (a FAILED run exports rc 0 today; docs say "a verified v10 receipt"); (3) envelope on the run-id path requires predicate.run_id equal to the run id, or envelopes only via explicit file path; (4) export reads the receipt once and signs the verified bytes; (5) keyid follows receipt kid after rotation | loki-ts/src (dsse export and verify), loki-ts/tests/engine10/dsse.test.ts, CHANGELOG.md, docs | HIGH | red-then-green test per item; dsse+verify_cmd green; dist guard 13/0 | released@2026-10-16T00:49Z | merged d64de6b5b, 794566ce6 (opus HIGH r2 APPROVE; 71/0, guard 13/0); r2 92775fa58 in opus HIGH re-review (group export fixed, core delta 0); r1 HIGH BLOCK: export read hook leaked into verifyGroup, so a genuine group receipt read as TAMPERED; r2 fixes in progress; opus HIGH review dispatched for d6c8f797f; Source: INTEL-1 opus review 08:35Z. Sonnet builder dispatched; opus HIGH review after |
-| INTEL-2 | Visible hard cost cap by default: the v10 start line shows the per-run cap; BUDGET_STOP (exit 3) enforces it; loki.yaml budgets.per_run or --max-cost sets it; conservative default with rationale in DECISIONS. Check what already exists first (BUDGET_STOP, LOKI_E10_CAP_S) | engine10 start line and budget path, loki.yaml schema, docs, tests | a run over the cap stops with exit 3 and BUDGET_STOP; the start line names the cap; the default is recorded in DECISIONS | MEDIUM | released@2026-10-16T00:49Z | none |
-| INTEL-3 | Reviewer-first PR body: delivery contract, each acceptance criterion mapped to changed files and the proving check, then NOT PROVEN, readable in 60 seconds | engine10 pr body rendering, tests | a fixture PR body lists every Wall criterion with its file and check; NOT PROVEN last; under a fixed line budget | MEDIUM | released@2026-10-16T00:49Z | main 0bab386c2+d4865ed9e, TL r2 APPROVE (3 mutations red); dist rebuilt, guard 13/0, features 91/0 |
-| D50-F1b | D50-F1 structural follow-up (CTO call B): run engine10 in a worktree on base per run instead of the user checkout, copying uncommitted user edits in via git stash create; run files stay under the user .loki; PR pushes from the worktree branch; removes the restore and pre-existing-dirty class by construction | loki-ts/src/engine10 supervisor, worker, intake, seal/discard, pr, their tests, dist | user checkout byte-identical after any outcome; dirty user edits visible to the run; ALREADY_SATISFIED leaves no diff; VERIFIED opens the PR from the worktree branch | HIGH | parked@2026-10-01T12:20Z: e69eeec2 REJECTED by opus. Blocking: dirty user edits snapshotted into the pushed branch and receipt base; ignored deps (node_modules, .venv, .env) absent in the worktree, VERIFIED fixture STALLED. Rework needs refuse-dirty in main(), start from HEAD, a dependency strategy (CoW clone or install step) and kill cleanup; CTO call | D50-F1 |
-| A-120 | One signing key, auto-generated (item 3) | see plan A-120 | HIGH | first-run-gate assertion per plan card | released@2026-10-01T00:52Z | Wave per plan section 5; one writer per file. Released in v10.5.13 (merge 1e1417b9 is an ancestor of v10.5.13). |
-| A-132 | Legacy: no HANDOFF.md, USAGE.md or lockfile in a fix commit (item 2) | see plan A-132 | MEDIUM | first-run-gate assertion per plan card | released@2026-10-01T00:52Z | Wave per plan section 5; one writer per file. Released in v10.5.13 (merge 297c2d1f is an ancestor of v10.5.13). |
-| A-133 | Legacy: skip Council evidence probes on a trivial diff (item 2) | see plan A-133 | HIGH | first-run-gate assertion per plan card | released@2026-10-16T00:49Z | Wave per plan section 5; one writer per file. |
-| A-132b | A-132 card promised build_prompt fixture-61 (the gated quick-PRD case) but the merged slice never committed it; it sits untracked in the A-132-133 worktree. Commit it with its index.json entry, prove it passes and is red with the gate removed | loki-ts/tests/fixtures/build_prompt/fixture-61/, index.json | LOW | build_prompt.test.ts covers fixture-61 | released@2026-10-01T00:52Z | worktree .claude/worktrees/agent-a101928295ea43bb7 holds the files Released in v10.5.13 (merge 297c2d1f is an ancestor of v10.5.13). |
-| A-103 | Wall never leaves a test that fails for unrelated reasons (item 1) | see plan A-103 | HIGH | first-run-gate assertion per plan card | released@2026-10-01T00:52Z | Wave per plan section 5; one writer per file. Released in v10.5.13 (merge 634124cb is an ancestor of v10.5.13). |
-| A-111 | Empty, skipped or hung checks are NOT VERIFIED (item 5) | see plan A-111 | HIGH | first-run-gate assertion per plan card | released@2026-10-01T00:52Z | Wave per plan section 5; one writer per file. Released in v10.5.13 (merge fa082acc is an ancestor of v10.5.13). |
-| A-103c | A-103 opus note: apply the missing-module not_run rule only when node's failing-tests block shows a file-level `test failed`, so a child node process crashing on a missing package (inherited stdio) cannot discard a real TypeError red; add the child-crash fixture | loki-ts/src/engine10/stages/wall.ts, loki-ts/tests/engine10/wall_runner.test.ts | HIGH | child-crash fixture red | released@2026-10-01T00:52Z | after A-103 Released in v10.5.13 (merge 774885e3 is an ancestor of v10.5.13). |
-| A-103d | A-103c opus note: nested Jest globals on node 20/22 TAP (`t.test("inner", () => expect(...))`) classify red (a false FAILED that keeps a bad Wall test) because nested yaml is indented 6 spaces and `^ {2}name:` misses it; node 26 gives not_run. Match `^ +name:` and `^ +stack:` at any indent. Pre-existing since 0cc1dea4 | loki-ts/src/engine10/stages/wall.ts, wall_runner.test.ts | HIGH | nested Jest-globals fixture not_run on node 20/22/26 | released@2026-10-01T00:52Z | CI runs node 22 Released in v10.5.13 (merge 634124cb is an ancestor of v10.5.13). |
-| A-111b | A-111 opus note: discount a zero-test trailer only when the test name equals the path under test, so one real passing test named like a bare filename (`a.test.js`) is not not_run | loki-ts/src/engine10/stages/verify.ts, its test | MEDIUM | bare-filename-named test passes | released@2026-10-16T00:49Z | after A-113 (verify.ts) |
-| E-154 | Incident 17:14Z: tests wrote real signing keys to the founder's `~/.loki/keys` once signing became default (A-121, A-122 builders). Central guard: tests/run-all-tests.sh, the bun test preload and conftest set LOKI_RECEIPT_SIGNING_KEY_FILE/HOME to a run-owned path, plus a check that fails when a test run creates `~/.loki/keys` | tests/run-all-tests.sh, loki-ts bunfig preload, tests/conftest.py, new guard test | MEDIUM | guard test red when a test writes the real key dir | released@2026-10-01T01:19Z | after A-121, A-122 Released in v10.5.14 (merge 0d8a5dce is an ancestor of v10.5.14). |
-| E-155 | Incident 21:58Z: a shell test run from the MAIN checkout (633 diff-selected tests, xargs -P 4, 17:58:16 local) switched HEAD to the stale branch loki/session-1789047299-95963; main ref intact, restored by `git checkout main` 33s later. Candidates running that second: test-metrics-command, test-metrics-json-unmeasured, test-migration-post-edit-revert, test-mirofish-integration, test-magic-injection. A stray root bun.lock also appeared at 17:54. Guard: tests/run-all-tests.sh records `git symbolic-ref HEAD` + status before and fails loudly when any test changes the parent checkout branch; bisect the culprit with that guard | tests/run-all-tests.sh, culprit test | MEDIUM | guard test red when a test runs git checkout in the parent repo | released@2026-10-16T00:49Z | process fix already applied: shell batches run only in a disposable worktree |
-| E-154c | CORRECTED PREMISE (builder, 59c1cb54): CI shards set LOKI_TEST_SHARD, not LOKI_TEST_LIST (a list-only mode that runs nothing), so sharded CI DOES run the guards; the train/14 failure was the guard test inheriting LOKI_TEST_SHARD. Slice adds shard-mode guard checks only. Original claim: the E-154/E-155 guards (run-owned signing key default, real ~/.loki/keys snapshot, parent HEAD check) are skipped whenever LOKI_TEST_LIST is set, and CI shards set it, so sharded CI runs carry NO guard: a test writing the real key dir or switching the parent branch would pass on CI. Make the guards active in shard mode too (the LOKI_TEST_LIST skip was presumably for selective local runs) and keep the guard test hermetic | tests/run-all-tests.sh, tests/test-e154-e155-guards.sh | MEDIUM | guard checks run and pass under LOKI_TEST_LIST | released@2026-10-01T01:19Z | found while fixing train/14 shard 6 Released in v10.5.14 (merge 0d8a5dce is an ancestor of v10.5.14). |
-| E-156 | Incident 22:00Z: pre-push gitleaks (generic-api-key) blocked train/11 on the key FILE NAME string `.loki/keys/receipt-ed25519.pem` (seal.ts:68, seal.test.ts:174, dist/loki.js:1244); no key material. Fixed by exact .gitleaksignore fingerprints, but any future commit that rewrites the minified dist line re-triggers and can block a release push. Durable fix needs a CTO call: a narrow `.gitleaks.toml` allowlist (regexTarget=secret, `^receipt-ed25519\.pem$`, extend defaults) pushed with LOKI_ALLOW_GITLEAKS_CONFIG_CHANGE=1 plus a test that a real key in the same position is still caught | .gitleaks.toml, tests/test-pre-push-gitleaks.sh | HIGH | real-key fixture still flagged; filename allowed | released@2026-10-01T01:19Z | CTO approval (security scan config) Released in v10.5.14 (merge 314b89fe is an ancestor of v10.5.14). |
-| E-157 | D46: Security Audit verdict reuse. (a) security-audit.yml also runs on push to train/** so every train tip gets the full --all gitleaks scan before main is fast-forwarded; (b) required-ci reuses the parent Security Audit verdict for an eligible VERSION-only bump under the existing eligibility rule (diff is VERSION plus generated version stamps only, parent run success at that exact SHA). Moat test: a non-VERSION-only bump still re-runs Security Audit. Supersedes FOUNDER-QUEUE 14 | .github/workflows/security-audit.yml, release.yml (required-ci), tests | HIGH | non-VERSION-only bump re-runs the scan | released@2026-10-16T00:49Z | after slice-D46-ci; r3 opus APPROVE 57b511d2; DROPPED from train/21 (D46): STEP 1 re-indent broke S-132 normalizer parity (test-version-bump-only 28/1), reverted 7d1a0f15, r4 with CI-health |
-| E-159 | Pre-existing secret-scan gaps found by the E-157 r2 opus reviewer: (a) an evil merge, a merge commit whose OWN content adds a secret (merge -s ours --no-commit, token in the merge commit), is invisible to both the PARENT..SHA range scan and the --all scan (only `gitleaks dir` found it); (b) pinned gitleaks 8.30.0 exits 0 when its internal git log fails (invalid range), a latent fail-open. Fix: --diff-merges=first-parent (or -m) in --log-opts for both modes or a working-tree scan at the release SHA; guard `git rev-list RANGE` success or treat `[git] fatal` as failure | scripts/security-audit-gitleaks.sh, workflows, tests | HIGH | evil-merge and bad-range fixtures fail the scan | released@2026-10-16T00:49Z | CI-health engineer after E-157 r3; r1 opus REJECT 5f33451d: stdin merge scan false-positives on real history (v10.5.13..14 rc 1), Wall checks skip in CI |
-| E-160 | D46 runner contention (peer steer 02:11Z): a green train SHA fast-forwarded to main re-runs Tests (8 shards), Bun Parity, Security Audit and First-run gate on the identical SHA, doubling runner load and queueing the next train. Proposal: on push to main, a first job checks for a successful run of the same workflow at the same SHA from a train/** push and, if found, exits success recording the reused run id (D28: same SHA = same tree); any SHA not train-tested runs in full. CTO call FIRST: OPERATING-MODEL says "Tier B full verification on every main commit (never cancelled on main)"; confirm reuse does not weaken Release required-ci, branch-conditional steps (train vs main), or the Security Audit range (base tag config). Sequence after E-157 r4 (same files) | .github/workflows/test.yml, bun-parity.yml, security-audit.yml, tests/test_release_required_ci.py | HIGH | main push of a train-green SHA records reuse and finishes in under 1 min; an untested SHA runs in full; a train-red SHA is not reused | released@2026-10-03T09:41Z | Stale ready row: already merged as 943355729 (opus approved, D55) and shipped in v10.6.0. A 09:40Z builder found no diff. |
-| E-161 | INCIDENT 02:46Z: an opus reviewer ran `git checkout --detach <tag>` x7 plus a `.gitleaksignore` overwrite in the SHARED main checkout (reflog 02:46:04Z to 02:46:38Z). Cause: its run-owned clone dir was deleted, the next `cd` into a new clone failed, and the shell cwd fell back to the main checkout; every later command ran there. Restored by the Chief of Staff (`git checkout main`, fafe50dd, clean). Guard: v10-guard.sh (PreToolUse) blocks `git checkout`/`git switch`/`git reset`/`git worktree remove` and writes to tracked files when cwd resolves to the main checkout and the caller is an agent (not the leader session); agent prompts use `cd DIR` followed by an exit-on-failure check. Test: a hook test with cwd=main checkout blocks a detached checkout and allows it in a worktree | scripts/v10-guard.sh, tests | HIGH | detached checkout in main checkout blocked; same in a worktree allowed | released@2026-10-16T00:49Z | GUARDS.md entry |
-| E-162 | Founder "faster" (03:05Z): slice CI runs only Tier A plus diff-selected suites (the existing Tier A selection), Bun Parity and the structural guards; the full 8-shard Tests stays on train/** and main, and the train stays the release verdict. Frees runners and targets about 2 min slice CI | .github/workflows/test.yml (slice-* job matrix only), tests | HIGH | slice-* push runs no 8-shard matrix; train/** and main still run all 8 shards; a slice touching a suite runs that suite | released@2026-10-16T00:49Z | after E-157 r4 (same file) |
-| E-165 | tests/test-mirofish-integration.sh line 413 runs `autonomy/loki start --no-mirofish` in the repo root: a live autonomous build that ran about 45 min, switched a worktree branch to loki/session-* and committed a docs change (found by DOC-02). Guard: the test must run against a run-owned fixture repo with a stub provider and LOKI_NO_BROWSER=1, never the repo root; add a structural guard that no test launches start/run against REPO_ROOT | tests/test-mirofish-integration.sh, a structural guard | HIGH | the test never runs loki start in the repo root; guard catches a planted case | released@2026-10-16T00:49Z | P0 guard (D26) |
-| E-166 | Jira auto-sync never starts: src/integrations/sync-subscriber.js builds JiraApiClient without the required email and apiToken, so LOKI_JIRA_URL plus LOKI_JIRA_TOKEN do nothing (DOC-02 added a known-issue note to the setup docs). Fix the wiring or remove the advertised auto-sync | src/integrations/sync-subscriber.js, tests | MEDIUM | with env set, the subscriber constructs a working client (mocked API) | released@2026-10-16T00:49Z | none |
-| P0-promote-bun | Auto-promote of 10.5.22 failed: promote.yml ran the first-run gate without bun, the installed CLI fell back to legacy, 7 v10 checks failed and the cost check crashed (IndexError). Install bun before the gate; cost check fails closed; explicit engine-fallback check | .github/workflows/promote.yml, scripts/first-run-gate.sh, tests/test-first-run-gate.sh | test-first-run-gate 56/0 incl. fallback fixture; gate --stub 0 failed | HIGH | released@2026-10-17T03:50Z | opus CTO APPROVE 5bdfe2f8 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| E-167 | Gate the no-bun path end to end (CTO follow-up to P0-promote-bun): run the default entry with bun absent from PATH and assert the legacy receipt, NOT VERIFIED on a skipped target and the documented exit codes, with the legacy 15-line budget and legacy verify (the v10 leg keeps 8 lines; scripts/first-run-gate.sh:123 forces LOKI_ENGINE=v10 for verify, which is why a bun-less run failed digest, verify and signed); the promote gate currently proves only the bun path | scripts/first-run-gate.sh, tests/test-first-run-gate.sh | no-bun stub run fails closed on a skipped test; clean no-bun run reads its legacy receipt | MEDIUM | released@2026-10-16T00:49Z | none |
-| E-161b | E-161 false block: the hook judges a detaching checkout by the hook cwd (the main checkout) and ignores a preceding checked cd into a linked worktree; at 07:20Z a cd into the release worktree followed by git checkout --detach was blocked (RULE8), and the release only proceeded via git -C. Resolve the effective directory from a leading checked cd or from git -C before applying RULE8 | scripts/v10-guard.sh, tests/test-v10-guard.sh | checked cd into a linked worktree then detach: allowed; cwd main with no cd: blocked; git -C linked: allowed | HIGH | released@2026-10-16T00:49Z | none |
-| P0-nobun | D48 flip does nothing on a bun-less npm install: bin/loki falls back to legacy without bun, and loki-ts/dist/loki.js is built for target bun (node gives ReferenceError: Bun is not defined). Make the Loki 10 engine run without a preinstalled bun (node-runnable build, or bun shipped as an npm dependency) and, when neither works, say so plainly on the start line. Architect plan first | bin/loki, loki-ts/scripts/build.ts, package.json (per plan) | bun-less host runs the v10 default or prints the plain cannot-run line; promote gate no-bun leg (E-167) passes | HIGH | released@2026-10-17T03:50Z | opus architect plan in progress Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| E-169 | Docker image and Homebrew formula use the same bun resolver as bin/loki (peer condition 3 for founder queue 17): the Docker image must contain a working bun so the default runs Loki 10; the Homebrew formula must either depend on bun or let the resolver print the plain cannot-run line | Dockerfile, Dockerfile.sandbox, the Homebrew formula (find it) | docker run of the image prints the Loki 10 start line; brew-style layout resolves bun or prints the plain line | MEDIUM | released@2026-10-16T00:49Z | none |
-| E-170 | Verify what still works after npm install --omit=optional before documenting it as a slim install: it also drops the existing @anthropic-ai optional packages (about 247MB of the measured 370MB delta). List which commands break and either document the slim path with its limits or recommend against it | package.json, docs/INSTALLATION.md | a scripted --omit=optional install runs loki --version, loki quick on the stub provider and loki verify; results recorded | LOW | released@2026-10-16T00:49Z | measured 08:33Z on 10.5.25 (haiku): slim 30,280 KB vs full 407,656 KB; omits @anthropic-ai/claude-agent-sdk, bun, @opentelemetry/*; --version, help, doctor and quick (stub claude) reported rc 0. NOT yet documented: the report omitted the stderr evidence of the plain cannot-run line on quick; re-check that before adding the slim path to docs/INSTALLATION.md |
-| D49-auto | Auto-promote to latest on Post-Release Smoke success (founder D49) | .github/workflows/promote.yml, tests/test_release_next_tag.py | HIGH | smoke-success from Release promotes; manual smoke never promotes; not-lower guard | released@2026-10-17T03:50Z | opus APPROVE 5510b8c8. Follow-ups (D49-auto-b): not-lower guard fails OPEN on an npm error (make it fail closed); loki-mode-sdk latest has no not-lower guard; a newer queued promote can replace a pending one in a release burst Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| D51-A3 | Headless `loki backlog owner/repo --all/--label/--issues` plus loki.yaml (schema, validator, env overrides) | autonomy/lib/backlog.py, autonomy/lib/loki_yaml.py, autonomy/loki, schemas/loki-yaml.schema.json, tests/test-backlog.sh | HIGH | backlog 47/0 | released@2026-10-17T03:50Z | sonnet APPROVE 14ff9ae2; follow-up D51-A3b: `loki_yaml.py show` echoes a token pasted into git.token_env (redact x-secret-ref fields); no-parser test case; re-run of a failed issue discards its kept worktree Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| D51-A4 | Slack on the v10 path (PR opened, BLOCKED, finished), webhook from the env var named by LOKI_SLACK_WEBHOOK_ENV, URL redacted, 5s bounded post | loki-ts/src/e10ext/slack_events.ts, engine10/supervisor.ts, tests | MEDIUM | slack tests 40/0 | released@2026-10-17T03:50Z | sonnet APPROVE adb838b2; one labelled test message after it ships Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| D48-r10 | loki-seal in the repo plugin marketplace (`/plugin marketplace add asklokesh/loki-mode`, `/plugin install loki-seal@loki-mode`), README line 4 | .claude-plugin/marketplace.json, README.md, tests/test-loki-seal-marketplace.sh | MEDIUM | clean-HOME install works; marketplace test 8/0 | released@2026-10-17T03:50Z | sonnet APPROVE 5ecab20d; nit: blank line between README lines 3 and 4 (DOC-01 owns README) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| P0-t15 | train/15 and train/17 red: quiet `loki quick` default output 16 lines (stderr noise: mkdir .loki/config File exists, 2 caveman bootstrap lines, echo broken pipe). Fix: caveman notices to the quiet run log, fold a sentinel-only .loki/config into the config dir (never ~/.loki), SIGPIPE reset via python3 re-exec guarded by an import probe | autonomy/run.sh, autonomy/loki, tests/test-quick-config-safety.sh | MEDIUM | default output at most 15 lines; ~/.loki/config untouched from $HOME; broken python3 still runs | released@2026-10-01T02:27Z | r1 REJECT (config clobber, python3 guard); r2 54da8960 APPROVE (config-safety 5/0, receipt-order 14/0 at 12 lines, crash-cli 57/0) Released in v10.5.16 (merge e7e39e27 is an ancestor of v10.5.16). |
-| A-113 | Stop reasons: STALLED and the fatal classifier (item 5) | see plan A-113 | HIGH | first-run-gate assertion per plan card | released@2026-10-01T01:19Z | Wave per plan section 5; one writer per file. Released in v10.5.14 (merge 0377398d is an ancestor of v10.5.14). |
-| A-114 | FALSE VERIFIED ON MAIN (found by the A-112 opus reviewer, repro m6 on 4ad430ad): bugrepo plus an unrelated red test; the agent changes only other.js; verify selects only node:other.test.js (testmap from the diff), so the task's own target test sums.test.js is never run and the run seals VERIFIED rc=0 while it is red. Fix: the relevant tests of the task-named files (hasRelevantTests / impacted(likely), the lean-path Wall stand-in) are ALWAYS selected by verify, whatever the diff touches | loki-ts/src/engine10/stages/verify.ts or testmap selection, tests | HIGH | m6 fixture seals FAILED | released@2026-10-16T00:49Z | coordinate with A-112 (verify.ts, same target notion); P0 moat |
-| A-115 | TIER 0 (steer 22:50Z). FALSE VERIFIED ON MAIN (A-112 opus reviewer, c10 on 275b4fc0): a conftest.py that skips the target test (and the unrelated red one) seals VERIFIED rc=0, "2 passed, 2 skipped", nothing disclosed. Seal accuracy: a relevant check with more skipped tests than base, or a diff touching conftest.py / pytest.ini / pyproject [tool.pytest] / jest or node test config, must not count as a pass or as progress; list it in NOT PROVEN | loki-ts/src/engine10/stages/verify.ts, failures.ts, tests | HIGH | c10 and e9 fixtures seal FAILED or NOT VERIFIED | released@2026-10-01T00:52Z | core at the 5000 cap: needs an offset (A-150) Released in v10.5.13 (merge bdb332e3 is an ancestor of v10.5.13). |
-| A-115b | A-115 opus notes: (1) an honest fix that also appends a new test to a relevant test file, in a repo with an unrelated red test, ends STALLED/FAILED instead of PARTIAL: the edited file is excluded from progress so the unrelated red is never subtracted; allow progress when the file's pre-existing target ids went red to green; (2) the node base-count fallback sums every `pass N`/`fail N` line, so a base test printing them inflates the count (safe-direction false PARTIAL); take the last pass and last fail lines | loki-ts/src/engine10/stages/verify.ts, verify_weak.test.ts | HIGH | both fixtures | released@2026-10-01T01:53Z | Released in v10.5.15 (merge 945f58ec is an ancestor of v10.5.15). |
-| A-119 | P0 FALSE VERIFIED ON MAIN (A-115b opus reviewer, reproduced on bba2e5ec): rename the target test file and weaken its expectation (sum.test.js => sum.spec.test.js with 6 changed to 5), add a comment to sum.js: rc=0 Outcome VERIFIED, receipt shows node:sum.spec.test.js pass, sum.js still buggy. verify only sees relevant test files that still exist on head; seal writes `weakened test: sum.test.js` (seal.ts:205) but that line never downgrades the verdict. Fix: seal's `weakened test:` downgrades to PARTIAL like verify's not_proven | loki-ts/src/engine10/stages/seal.ts, tests | HIGH | rename-and-weaken fixture: not VERIFIED, rc!=0 | released@2026-10-01T01:53Z | Tier 0 Released in v10.5.15 (merge c41a2b83 is an ancestor of v10.5.15). |
-| A-119b | A-119 opus review (REJECT on pre-existing holes, A-119 landed as a strict improvement): weakening still ends VERIFIED via (1) a helper file a base test imports (eq=()=>{}), (2) snapshot or fixture edits (__snapshots__/*.snap, tests/fixtures/*.json), (3) tests isTestFile (testmap.ts:51) does not recognise: __tests__/*.js, mocha test/*.js, cargo tests/*.rs, including rename to .bak. Also: verdictOf returns ALREADY_SATISFIED before the weakened downgrade when implement says already_done; package.json jest testPathIgnorePatterns and vite.config.ts test.exclude skip config detection. Fix: widen the seal.ts weakTests predicate to any changed/deleted base path under test/, tests/, __tests__/, __snapshots__/, fixtures dirs plus non-test files a base test imports; check weakened before the already_done early return; add vite.config and in-block jest keys to CFG detection | loki-ts/src/engine10/stages/seal.ts, verify.ts (CFG only), tests | HIGH | each repro gives not-VERIFIED; source-only fix and new test stay VERIFIED | rejected@2026-10-01T05:12Z | |
-| A-117 | FALSE VERIFIED IN `loki verify` (A-130 r2 opus reviewer): on a run whose events.jsonl was tampered (append, edit, truncate, delete), the run now ends FAILED (A-130) but the receipt on disk still says VERIFIED with no tamper mark, because the worker sealed it before the supervisor detected the tamper; `loki verify` prints verdict: VERIFIED rc=0. Fix: record the tamper on the receipt via the registered receipt.addendum event (hash-chained) or have verify check the event log hash; verify must say TAMPERED and exit non-zero | loki-ts/src/engine10/verify_cmd.ts, supervisor.ts or seal.ts, tests | HIGH | tampered-log fixture: loki verify TAMPERED rc!=0 | released@2026-10-16T00:49Z | after A-130 (supervisor.ts); r2: opus REJECT, tail truncation erases post-seal tamper, fix = signed final log line |
-| A-118 | Exit-honest policy gap on the DEFAULT path (A-115 r2 finding): legacy `loki quick` prints `Evidence Receipt: NOT VERIFIED` yet exits rc 0 on a run whose target test was skipped; G1 exit-honest counts a skipped test as green, so it does not catch this. CTO call: should legacy quick exit non-zero on NOT VERIFIED when a relevant test was skipped/weakened, and should G1 count skipped as not-green? | autonomy/run.sh (quick exit path), scripts/first-run-gate.sh G1 | HIGH | skipped-target legacy run exits non-zero; G1 treats skipped as not green | released@2026-10-16T00:49Z | D47 decided: rc 3 on tests_integrity failed (skip added, runner config changed, test file deleted/renamed); assertion edits disclosed rc 0; G1 green needs pass 2 fail 0, 9b asserts rc 3. Files: proof-generator.py, run.sh after generate_proof_of_run, first-run-gate.sh, docs/exit-codes.md. Blocks promote of `latest`; built df404970, opus review |
-| A-112b | A-112 readability debt: subtractBase in verify.ts was folded to reach 4999 of 5000 core lines (9 lines over 200 chars, longest 347; un/progress/base-run loop each on one line). Unfold when A-150 frees budget; no behaviour change | loki-ts/src/engine10/stages/verify.ts | MEDIUM | budget test plus verify_prered unchanged | released v11.17.39 | after A-150 |
-| A-113b | A-110 opus notes on A-113: (1) under the CLI invoker (LOKI_E10_INVOKER=cli) the provider child stderr never reaches the fatal classifier (the *-impl.stderr.log is empty), so a credit/auth failure printed on plain stderr gives stop:null and burns the fix rounds; (2) machine.ts re-records the previous signature when a verify crashes, so a crashed verify counts toward a stall. Fix both in session.ts/machine.ts, with end-to-end tests through the real worker | loki-ts/src/engine10/session.ts, machine.ts, tests | HIGH | CLI stderr credit line stops fatal; crashed verify does not count as a stall repeat | released@2026-10-01T01:19Z | keep the A-110 escalated emit; the A-110 reviewer plugin probe is a good e2e template Released in v10.5.14 (merge 0377398d is an ancestor of v10.5.14). |
-| A-121 | v10 signs and verifies natively (item 3) | see plan A-121 | HIGH | first-run-gate assertion per plan card | released@2026-10-01T00:52Z | Wave per plan section 5; one writer per file. Released in v10.5.13 (merge 08b31271 is an ancestor of v10.5.13). |
-| A-122 | Delete the GPG signing layer (item 3, deletion) | see plan A-122 | HIGH | first-run-gate assertion per plan card | released@2026-10-01T00:52Z | Wave per plan section 5; one writer per file. Released in v10.5.13 (merge cb738c36 is an ancestor of v10.5.13). |
-| A-121b | A-121 opus note: a receipt downgrade exits 0. Anyone can edit the body, recompute receipt_sha256 and null the jwt to get UNSIGNED rc 0 on `loki verify`, and the legacy deploy gate refuses UNSIGNED but the v10 verify does not. Decide the signed-by-default policy: once a local key exists, UNSIGNED on a receipt from this machine exits non-zero (or the receipt records its kid outside the hashed body) | loki-ts/src/engine10/verify_cmd.ts, stages/seal.ts, tests | HIGH | downgrade fixture exits non-zero | released@2026-10-01T03:00Z | D47 decided: UNSIGNED exits 3 on both engines (verify_cmd.ts EXIT_BY_VERDICT, autonomy/verify.sh _verify_receipt_digest), --allow-unsigned / LOKI_VERIFY_ALLOW_UNSIGNED=1 accepts with explicit line; update tests/test-engine10-live-pr.sh 115-122; verify never creates a key |
-| A-121c | A-121b opus finding B: legacy `loki verify` passes a WELL-FORMED token with an unknown kid at rc 0 (`attestation: UNCHECKED`, `VERDICT: VERIFIED`) with or without the local key; engine10 gives rc 2. A forger can always mint such a token, so on legacy a downgrade-to-foreign-kid is a pass. D47 kept legacy UNCHECKED unchanged because it also covers honest cross-machine verification. CTO call: make legacy UNCHECKED non-zero (parity with engine10 rc 2), now that D48 row 2 adds `loki verify --pubkey` as the honest cross-machine path? Also: a missing .loki/state/last-proof-id.txt makes legacy verify skip the receipt check entirely and pass (pre-existing, A-134) | autonomy/loki (_deploy_receipt_verdict, verify), tests | HIGH | unknown-kid forged token exits non-zero on legacy; honest cross-machine path documented | released@2026-10-16T00:49Z | merged 1a8a9c7bc, 15c0a26eb (opus HIGH r2 APPROVE; receipt-order 38/0, quiet-tail 6/0, deploy-receipt-gate 27/0, exit-codes-documented 19/0) |
-| A-110 | One named outcome, fixed exit ladder, --json (items 1 and 5) | see plan A-110 | HIGH | first-run-gate assertion per plan card | released@2026-10-01T00:52Z | Wave per plan section 5; one writer per file. Released in v10.5.13 (merge 47ac1ccc is an ancestor of v10.5.13). |
-| A-112 | Baseline subtract: judge only the delta (item 5) | see plan A-112 | HIGH | first-run-gate assertion per plan card | released@2026-10-01T00:52Z | Wave per plan section 5; one writer per file. Released in v10.5.13 (merge 69f1a910 is an ancestor of v10.5.13). |
-| A-123 | Doctor: only the selected provider blocks, one Ready line (item 3) | see plan A-123 | MEDIUM | first-run-gate assertion per plan card | released@2026-10-01T00:52Z | Wave per plan section 5; one writer per file. Released in v10.5.13 (merge 275b4fc0 is an ancestor of v10.5.13). |
-| A-134 | Legacy: receipt after the final commit, chatter behind --verbose (item 2) | see plan A-134 | MEDIUM | first-run-gate assertion per plan card | released@2026-10-01T00:52Z | Wave per plan section 5; one writer per file. Released in v10.5.13 (merge 7d3edf96 is an ancestor of v10.5.13). |
-| A-134b | A-134 opus notes: (1) standalone autonomy/verify.sh prints no attestation line (only `loki verify` has _deploy_receipt_verdict); print `attestation: UNCHECKED (run via loki verify)` instead of silence; (2) the quiet failure tail grep `[Ff]ailed` matched the RALPH system-prompt line and printed ~1.5k chars; anchor to `^\[(ERROR|WARN)\]` or cap line length; (3) the quiet inner run starts as a background job so its stdin is /dev/null even from a TTY: pause-mode keypress resume changes for quiet runs; (4) `loki quick --verbose` is also the A-122 cmd_quick flag, done | autonomy/verify.sh, autonomy/run.sh | MEDIUM | each note has a test | released@2026-10-16T00:49Z | |
-| A-134c | A-134b r1 review finding: provider call sites in autonomy/run.sh (mainline claude -p at about 25455/25460, provider_invoke_argv about 1050/1053) do not redirect stdin, so under LOKI_VERBOSE=1 (and any non-quiet path) a parent stdin pipe that never closes blocks `claude -p` reading stdin (pre-existing). Fix: `< /dev/null` at provider invocations that pass the prompt as an argument | autonomy/run.sh (provider call sites only), providers/*.sh, tests | MEDIUM | never-closing stdin pipe: verbose `loki quick` completes under timeout 60 | released@2026-10-16T00:49Z | |
-| A-130 | v10 quiet by default (item 2) | see plan A-130 | MEDIUM | first-run-gate assertion per plan card | released@2026-10-01T01:19Z | Wave per plan section 5; one writer per file. Released in v10.5.14 (merge a518bfea is an ancestor of v10.5.14). |
-| A-130b | A-130 Reason line prints first_error from a failing check verbatim (capped at 200 chars, control chars stripped) but unredacted: a `ghp_` token in a test failure line reaches the terminal. No TS redactor is reachable from engine10 core (only autonomy/lib/proof_redact.py). Port the token patterns to a small TS helper outside core or redact first_error where it is captured in verify | loki-ts/src (util), verify.ts or output.ts, tests | MEDIUM | ghp_/sk- token in first_error prints redacted | released@2026-10-01T02:27Z | ; sonnet APPROVE be50510f (redaction before cap, parity with proof_redact.py) Released in v10.5.16 (merge f214a0fa is an ancestor of v10.5.16). |
-| D61-17 | D62 P1: D61 slice 17, speed eval tier (8 spd- tasks per D67, arms v10-parallel, v10-seq, raw-claude, tokens per completed) | eval/loki10/tasks/spd-*, eval/loki10/harness.py, eval/loki10/summarize, eval/loki10/test-harness.sh | MEDIUM | released@2026-10-16T00:49Z | train/82 e072e47a9. Harness 181 passed, 0 failed. D67 speed tier, not a D34 large-tier result. |
-| D61-01 | D62 P1: D61 slice 1, pre-model stage timer | engine10/supervisor.ts, engine10/output.ts, tests engine10/premodel_timing.test.ts | MEDIUM | released@2026-10-16T00:49Z | train/81 dd2995153, red on Tests; carried in train/82 e072e47a9. Behind LOKI_SPEED=1. |
-| D61-08 | D62 P1: D61 slice 8, deterministic decomposer DAG | new engine10/decompose.ts, tests engine10/decompose.test.ts | MEDIUM | released@2026-10-16T00:49Z | train/81 dd2995153, red on Tests; carried in train/82 e072e47a9. Behind LOKI_SPEED=1. |
-| D62-FIX | D62 P3: root action.yml routes to Loki 10 (no `--simple`), plus one real end-to-end BUDGET_STOP exit 3 test | action.yml, tests for action and budget e2e | MEDIUM | merged@2026-10-03T02:28Z | train/81 dd2995153, red on Tests; carried in train/82 e072e47a9. |
-| D61-02 | D62 P1: D61 slice 2, lean prefix default plus byte-identity guard | e10ext/lean_prefix.ts, stages/implement.ts, stages/fix.ts | MEDIUM | released@2026-10-16T00:49Z | train/80 5520e26ae, red on Tests (P9 CI flake that predates the train) and Coverage; carried in train/82 e072e47a9. |
-| D61-07 | D62 P1: D61 slice 7, worktree dependency prep | autonomy/lib/worktree_prep.py, tests/test-worktree-prep.sh | MEDIUM | released@2026-10-16T00:49Z | train/80 5520e26ae, red on Tests (P9 CI flake that predates the train) and Coverage; carried in train/82 e072e47a9. |
-| D62-VIS | D62 P2a: visual evidence in PRs (local Playwright screenshots of changed pages in the PR body) | loki-ts/src/features/visual_evidence.ts, engine10/stages/seal.ts, tests | MEDIUM | merged@2026-10-03T02:57Z | train/82 e072e47a9 with D12 B1-B3 fixes (e035e9929). LOKI_VISUAL_EVIDENCE stays off until the HIGH re-review approves. |
-| D62-JIRA | D62 P2c: Jira and Linear intake into v10 via autonomy/issue-providers.sh, intake only | loki-ts/src/features/tracker_intake.ts, tests | MEDIUM | merged@2026-10-03T02:28Z | train/81 dd2995153, red on Tests; carried in train/82 e072e47a9. |
-| D64-VIS | D64 1: visual evidence, local Playwright screenshots plus trace or video of changed pages in the PR body and receipt | new loki-ts/src/engine10/evidence_visual.ts, engine10/pr_body.ts hook, tests | MEDIUM | parked | D64 withdrawn 00:25Z; not started. |
-| D64-E2E | D64 2: verify runs the repo's Playwright or Cypress e2e when present; mobile only if already installed; never claim coverage that did not run | new loki-ts/src/engine10/e2e.ts, verify stage hook, tests | MEDIUM | parked | D64 withdrawn 00:25Z; not started. |
-| D64-SERVE | D64 4: loki serve webhooks (GitHub, Linear, Jira) and cron schedules in the Control Plane | packages/control-plane/src/server/triggers*, tests | MEDIUM | parked | D64 withdrawn 00:25Z; not started. |
-| D64-MERGE | D64 6: loki merge, merge queue landing approved Loki PRs in order with re-verify on the updated base | new loki-ts/src/engine10/merge_queue.ts, CLI arm, tests | MEDIUM | parked | D64 withdrawn 00:25Z; not started. |
-| D64-REVIEW | D64 7: loki review <pr> posts a review with a deterministic risk score | new loki-ts/src/engine10/review_risk.ts, CLI arm, tests | MEDIUM | parked | D64 withdrawn 00:25Z; not started. |
-| D64-PLAN | D64 8: loki plan shows contract, units and files for approval before running | new loki-ts/src/engine10/plan_mode.ts, CLI arm, tests | MEDIUM | parked | D64 withdrawn 00:25Z; not started. |
-| D64-MEM | D64 9: project memory (D50 item 3) in the v10 context pack | new loki-ts/src/e10ext/project_memory.ts, tests | MEDIUM | parked | D64 withdrawn 00:25Z; not started. |
-| D64-INTAKE | D64 10: Jira, Linear and Sentry intake into v10 via autonomy/issue-providers.sh | autonomy/issue-providers.sh, v10 intake ref parsing, tests | MEDIUM | parked | D64 withdrawn 00:25Z; not started. |
-| D64-EASE | D64 ease: first-run gate ease row (time to first PR, prompt count), published in METRICS | first-run gate script, docs/v10/FIRST-RUN-GATE.md, METRICS | MEDIUM | parked | D64 withdrawn 00:25Z; not started. |
-| D61-05 | D65: D61 slice 5, warm engine socket in the dashboard daemon | engine10/dashboard/server.ts, new engine10/warm.ts, tests | MEDIUM | released@2026-10-16T00:49Z | train/81 dd2995153, red on Tests; carried in train/82 e072e47a9. |
-| D61-06 | D65: D61 slice 6, CLI warm client with 50ms socket try and cold fallback | engine10/cli.ts, new engine10/warm_client.ts, tests | MEDIUM | released@2026-10-16T00:49Z | train/81 dd2995153, red on Tests; carried in train/82 e072e47a9. |
-| D65-CP | D65 D63-3: Control Plane as the default UI plus BLOCKED answer UI | packages/control-plane, loki control wiring | MEDIUM | merged@2026-10-03T02:28Z | train/81 dd2995153, red on Tests; carried in train/82 e072e47a9. |
-| D65-SLACK | D65 D63-4: Slack two-way (@loki starts a run, BLOCKED answers return) | new integrations slack module, docs | MEDIUM | merged@2026-10-03T02:28Z | train/81 dd2995153, red on Tests; carried in train/82 e072e47a9. |
-| D65-SPEC | D65 D63-6: spec to delivery contract with criteria traced in the receipt | loki-ts/src/features/contract.ts, receipt fields | MEDIUM | merged@2026-10-03T02:57Z | train/82 e072e47a9 with D12 C1 fixes (4bf0f5236) and spawn env (32b9db508). LOKI_CONTRACT stays off until the HIGH re-review approves. |
-| D65-MULTI | D65 D63-7: multi-repo workspaces, D51 Phase B slices behind LOKI_WORKSPACES | per docs/v10/D51-PHASE-B.md | MEDIUM | merged@2026-10-03T02:28Z | train/81 dd2995153, red on Tests (missing workspace completion, fixed dc1fa634f); carried in train/82 e072e47a9. |
-| D65-MCP | D65 D63-8: MCP server tools run, status and verify for v10 | mcp/server.py, tests | MEDIUM | merged@2026-10-03T02:28Z | train/81 dd2995153, red on Tests (count docs and event balance, fixed dc1fa634f); carried in train/82 e072e47a9. |
-| D65-CONT | D65 D63-9: one container for the Control Plane plus Helm and ECS examples | Dockerfile.control-plane, deploy/helm, deploy/ecs, docs | MEDIUM | merged@2026-10-03T02:28Z | train/81 dd2995153, red on Tests (DEPS rows, fixed dc1fa634f); carried in train/82 e072e47a9. |
-| D65-SPEC-F1 | D12 should-fix from the HIGH re-review: contract read requires a regular file with a size cap (a FIFO at .loki/contract.json hangs seal), and malformed or unreadable criteria add one NOT PROVEN line instead of being dropped | loki-ts/src/features/contract.ts, tests/features/contract.test.ts | MEDIUM | merged@2026-10-03T03:13Z | Review af6ddde5 2026-10-03T03:03Z; fails closed today, no false VERIFIED. TL APPROVE; 92bf182b4 plus D70 default-on 960f4b57c in train/83 1a63ad156. |
-| D65-SPEC-F2 | D12 should-fix (design): snapshot or hash .loki/contract.json at intake so the implementing agent cannot edit it before seal | loki-ts/src/features/contract.ts, engine10 intake | HIGH | merged@2026-10-03T08:22Z | opus r2 APPROVE (mutation red 2/18); main 4bf62e271 054caef8b + dist 4088f8cb3 |
-| D62-VIS-F1 | D12 should-fix: SIGKILL the dev server process group after a short grace (a SIGTERM-ignoring server survives capture); verifyReceipt requires regular files for evidence_screens (path "." throws EISDIR) | loki-ts/src/features/visual_evidence.ts, tests/features/visual_evidence.test.ts | MEDIUM | merged@2026-10-03T10:22Z | merged 95254a6cf a8d9873f9 c5a8743d7 (opus r3 APPROVE; finish() reaps groups every exit, mutation red), dist 0ab093f25 guard 13/0, bun 48/0. Advisories A1 pgid reuse, A2 bg dev server killed at worker exit (follow-up) |
-| D61-03 | D61 slice 3, lean eligibility without a named file behind LOKI_SPEED | engine10/sizing.ts, features/speed/lean_select.ts, tests engine10/sizing_lean.test.ts | MEDIUM | released@2026-10-16T00:49Z | TL APPROVE; 999ea6af3 in train/83 1a63ad156. |
-| D61-09 | D61 slice 9, decomposability check with strict-schema confirm | features/speed/decompose_check.ts, tests engine10/decompose_check.test.ts | MEDIUM | released@2026-10-16T00:49Z | TL APPROVE; 0393c5a6b in train/83 1a63ad156. |
-| D61-15 | D61 slice 15, live unit grid (dashboard /g/<group>, Control Plane group_id) | features/speed/group_grid.ts, engine10/dashboard, packages/control-plane runs and drizzle 0001 | MEDIUM | released@2026-10-16T00:49Z | TL APPROVE plus should-fix (400 on bad encoding); 024a4d16b, 79eac0297 on main for train/84. Add a drizzle 0001 snapshot before the next schema change. |
-| D61-10 | D61 slice 10, unit runner (backlog.py --dag) | autonomy/lib/backlog.py, tests/test-backlog-units.sh | MEDIUM | released@2026-10-16T00:49Z | TL APPROVE; ad4f4b926. Follow-up D61-10-F1 1e844e066 TL APPROVE (30/0), approved@2026-10-03T03:33Z. |
-| D61-11 | D61 slice 11, unit run mode (write-set fence, pack-only brief, unit cost cap) | features/speed/unit_mode.ts, e10ext/scope.ts, e10ext/context.ts | HIGH | (not recorded; see Notes) | released@2026-10-16T00:49Z | 48006fdbe..a56978deb, opus HIGH r3 APPROVE (169/0, tsc 0). Fence and pack-only brief only: unitCapEnv has no caller, so no unit cost cap is enforced yet (see D61-11b). |
-| D61-11b | Wire the unit cost cap (unitCapEnv) into the real unit spawn path, fail closed with a NOT PROVEN note on a bad unit spec, read the spec at intake from outside the worktree, and state in slice 12 that FAILED units are never merged (backstopCommit runs add -A unfenced) | features/speed/unit_mode.ts, e10ext/scope.ts, e10ext/context.ts | HIGH | released@2026-10-16T00:49Z | Merged f6dea72bd+5e6b5e9c3, dist 095f17e79. r2 opus APPROVE (18 containment cases, revert-red 22/1, supervisor rc=2 probe). Main: budget+unit_mode+features+supervisor 320/0, tsc 0, dist guard 13/0. Advisories carded: gate maybeRunGroup on !u; supervisor main() rc=2 test; win32 sep. |
-| P1-DISCARD-PROTO | discardIfSatisfied uses `f in pre` (e10ext/discard.ts:36): prototype-named files (constructor, toString) survive the ALREADY_SATISFIED discard, so the run reports completed with a source diff (breaks D50-F1). Use Object.hasOwn plus a real-git test | loki-ts/src/e10ext/discard.ts, loki-ts/tests/e10ext/discard*.test.ts | HIGH | merged@2026-10-03T05:10Z | opus APPROVE (real-git probe: 8 prototype names incl __proto__ and a/constructor all discarded; parent code discarded 1); cherry-picked 6e6a74680, e10ext 92/0. Sibling scope.ts:20-21 hole covered by D61-11 r3 |
-| D61-12 | D61 slice 12, integrator (ordered merges, fix units, 2-round cap) | features/speed/integrate.ts, tests features/speed/integrate.test.ts | HIGH | parked@2026-10-03T04:47Z | Round 7 opus BLOCK 5b788e895: exemption launders drops (B1,B2), context false positive (B3); round 8 is final: three-way containment, no exemption, else drop 04:47Z: round 8 opus BLOCK on 35a7b0c32 (C1-C4, S3: a dropped unit change reported merged and ready; E6 mode-only false fail). Final round spent: dropped from this window per D73; integrator design rework next window. |
-| D61-14 | D61 slice 14, group events plus terminal unit table | features/speed/group_output.ts, engine10/events.ts | MEDIUM | released@2026-10-16T00:49Z | TL APPROVE; 61c598412. Should-fix: unref() the default repaint timer (fold into D61-16 caller slice). |
-| D61-04 | D61 slice 4, already-done off path | engine10 intake, features/speed | HIGH | released@2026-10-16T00:49Z | opus r5 APPROVE (r4 probes 6/0, tar escape fails closed on BSD and GNU, 5 mutations red); cherry-picked 1f5873e2e..9c8ea1dea, dist 588658b36, docs 35deef1f9; engine10/features/e10ext 1338/0 on main |
-| D61-04-F | D61-04 should-fixes: base-tree temp copy leaks on SIGTERM/process.exit (cli.ts:350,359 skip finally); 4 race tests in already_done.test.ts leak one copy each (gate never released); empty root leak if mkdirSync(tree) throws | loki-ts/src/features/speed/already_done_async.ts, loki-ts/tests/engine10/already_done.test.ts | MEDIUM | merged@2026-10-03T05:31Z | Source: D61-04 r5 opus review. Core engine10 net 0 Built 5186f4717 (red 0/2, green 2/0, engine10+features 1243/0); sonnet TL review dispatched. TL APPROVE (54/0); cherry-picked, dist e6ac78c02, dist guard 13/0. Note: settle() uses fixed 300ms; poll if flaky. |
-| D61-13 | D61 slice 13, one Seal plus combined receipt with per-unit sub-receipts | engine10/stages/seal.ts, types.ts, pr_body.ts, features/speed | HIGH | released@2026-10-16T00:49Z | Round 3 opus APPROVE a2c3d9cb2 (B2 held-UNCHECKED fixed, 4 mutations red, moat 4/9); cherry-picked 203eb79a2..116a17ad8, dist 7ad4a44e9. Pushes core to 5001 lines, P0-CORE-BUDGET trims |
-| D61-16 | D61 slice 16, route loki "<task>" and loki <file> through the decomposer behind LOKI_SPEED | engine10/cli.ts, supervisor.ts, features/speed/route.ts | HIGH | released@2026-10-16T00:49Z | Opus APPROVE 37804c1b6; cherry-picked bb11c63e5 into train 85. Hardening D61-16-F in review. |
-| D63-C1 | CP-AUTH: bearer token on /v1/*, refuse non-loopback without token, Host check | control plane app, docs CONTROL-PLANE | HIGH | merged | Round 2 opus APPROVE; merged with C10 as bdf20587f, 180e1e283 (train 86) |
-| P0-VERIFY-ARG | loki verify without --pubkey drops args[0] and verifies the latest run (false green, from b073d50a1) | loki-ts/src/engine10/keys_cmd.ts, tests | HIGH | merged@2026-10-03T05:03Z | opus r3 APPROVE (B1 core net +2, B2/B3 mutations red, CLI test 7/0); cherry-picked 02e71bd41..78606f613, dist 7bfa73a64, dist guard 13/0 |
-| D63-C10 | CONTAINERS: token required in image docs, Helm and ECS | Dockerfile.control-plane, deploy/helm, deploy/ecs, docs | MEDIUM | merged | TL APPROVE 645c35a7f (helm required guard mutation red, 46/0); merged 1b2174fff (train 86) |
-| D63-C2 | CP-DEFAULT: Control Plane on by default (loopback) | per card C2 | MEDIUM | released@2026-10-03T09:21Z | on main d7a097aca, 61d6ce125, 808d373a6; first tag v10.6.9 (drift audit 09:22Z) |
-| D63-C5 | ROUTING: slack in Bun allowlist, jira:/linear: refs to v10 | bin/loki, per card C5 | MEDIUM | merged@2026-10-03T03:55Z | TL APPROVE 01a057352; cherry-picked 73b867a91 into train 85. |
-| D63-C8 | WORKSPACES: parallel workspace runs, missing commands | per card C8 | MEDIUM | merged@2026-10-03T04:12Z | TL APPROVE; cherry-picked onto main (allowlist rows for loki workspace/control dropped), pytest 13 pass, test-workspace rc 0, drift rc 0; on train 85 (2cc94a548). |
-| D63-C9 | MCP: v10 run/status/verify tools, test wired into a runner | mcp/, per card C9 | MEDIUM | merged@2026-10-03T03:55Z | TL APPROVE bb13eb875; cherry-picked 3e686608e into train 85. |
-| D63-C12 | STUB-INVOKER: LOKI_CLAUDE_CLI alone selects the CLI invoker | engine10/session.ts, docs FIRST-RUN-GATE | HIGH | rejected@2026-10-03T04:12Z | Opus BLOCK (LOKI_CLAUDE_CLI alone records paid runs as $0 cli-invoker-unmetered). Dropped per D72; explicit LOKI_E10_INVOKER=cli serves the stub gate. |
-| D61-16-F | D61-16 hardening: explicit spec paths, cwd resolve, containment, 1 MB cap, NUL, no fallback after group throw, relevant_files | features/speed/route.ts, supervisor.ts hook | HIGH | merged@2026-10-03T04:12Z | Round 3 opus APPROVE 9e831f447 (O_NONBLOCK FIFO fix, mutation red); cherry-picked 5c31f4fd1, 544355c63, 7d33a5d75; main moat 4 of 9 rc 0; on train 85. |
-| D63-C4 | BLOCKED-RESUME: loki answer closes the BLOCKED loop | features/blocked_answer.ts, cli.ts, control-plane answer.ts, docs | MEDIUM | merged@2026-10-03T03:55Z | TL APPROVE 7b24ed66b + bdd5018d7; cherry-picked into train 85 (dist 52c3b0e02). |
-| D63-C3 | BASH-FLIPS: bare loki opens the Control Plane; workspace gate flips | autonomy/loki, tests/test-ui-bare-loki.sh, docs/dashboard-guide.md | MEDIUM | released@2026-10-03T09:21Z | on main 06579d2f2, 93cf367d8; first tag v10.6.9 (drift audit 09:22Z) |
-| D63-C11a | E2E-HARNESS: stub-provider E2E harness, legs 1-4 | scripts/e2e-d65.sh, scripts/e2e-d65/ | MEDIUM | released@2026-10-03T09:21Z | on main 84e8d89f9; first tag v10.6.9 (drift audit 09:22Z) |
-| D63-C11b | E2E-LEGS: stub-provider E2E legs 5-9 (Jira, contract, multi-repo, MCP, containers) and E2E-D65.md section 6 | scripts/e2e-d65/legs/05-09, docs/v10/E2E-D65.md | MEDIUM | merged@2026-10-03T05:53Z | Built c32e7c06c: legs 1-6, 8 PASS; 7 FAIL (BUG-5), 9 FAIL (BUG-6); force-fail rc 1; shellcheck clean. Sonnet TL review dispatched. TL APPROVE (leg 6 PASS, force-fail fails=1, shellcheck 0); cherry-picked. Doc table needs a refresh after BUG-5/BUG-6 land. |
-| D65-BUG5 | Installed package lacks schemas/loki-yaml.schema.json (package.json files), so `loki workspace run` fails rc=2 outside a source checkout | package.json, a packaged-files test, CHANGELOG | LOW | merged@2026-10-03T05:55Z | Found by C11b leg 7. Builder dispatched from 3c47d0f1a. Fix e2abb9d8f (packaged test 14/1 -> 15/0); TL APPROVE (3 packaging suites green); cherry-picked. |
-| D65-BUG6 | Dockerfile.control-plane omits loki-ts sources imported by packages/control-plane ingest.ts, so docker build fails Could not resolve | Dockerfile.control-plane, .dockerignore, CHANGELOG | MEDIUM | merged@2026-10-03T05:54Z | Found by C11b leg 9. Builder dispatched from 3c47d0f1a. Fix 33e6508c7; TL APPROVE (rebuilt image, /ready 200, test-control-plane 17/0); cherry-picked. Follow-up D65-BUG6-G: static guard that every loki-ts import in packages/control-plane is COPYed by the Dockerfile. |
-| D65-BUG6-G | Guard: every loki-ts/src path imported by packages/control-plane/src appears in a Dockerfile.control-plane COPY | an existing control-plane shell test | LOW | merged@2026-10-03T05:58Z | TL non-blocking note on D65-BUG6. Built 31076e369 (guard red on missing redact.ts COPY, green restored, control plane 18/0, shellcheck 0); TL review dispatched. TL APPROVE (red/green reproduced, 11 import shapes, 18/0, shellcheck 0); non-blocking: dynamic import() and same-line second import not detected. |
-| P0-SPAWN-ENV-SPEED | Train 86 Coverage red: spawn_env_guard flags features/speed/already_done_async.ts execFile whose env arrives via an opts spread; inline env in the call | loki-ts/src/features/speed/already_done_async.ts | LOW | merged@2026-10-03T05:40Z | gh run 37099794381: 3070 pass 1 fail, (fail) spawn env guard > no spawn under loki-ts/src omits env. Runtime env is passed; source scan cannot see the spread. Blocks train 86 promote; fix rides train 87. Fix 191e5c6d2 (red 1 fail, green 2/0); dist 6cbdd32e0, dist guard 13/0; main full loki-ts bun test 3072 pass 0 fail. |
-| P0-TC-SUPERSEDE | train-cycle Phase A superseded green unpromoted train/87 with train/88 and Phase B only evaluates the newest train; hold a green unpromoted train so Phase B promotes it first | scripts/train-cycle.sh, tests/test-train-cycle.sh | MEDIUM | merged@2026-10-03T06:18Z | Incident 06:13Z, RM promoted 87 by SHA by hand. Fix 5abab1f2c (red 47/3, green 50/0, shellcheck 0). TL APPROVE: A and B share REQUIRED_TRAIN and success rule; gh/fetch failures fail open; non-fast-forward train not held; mutation 47/3. Cherry-pick bd686b7c9. |
-| D65-UI-NAMING | One UI command: loki serve --help points to loki / loki control serve; README control row and TOOL-INTEGRATION.md stop presenting loki serve or a LOKI_CONTROL=1 preview as the UI | autonomy/loki, README.md, docs/TOOL-INTEGRATION.md, CHANGELOG.md | LOW | merged@2026-10-03T06:25Z | Peer finding 06:20Z. Fix 5708413dd; serve routing unchanged. TL APPROVE (bash -n ok, serve --help exits 0 and binds nothing, wording matches control.ts LOKI_CONTROL=="0"). Follow-up D65-UI-NAMING-2 for bash fallback and cli.ts help. |
-| D65-UI-NAMING-2 | Bash fallback cmd_control and loki-ts cli.ts help still say preview, needs LOKI_CONTROL=1; align with bun route (on by default, LOKI_CONTROL=0 off) | autonomy/loki, loki-ts/src/cli.ts, loki-ts/dist, tests, CHANGELOG.md | LOW | merged@2026-10-03T06:33Z | Fix 15f631fae (red: preview line rc=0 under LOKI_CONTROL=0; green: off line rc=0, no bun names bun rc=1). TL APPROVE: OFF_LINE byte-identical to control.ts:12, delegation unchanged, control plane 19/0, dist guard 13/0, shellcheck no new findings. Cherry-pick e564d2423 (CHANGELOG conflict resolved keeping both lines). Non-blocking: no-bun assertion depends on bun absent from /usr/bin:/bin. |
-| D75-GITLEAKS-RANGE | train/** pushes scan merge-base(origin/main)..SHA via security-audit-gitleaks.sh; main-push secret-scan always full (no E-160 skip); release.yml required-ci reuses only main-branch or dispatch audit verdicts; weekly cron becomes daily | .github/workflows/security-audit.yml, .github/workflows/release.yml, tests/test-security-audit-config.sh | HIGH | merged | main baf694a9b/8da824056/09fe087ae; opus r3 APPROVE 08:02Z (live gate rc=0 today, stub gh error rc=1, 8 mutations red); test 54/0; follow-up D75b |
-| D75b | release.yml sched_audit gate: separate schedule fetch, paginated newer-success check, indeterminate blocks (fail-closed on page overflow) | .github/workflows/security-audit.yml, .github/workflows/release.yml, tests/test-security-audit-config.sh | HIGH | merged | main (cherry-pick of 03914c5ab); opus APPROVE 08:09Z (live gate rc=0, created>= filter verified live, stub errors block, 11 mutations red); 57/0; LOW: missing total_count passes, newest-first ordering undocumented |
-| P0-D75-PINS | D75 regressed tests/test_release_required_ci.py (24 fail, gh stub lacks scheduled-audit answers) and E-123 scanner pins; train/92 Tests red | | | merged@2026-10-03T08:27Z | opus APPROVE (5 gate mutations red); main ae8f70284; required_ci 63/0, E-123 31/0, audit-config 57/0 on main |
-| D65-BUG7 | E2E leg 7: installed `loki workspace run` exits 1 with 0 receipts after BUG-5 (integration.json now written); expected one run per repo and rc 0 | engineer-determined (autonomy/lib workspace path, tests) | MEDIUM | merged | main b5a0085a0 (cherry-pick of 18ca83dd8); TL APPROVE 07:59Z (mutation red 15/1, restored 16/0); dist guard 13/0; e2e-d65 legs=9 fails=0 |
-| D63-C6 | SLACK: two-way Slack on by default | features/slack_inbound.ts, docs/slack.md, README | HIGH | merged@2026-10-03T04:15Z | Opus round 2 APPROVE; cherry-picked 1acd2a9a2,4b2c242bd,f02609175, dist fc10b503c |
-| D63-C6-F | SLACK follow-up: sender allowlist, 64 KB task cap, no local paths in replies, strict --port | features/slack_inbound.ts, docs/slack.md | MEDIUM | merged@2026-10-03T04:25Z | TL APPROVE e8837ffa4 (3 mutations red); cherry-picked 2a404421a, dist 7ad4a44e9 |
-| P0-CORE-BUDGET | Core engine10 at 5001 lines after D61-13 (budget.test.ts needs < 5000); remove dead core code | loki-ts/src/engine10 | MEDIUM | merged@2026-10-03T10:50Z | 77d879908 cherry-picked c0dee1301; second TL (sonnet) BLOCKED only on stale test pins (test-engine10-dist greps intakeStage/prStage; already_done.test imports intakeStage), CoS repinned c9c377563; engine10 bun 1189/0, budget 27/0, tsc 0, engine10-dist 18/0, dist 500d77e24, guard 13/0; TL r2 dist-test BLOCK not reproduced (test-engine10-dist.sh 18/0 on main, no intakeStage refs) |
-| P0-CONTROL-LINUX | train/85 ubuntu red: control_default timed out because a repo-root node_modules disables bun auto-install (hono missing) | loki-ts/src/commands/control.ts, loki-ts/tests/commands/control_default.test.ts, CHANGELOG.md | HIGH | merged@2026-10-03T04:56Z | opus APPROVE (reproduced in oven/bun:1.3.13; npm tarball uses bundled dist/server.js so no runtime fetch); cherry-picked 2d6e4a77d, dist 377871c88, dist guard 13/0. Follow-up: frozen-lockfile install of packages/control-plane in CI |
-| D63-C7 | TRACKERS: Jira and Linear intake polish | features/tracker_intake.ts, docs/trackers.md, README | MEDIUM | merged@2026-10-03T03:55Z | TL APPROVE 5c002ae69; cherry-picked 6fd472e1a into train 85. Advisory: suffix/userinfo/port negative tests. |
-| P0-D66-FENCE | Fix-forward: lean_select value-imported stages/plan (train 83 Coverage red, run 37092508809) | engine10/relevant_files.ts, stages/plan.ts, features/speed/lean_select.ts | MEDIUM | merged@2026-10-03T03:21Z | TL APPROVE; 53182ff94; budget.test 27/0, typecheck rc 0. |
-| PO-CL-1 | CHANGELOG Unreleased hygiene: drop already-shipped duplicates and the stale trailing [Unreleased] heading | CHANGELOG.md | each bullet at most once across Unreleased and released sections; grep -c "^## \[Unreleased\]" is 0; dash guard passes | LOW | released@2026-10-17T03:50Z | merged ab4dea609 (TL APPROVE); PO batch 08:53Z. Released sections untouched. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| PO-DOC-1 | README: document loki verify --export-dsse and loki workspace list/show/run/status | README.md | grep finds export-dsse and "workspace run"; flags match bash autonomy/loki help workspace | LOW | released@2026-10-17T03:50Z | merged a85806aaf (TL APPROVE); PO batch 08:53Z (PO-DOC-1 and PO-DOC-2 merged into one README slice). Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| PO-DOC-3 | release-checklist notes the PREV_NOT_ON_NPM refusal; fix the dangling PLATFORM-SUPPORT reference | docs/dev/release-checklist.md, docs/UNREACHABLE-TESTS.md | grep PREV_NOT_ON_NPM release-checklist >= 1; no missing path named | LOW | released@2026-10-17T03:50Z | merged 739759155 (TL APPROVE); PO batch 08:53Z. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| PO-HELP-1 | CLI help: add loki help answer and --export-dsse to loki help verify | autonomy/loki (help functions only) | help answer exits 0 and shows --text; help verify mentions dsse; bash -n; help tests pass | MEDIUM | released@2026-10-17T03:50Z | merged ef50958a5 (TL APPROVE; help-no-recursion 9/0 on main, red 7/2 at parent) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| SEC-SCAN-1 | tests/test-secret-scan.sh 5/1 on main (real AWS key -> got pass/VERIFIED/0, expected fail/BLOCKED/2) | tests/test-secret-scan.sh and the secret-scan gate it exercises | suite green on main; root cause named (host gitleaks dependence vs real gate regression); no gate weakened | MEDIUM | released@2026-10-17T03:50Z | merged 04f62ff4e (TL APPROVE; root cause: fixture AKIAIOSFODNN7EXAMPLE is gitleaks-allowlisted; 6/0 with and without gitleaks; mutation 3/3 red) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| PO-AUDIT-CLI-1 | S-221 re-cut: python3 dashboard/audit.py verify exits 0 on an empty or pre-hash audit dir though it checked nothing; exit 2 with status not_verified, keep valid field and tip untouched | dashboard/audit.py (_unified_cli verify branch and docstring only), tests/dashboard/test_audit_verify_cli_nothing_checked.py (new), docs/audit-logging.md (exit codes), CHANGELOG.md | python3 -m pytest -q tests/dashboard/test_audit_verify_cli_nothing_checked.py (empty dir 2, valid chain 0, tampered 1, tip on empty dir still 0; red on current main); python3 -m pytest -q tests/dashboard/test_audit_verify_nothing_checked.py; bash tests/test-audit-chain-honesty.sh; bash tests/test-audit-js-suites.sh | MEDIUM | released@2026-10-17T03:50Z | main db276a24e; TL APPROVE (tampered=1, empty=2 nothing_checked); pytest 11 passed Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| PO-DASH-HONEST-1 | S-222 + S-223 re-cut: skill-session WebSocket push hardcodes running_agents 0; notification triggers panel says No triggers configured after a failed read | dashboard/server.py (skill-session payload near line 1042 and get_notification_triggers only), legacy-ui/components/loki-notification-center.js (_loadTriggers and empty branch only), tests/dashboard/test_skill_session_ws_running_agents.py (new), tests/dashboard/test_notification_triggers_unreadable.py (new), legacy-ui/tests/loki-notification-triggers-error.node.test.mjs (new), CHANGELOG.md | pytest on the two new files red then green (running_agents None when unmeasured, triggers null plus error on a corrupt file, [] on a missing one); node --test legacy-ui/tests/loki-notification-triggers-error.node.test.mjs (error text lacks No triggers configured, empty list keeps it); python3 -m pytest -q tests/dashboard -k "notification or skill_session" | LOW | released@2026-10-17T03:50Z | main 99674923f; TL APPROVE; pytest 7 passed, node 3/0 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| PO-WEB-COST-1 | S-224 re-cut: web-app Evidence Receipt Cost field and Metrics cost trend show a partly priced run (cost_partial true) as a complete cost | web-app/src/components/EvidenceReceiptPanel.tsx (Cost field only), web-app/src/api/client.ts (ProofDetail cost type and cost/timeline runs type only), web-app/src/pages/MetricsPage.tsx (costTrend only), web-app/src/components/EvidenceReceiptPanel.cost.test.mjs (new), CHANGELOG.md | node --test web-app/src/components/EvidenceReceiptPanel.cost.test.mjs (cost_partial true renders at least $1.20, absent keeps $1.20, partial trend label carries (partial); red before); cd web-app && npx tsc -b rc 0 | MEDIUM | released@2026-10-17T03:50Z | main 4a429626b; TL APPROVE; node 4/0; shard markers fixed 8106e6a72 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| PO-STANDALONE-COST-1 | S-225 re-cut: standalone receipts list shows a partly priced run as a complete cost | legacy-ui/scripts/build-standalone.js (loadReceipts cost cell only), tests/test-receipts-panel.sh (one new leg), CHANGELOG.md | bash tests/test-receipts-panel.sh rc 0 with the new leg asserting at least $X.XX only when cost_partial is true (red before); bash tests/test-budget-banner-dedup.sh rc 0 | LOW | released@2026-10-17T03:50Z | main f99c8cc64; TL APPROVE; receipts-panel 21/0 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| PO-WEB-DEPLOY-1 | S-228 re-cut: DeployConnections connect and disconnect handlers push synthesized default not-connected statuses upward after their own fetch failed | web-app/src/components/DeployConnections.tsx (connect and disconnect handlers only, lines 395-440), web-app/src/components/DeployConnections.propagate.test.mjs (new), CHANGELOG.md | node --test web-app/src/components/DeployConnections.propagate.test.mjs (no synthesized statuses reach onStatusChange after a failed fetch; red before); node --test web-app/src/components/DeployConnections.state.test.mjs; cd web-app && npx tsc -b rc 0 | LOW | released@2026-10-17T03:50Z | main fd92d52f0 (r2 3ade22ae1 adds runner+shard row, the sole TL finding; CoS verified shard-coverage 19/0, drift 6/0) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| PO-WEB-WORKSPACE-1 | S-229 + S-230 re-cut: preview header says Detecting project type forever after a failed preview-info fetch; unknown phases label building and Replay Build can never show (buildPhase returns idle when not building, so the complete branch is unreachable) | web-app/src/components/ProjectWorkspace.tsx (getPreviewInfo call and the two Detecting project type branches ~1877 and ~2093; buildPhase memo ~1401-1410 and Replay Build condition ~1488 only), web-app/src/components/ProjectWorkspace.preview.test.mjs (new), web-app/src/components/ProjectWorkspace.phase.test.mjs (new), CHANGELOG.md | node --test on both new files (rejected fetch renders Could not detect project type; unrecognized phase is not building; completed idle session shows Replay Build; red before); node --test web-app/src/components/ProjectWorkspace.panels.test.mjs; cd web-app && npx tsc -b rc 0 | LOW | released@2026-10-17T03:50Z | main 38ae6a29c; TL APPROVE; node 16/0 with DEPLOY tests Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| PO-WS-METRICS-1 | D51-B15 re-cut (its gate B07 was superseded and there is no group.json; runs record only integration.json): record per-repo started_at and finished_at in integration.json, add workspace_metrics.py reporting PRs per wall-clock hour and per attention minute; runs lacking timestamps are reported as unmeasured, never counted as zero | autonomy/lib/workspace.py (run loop and integration.json write only), autonomy/lib/workspace_metrics.py (new), tests/workspace/95-metrics.sh (new, register in the runner and a shard row, timeout -k, shellcheck), docs/WORKSPACES.md, CHANGELOG.md | bash tests/workspace/95-metrics.sh (fixture run gives the hand-computed rate; an old integration.json without timestamps prints unmeasured; red before); bash tests/workspace/50-run.sh and 00-smoke.sh rc 0; structural-checks.sh and shard registration guards rc 0 | MEDIUM | released@2026-10-17T03:50Z | main 624b5d964; TL APPROVE; test-workspace 19/0 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| PO-SESSION-COMMIT-1 | S-219 + S-220 re-cut (legacy run.sh): a failed git add -A makes the session commit silently commit nothing; the untrack step's global git reset drops force-staged agent files from the session commit | autonomy/run.sh (commit_session_changes add block ~11065 and _loki_untrack_agent_committed_user_files ~10985 only), tests/test-session-commit-add-failure.sh (new), tests/test-untrack-keeps-force-staged.sh (new), both registered in the runner with shard rows, CHANGELOG.md | both new tests rc 0 and red when the rc check or git reset -q is restored in a scratch copy; bash tests/test-branch-lifecycle.sh rc 0; bash -n autonomy/run.sh; shellcheck on changed files; structural-checks.sh rc 0 | MEDIUM | released@2026-10-17T03:50Z | 939e23126. TL APPROVE (exit 128 aborts the add, index restore reproduced, both mutants red). On main: new tests 7/0 and 5/0, bash -n ok, shard 19/0, drift 6/0. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| PO-COUNCIL-LABEL-TEST-1 | S-213 re-cut: the Council vote header in cost.html and the council prefix plus title on the proofs.html badge have no test of their own | legacy-ui/tests/static-council-vote-label.node.test.mjs (new; reads legacy-ui-static/proofs.html and cost.html, edits neither) | node --test legacy-ui/tests/static-council-vote-label.node.test.mjs passes (proofs.html line 152 prefix and title, cost.html line 308 header); renaming the header or dropping the title in a scratch copy fails it | LOW | released@2026-10-17T03:50Z | c331cde1a (r2 23f2c4e5f: content-anchored matching, shard row). CoS verified on main: node --test 2/0, shard coverage 19/0, drift 6/0. Test-only, no CHANGELOG. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| PO-P7-SINKS-1 | E-138: P7 no-fabricated-data scanner misses optional-call sinks and one-hop aliases (setRows?.([...]), window[k]?.(rows), const s = setRows; s(rows), a memo that forwards a fabricator result) | tests/moat/p7-no-fabricated-data.sh (and its red and green fixtures under tests/moat/ only) | bash tests/moat/p7-no-fabricated-data.sh with a red and a green fixture per form, each red before the change; the existing fixtures keep their verdicts; moat suite 4/9 or better unchanged | HIGH | released@2026-10-17T03:50Z | b2b592b29. Opus APPROVE: 13 added findings, 0 removed, real tree 0 findings, each arm mutation-red. On main all four P7 cases PASS. Advisory: SCALAR_READ exclusion has no pinning fixture. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| A-04d | A-04c follow-up (opus r5 advisories A1, A3): loki-seal Known limits must name empty body or early return, an assertion only in a helper declared after the test, same-name or keyword collisions across files, and forged runner-format lines printed by a test; fix the README sentence the matched test body must contain an assertion | packages/loki-seal/README.md, packages/loki-seal/skills/loki-seal/SKILL.md, CHANGELOG.md | grep finds each of the four limits in README Known limits; bash packages/loki-seal/test/run.sh 72/0; no code change | LOW | released@2026-10-16T00:49Z | aa4770f57; seal suite 72/0. Plus 0b-fix: escaped U+2714/U+2716 marks in an A-04c fixture that turned structural-checks emoji scan red on main. |
-| D51-B13r | Read-only workspace runs API over integration.json (runs never produce group.json) | dashboard/api_workspaces.py (new), dashboard/api_operator.py (2 GET routes only), tests/dashboard/test_api_workspaces.py (new) | `python3 -m pytest tests/dashboard/test_api_workspaces.py -q` (red: module absent) | MEDIUM | released@2026-10-17T03:50Z | merged 6d927b5c6 (TL approve; cherry-pick of 4fbb99b40), wall shard 19/0 drift 6/0 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| D51-B14r | Start page "Workspace runs" card: per-repo rows, integration row, stale badge; an unreadable run shows an error, never an empty card | legacy-ui-static/start.html, legacy-ui/tests/start-workspace-card.node.test.mjs (new), run-all-tests.sh line | `node --test legacy-ui/tests/start-workspace-card.node.test.mjs` (red: no card) | LOW | released@2026-10-17T03:50Z | 1280b2781 + 7329ab5f1 on main (TL APPROVE r2, node 5/0, red 4/1) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| D51-B16r | E2E through the real CLI routes, plus the "verify a workspace run" doc | tests/workspace/99-e2e.sh (new), docs/WORKSPACES.md | `bash tests/test-workspace.sh` (red: 99-e2e asserts absent) | MEDIUM | released@2026-10-17T03:50Z | merged 4341f84a5 (approve; cherry-pick of ef73d6c6d), test-workspace 33/0 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| WS-INTERRUPT | SIGTERM/SIGINT writes integration.json status=interrupted; status lists an unreadable run as "unreadable" | autonomy/lib/workspace.py (stop, _runs, status only), tests/workspace/55-interrupt.sh (new) | `bash tests/test-workspace.sh` | MEDIUM | released@2026-10-17T03:50Z | merged 52f510d71 (approve; cherry-pick of e70cdcc6d) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| WS-PREP-BOUND | Bound the prep lock to 120s then FAILED; refuse relative-symlink escape and source-path shebangs | autonomy/lib/worktree_prep.py, tests/test-worktree-prep.py | `python3 tests/test-worktree-prep.py` | MEDIUM | released@2026-10-17T03:50Z | merged 7c37faa8d (approve; cherry-pick of a2f2718d3), test-worktree-prep OK Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| P2-FV-EXIT | fast_verify exit codes: INCONCLUSIVE=3, unknown flag=64, missing root=2; retire the overdue pending line | autonomy/lib/fast_verify.py (main only), tests/test-fast-verify.sh, tests/moat/pending.txt (1 line), docs/exit-codes.md (--fast row) | `bash tests/moat/run.sh` no rule failed, P2 passes on both routes | HIGH | released@2026-10-17T03:50Z | merged c4afa7344 458dfdfb5 (TL r2 APPROVE): --path alias, --help 0; airgap 4/0, fast-verify 17/0, moat P2.fast-verify-inconclusive-not-zero PASS on main Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| S-215r | proof-pr.sh python cannot be shadowed by a cwd json.py | autonomy/lib/proof-pr.sh (render_evidence_receipt_md), tests/test-proof-pr-no-cwd-shadow.sh (new) | the new test (red on main) | HIGH | released@2026-10-16T00:49Z | merged c6536dfe2 (opus approve; cherry-pick of b4176f42e). On main checkout proof-pr suite 5/1 only on the .loki/state/provider leg: the gitignored file predates the slice (Sep 30 17:58), environmental; builder worktree 6/0. CoS decision 10:14Z |
-| S-216r | verify.sh python readers are isolated from cwd shadowing | autonomy/verify.sh (reader sites 190,591,1269,1271,1295,1337,1339,1441), tests/test-verify-no-cwd-shadow.sh (new) | the new test | HIGH | released@2026-10-16T00:49Z | r3 opus APPROVE; cherry-picked 100535de2 f38a93966 77b84becc; main: cwd-shadow 20/0, test-verify 25/0; test now flags only a provider file created during the run (6185c5249); CHANGELOG deduped. Advisories: label no-interpreter as inconclusive, add a dynamic leg for line 3117 |
-| S-218r | _loki_untracked_status cannot run a repo-local fsmonitor | autonomy/run.sh (_loki_untracked_status only), tests/test-untracked-status-fsmonitor.sh (new) | the new test | HIGH | released@2026-10-16T00:49Z | r5 opus APPROVE (version spoofs, nonce, B1 retry all fail closed); main 0b6604fd9 + CHANGELOG collapse 1ff144efb; fsmonitor 21/0, branch-lifecycle 83/83; advisories A1 digit-length cap, A2 two-call race; in train/95 |
-| HONEST-READ-1 | A corrupt or denied file gives 503 or an error row, never an empty list | dashboard/server.py (list_proofs, memory patterns/episodes/skills/index only), legacy-ui-static/proofs.html, tests/dashboard/test_unreadable_not_empty.py (new) | `python3 -m pytest tests/dashboard/test_unreadable_not_empty.py -q` | LOW | released@2026-10-17T03:50Z | merged 05c0940e9 (approve; cherry-pick of a29956235), pytest 12 passed Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| S-226r | An unmeasured cost reads "unmeasured", not $0.00, in stats and status on both routes (absorbs S-227) | autonomy/loki (cmd_stats, cmd_status budget block), loki-ts/src/commands/stats.ts, loki-ts/src/commands/status.ts (readBudgetField), tests/test-stats-unmeasured-cost.sh + tests/test-status-budget-unmeasured.sh (new) | both new tests plus `cd loki-ts && bun test` | MEDIUM | released@2026-10-16T00:49Z | merged e2c283a40 (approve; cherry-pick of 72df5665e), stats 8/0 status 8/0 |
-| S-231r | Rename the CI moat job to what it proves | .github/workflows/test.yml (job name and summary echo only) | `git grep -n "name: Moat suite" -- .github` prints nothing | LOW | released@2026-10-16T00:49Z | d8cb2bc9c on main; TL APPROVE (job id kept, no display-name consumer; CoS verified no protection or ruleset context) |
-| PO-TEST-1 | Tests for scripts/metrics-usage-append.py | tests/test-metrics-usage-append.sh (new), runner and shard registration | red-then-green, shellcheck, structural guards; never writes the real METRICS.md | LOW | released@2026-10-17T03:50Z | merged 41103e5c3 (TL APPROVE; suite + shard/registration guards green) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| PO-TEST-2 | Tests for scripts/check-inline-scripts.js | tests/test-check-inline-scripts.sh (new), runner and shard registration | valid exits 0, broken fixture exits 1, structural guards | LOW | released@2026-10-17T03:50Z | merged 8b3fa5af4 (TL APPROVE; suite + shard/registration guards green) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| PO-TEST-3 | Tests for scripts/clean-test-branches.sh safety rules | tests/test-clean-test-branches.sh (new), runner and shard registration | refusals proven in a throwaway repo; mutation dropping main refusal goes red; structural guards | MEDIUM | released@2026-10-17T03:50Z | merged 75953c210 (TL APPROVE; suite + shard/registration guards green) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| P7-SCALAR-PIN | Pin the P7 SCALAR_READ exclusion with honest fixtures, so a regression that flags `.length`, `[0]` or `.find(` reaching a sink (or a widening that lets a fabricated array through) goes red. | tests/moat/p7-no-fabricated-data.sh only | Add honest fixtures `const n = getRows(d).length; setCount(n);`, `setFirst(getRows(d)[0])`, `setHit(getRows(d).find(x=>x.ok))` with expected 0 findings. RED: temporarily change `if not SCALAR_READ.match(tail): return True` (line ~1243) to `return True` and run `bash tests/moat/p7-no-fabricated-data.sh` -> the new fixtures fail. GREEN: revert -> `bash tests/moat/p7-no-fabricated-data.sh` exit 0, and every existing fixture keeps its expected count. Also `bash tests/moat/run.sh` shows the P7 verdict unchanged. Do NOT touch pending.txt. No CHANGELOG line (test-only). | HIGH | released@2026-10-17T03:50Z | d668a9cbc opus APPROVE (13 mutations, 11 caught by new fixtures); advisories: realistic ternary shape, Index/Find honest-label debate, .search gap Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| SEAL-FORGED-LINES | loki-seal refuses VERIFIED when the parsed passing lines disagree with the runner's own summary counts, so a test that prints forged `ok N - name` or `--- PASS:` lines cannot fake delivery. | packages/loki-seal/bin/contract.js (passing() and its caller), packages/loki-seal/test/seal.test.js, packages/loki-seal/README.md (Known limits ~44), CHANGELOG.md | RED: new seal.test.js cases: (a) TAP output with `ok 1 - x` printed by the test body plus summary `# pass 0` / `# fail 1`; (b) pytest output with `test_x PASSED` plus `1 failed, 0 passed`; (c) an id that appears both passed and failed. Each expects NOT VERIFIED with reason "runner output inconsistent". `bash packages/loki-seal/test/run.sh` fails on the new cases before the change (baseline 72/0). GREEN: after the change, `bash packages/loki-seal/test/run.sh` passes all cases (75+/0) and the existing 72 stay green. When no summary line exists, current behavior is unchanged (document this in Known limits). CHANGELOG: "loki-seal: forged runner pass lines that contradict the runner summary now give NOT VERIFIED." | HIGH | released@2026-10-17T03:50Z | r7 opus BLOCK: F1 unterminated write hides real summary, F2 64MB cap drops summary; r8 builder dispatched r10 8046c2b6f opus BLOCK: 4 reproduced forges (.bin/node shim, self-package reporter, node_modules reporter, npm config outside project .npmrc). D80 amendment 2 adopted (spawn process.execPath, scrubbed env, builtin reporters only, jest/vitest NOT VERIFIED). r11 building. r11 42421df35 (132/132; 10 new tests red 8 on r10). Opus re-review running. r11 opus BLOCK: env-scrub mutant survives 132/0 (no NODE_OPTIONS/NODE_PATH test). Other spec points verified, 4 of 5 mutants red. r12 building: childEnv unit test + A1/A3/A4/A5. r12 431f4bafe: childEnv exported+unit/E2E tests, scrub mutant red, 134/0; opus verify-only re-review. r12 opus APPROVE (scrub mutant 132/2 red, M2a/M2b/M3 caught). 12 commits on main, 134/0 on main. Advisories: jest/vitest red-counts E2E untested; NODE_PATH E2E only via unit test. r13 98e144f21 escapes U+2713/2714/2716 for the emoji scan, 134/0. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| HONEST-READ-2 | /api runs never claim "recorded no run_id" or "no per-iteration records" when the events or iteration files were unreadable or corrupt; they say unreadable, with the errno. | dashboard/api_runs.py, tests/dashboard/test_api_runs_unreadable.py (new), tests/run-all-tests.sh (run_test line), tests/shard-durations.tsv (row), CHANGELOG.md | RED: new pytest: (a) events file chmod 000 -> list_runs reason must contain "unreadable", not "no run id found"; (b) iteration dir with only corrupt JSON -> reason "unreadable or corrupt", not "no per-iteration records"; (c) missing file (ENOENT) keeps today's "no ..." wording. Skip (a) when running as root. `python3 -m pytest -q tests/dashboard/test_api_runs_unreadable.py` red before. GREEN: same command passes; `python3 -m pytest -q tests/dashboard` stays green. Register `run_test "Dashboard api_runs unreadable reads (HONEST-READ-2)" "timeout -k 10 120 python3 -m pytest -q $SCRIPT_DIR/dashboard/test_api_runs_unreadable.py"` plus the shard row `Dashboard api_runs unreadable reads (HONEST-READ-2)<TAB>5`, then run the structural guards for new test files. CHANGELOG: "Dashboard runs view reports unreadable or corrupt run records instead of claiming none were recorded." | MEDIUM | released@2026-10-17T03:50Z | b8b30f271 on main (MEDIUM TL APPROVE) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| BACKLOG-LEDGER-FAILCLOSED | `loki backlog` daily budget cap fails closed: a corrupt or unreadable spend ledger stops new units with BUDGET_STOP "ledger unreadable" instead of reading $0 spent, and add_spend never overwrites a corrupt ledger (move it aside to .corrupt-<ts>). | autonomy/lib/backlog.py (spent_today, add_spend, cap check ~383), tests/test-backlog.sh, CHANGELOG.md | RED: add a case to tests/test-backlog.sh with HOME pointing at a run-owned temp dir, `~/.loki/backlog-spend.json` containing `{not json`, a daily cap of $1, and a stub loki. Expect status "BUDGET_STOP: ... ledger unreadable" and no unit started; today the cap reads 0.0 and units run. A second case checks that after add_spend the corrupt bytes survive in backlog-spend.json.corrupt-*. `bash tests/test-backlog.sh` red before. GREEN: same passes; `bash tests/test-backlog-units.sh` stays green; a missing ledger (ENOENT) still means $0 spent. No cap configured means no behavior change. CHANGELOG: "loki backlog: a corrupt spend ledger now stops new units when a daily budget is set, instead of reading as $0 spent." | MEDIUM | released@2026-10-17T03:50Z | 4dd5faf62 on main (MEDIUM TL APPROVE) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| MCP-RUN-EXIT | MCP v10_run reports an early loki crash (exit code plus the last 20 log lines) instead of returning run_id None with no error. | mcp/v10_tools.py, mcp/tests/test_v10_tools.py | RED: new test: monkeypatch the loki binary to a stub that exits 2 immediately and writes "boom" to the log. Expect a result with `error` containing "exited 2" and "boom"; today it is `{"run_id": None, "pid":..., "log_path":...}`. `python3 -m pytest -q mcp/tests/test_v10_tools.py` red before. GREEN: same passes and `bash tests/test-mcp-server.sh` (test 13 at :204) stays green. A still-running process with no run id yet keeps today's shape. CHANGELOG: "MCP loki run now returns the exit code and log tail when loki exits before a run starts." | LOW | released@2026-10-17T03:50Z | 01c8c0e6c cherry-picked (TL APPROVE; pytest 18/0, red 2 on revert, test-mcp-server 13/0) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| CTRL-STATUS-RUNS | `loki control status` (TS route) prints "runs: unknown (<reason>)" when /v1/runs fails or has no total, never "0 runs". | loki-ts/src/commands/control.ts, loki-ts/tests/commands/control.test.ts (new or existing), CHANGELOG.md | RED: test with a fetch stub that returns 500, and one that returns `{}` -> output must not match /\b0 runs\b/ and must contain "unknown". `cd loki-ts && bun test tests/commands/control.test.ts` red before. GREEN: same passes; a stub with total 3 prints "3 runs"; `cd loki-ts && bun run build` then `bash tests/test-release-dist-guard.sh`. The bash cmd_control in autonomy/loki is in-flight (S-226r); file a follow-up instead of editing it. CHANGELOG: "loki control status shows runs as unknown when the control plane cannot be read." | LOW | released@2026-10-17T03:50Z | cf9da0c41 on main (TL APPROVE); bash cmd_control same default left for S-226r Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| CP-BAD-ENCODING | The control-plane server returns 400 for malformed percent-encoding instead of a 500 from an unguarded decodeURIComponent. | packages/control-plane/src/server/app.ts, packages/control-plane/test/server/bad-encoding.test.ts (new) | RED: request `/v1/runs/%E0%A4%A` (and a path with a lone `%`) -> expect 400 and a JSON error; today it is 500. `cd packages/control-plane && bun test test/server/bad-encoding.test.ts` red before. GREEN: same passes and `bash tests/test-control-plane.sh` stays green. CHANGELOG: "control plane: malformed URL encoding returns 400." | LOW | released@2026-10-17T03:50Z | e14b650ab on main (TL APPROVE) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| CP-DRIZZLE-SNAP | Add the missing drizzle 0001 snapshot so `db:generate` on an unchanged schema produces no spurious migration. | packages/control-plane/drizzle/meta/0001_snapshot.json (new) | RED: in a run-owned scratch copy (`loki_run_tmp_create`, then `cp -R packages/control-plane "$LOKI_RUN_TMP/cp"`), run `cd "$LOKI_RUN_TMP/cp" && bun run db:generate` -> a 0002_*.sql appears for the unchanged schema. GREEN: generate the snapshot, repeat in a fresh copy -> no new file, and `git diff --stat` shows only the snapshot. Then `bash tests/test-control-plane.sh` passes. Clean up with loki_run_tmp_cleanup. No CHANGELOG (internal). | LOW | released@2026-10-17T03:50Z | 28e1556c4 on main (TL APPROVE) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| CP-COPY-GUARD-2 | Harden the control-plane Docker COPY guard so it also catches dynamic import(), a second import on one line, and transitive loki-ts value imports missing from Dockerfile.control-plane COPY lines. | tests/test-control-plane.sh (guard block 44-78) | RED: add self-test fixtures inside the suite (in a run-owned temp dir): a file with `await import("../../loki-ts/src/x")`, one with two imports on one line, and a chain a.ts -> b.ts (value import) where b is not copied. Each must make the guard report a missing COPY; today it passes. Run `bash tests/test-control-plane.sh` and show a fixture assertion failing before. GREEN: same passes on the real tree (type-only imports stay ignored, e.g. events.ts -> types.ts). Mutation: delete one real COPY line (Dockerfile.control-plane:16-17) in a scratch copy -> the guard goes red. No CHANGELOG. | LOW | released@2026-10-17T03:50Z | e592482d4 on main (TL APPROVE) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| SPEED-TIMER-UNREF | The group-output spinner interval no longer keeps the process alive when stop() is never called. | loki-ts/src/features/speed/group_output.ts, loki-ts/tests/features/speed/group_output.test.ts | RED: test spawns `bun -e` with isTTY forced true that calls start() and never stop(), with a 5 s timeout -> today it hangs (killed by the timeout, assert exit). `cd loki-ts && bun test tests/features/speed/group_output.test.ts` red before. GREEN: `.unref?.()` on the interval; the child exits within 2 s; existing tests stay green; `bun run build` plus the dist guard pass. Must not touch features/speed/unit_mode.ts (D61-11). CHANGELOG: "Grouped speed output no longer keeps the process alive after a command finishes." | LOW | released@2026-10-17T03:50Z | 06ac495c0 on main (TL APPROVE), dist 63c6fd667 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| SC-LOKI-RATCHET | Warning-level shellcheck coverage for autonomy/loki as a count ratchet (at most 89 today, may only shrink), without editing autonomy/loki. | tests/run-shellcheck.sh, tests/shellcheck-baselines.tsv (new data file, not a test script) | RED: add the ratchet, then in a scratch copy append a line producing SC2086 to autonomy/loki -> `bash tests/run-shellcheck.sh` fails "autonomy/loki warnings 90 > baseline 89". GREEN: on the real tree `bash tests/run-shellcheck.sh` passes and prints "autonomy/loki warnings 89 (baseline 89)". Lowering the file count below the baseline prints a hint to lower the baseline. Run it with `timeout -k 10 120` and record the wall time (today about 19 s for this file) in the PR, and schedule the large file first so total wall time does not grow. Not a new tests/*.sh, so no runner or shard row. No CHANGELOG. | LOW | released@2026-10-17T03:50Z | 785423377 on main (TL APPROVE) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| TRACKER-SITE-1 | Jira intake refuses when JIRA_BASE_URL and the browse URL's origin differ, instead of fetching the same key from the wrong site and building the wrong issue. It also refuses suffix, userinfo and port tricks. | loki-ts/src/features/tracker_intake.ts, loki-ts/tests/engine10/tracker_intake.test.ts, CHANGELOG.md | RED: new tests: (1) JIRA_BASE_URL=https://acme.atlassian.net plus URL https://other.atlassian.net/browse/X-1 -> expect an error naming both origins (today it resolves to acme); (2) `https://acme.atlassian.net.evil.com/browse/X-1`; (3) `https://user@acme.atlassian.net/browse/X-1`; (4) `https://acme.atlassian.net:8443/browse/X-1` -> each refused. `cd loki-ts && bun test tests/engine10/tracker_intake.test.ts` red before. GREEN: same command passes, plus `cd loki-ts && bun run build` and `bash tests/test-release-dist-guard.sh` (dist rebuilt in main checkout per memory). Matching origins still work. CHANGELOG: "Jira intake: a browse URL whose site differs from JIRA_BASE_URL is refused instead of silently fetched from the configured site." | MEDIUM | released@2026-10-17T03:50Z | 5b595ba3b on main (MEDIUM TL APPROVE) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| PO3-QS-MATCH | quickstart picks simple-todo-app for briefs that match no template (#217): keywords + no-match fallback | autonomy/quickstart.sh, tests/test-quickstart-bash32.sh | MEDIUM | bash tests/test-quickstart-bash32.sh (red: URL-shortener brief ranks simple-todo-app first) | released@2026-10-17T03:50Z | ca50d28d8 TL APPROVE Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| PO3-PAUSED-TTY | Bun PAUSED.md says Press Enter off a TTY and cites wrong run.sh lines (#212) | loki-ts/src/runner/intervention.ts, loki-ts/tests/runner/intervention.test.ts | LOW | cd loki-ts && bun test tests/runner/intervention.test.ts (red: non-TTY text still says Press Enter) | released@2026-10-17T03:50Z | TL APPROVE (27/0, 8/0, 85/0, byte parity cmp identical 411B); merged 1ba95e986+b31cf61a7, dist rebuilt Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| PO3-MEM-INDEX | loki memory index rebuild wipes the index and prints success on failure (#204) | autonomy/loki (24647-24662 only), tests/test-memory-cli.sh | MEDIUM | bash tests/test-memory-cli.sh (red: 2-episode fixture ends with total_memories 0 or no index.json) | released@2026-10-17T03:50Z | TL APPROVE (test-memory-cli 25/0, 11b red on parent); merged b7b9c74bb Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| PO3-COUNCIL-TODO | council TODO/FIXME count scans node_modules/.git/.loki and can set blocked=true (3 greps) | autonomy/completion-council.sh (3609, 3886, 4152), tests/test-council-todo-scope.sh (new) | HIGH | bash tests/test-council-todo-scope.sh (red: 6 TODO files under node_modules block the council) | released@2026-10-17T03:50Z | opus APPROVE (32 council suites rc 0, BSD+GNU grep, red 7/9); merged d5ac03e1a; advisories A1-A3 logged Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| PO3-HEAL-DOC | healing docs claim failure-modes.json and an enforced pairing contract that never run in production (#200) | skills/healing.md, docs/dev/architecture-reference.md, tests/test-heal-docs-honesty.sh (new) | LOW | bash tests/test-heal-docs-honesty.sh (red: docs assert the artifact is written; zero production callers) | released@2026-10-17T03:50Z | TL APPROVE (3/0, red on parent, mutation red, structural guards green); merged a9388e9a7 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| PO3-SKILL-RUNTIME-DOC | SKILL.md says only read-only commands run on Bun; cli.ts now routes start, proof, report, engine10 and more | SKILL.md (line 18), tests/test-skill-md-runtime-claim.sh (new) | LOW | bash tests/test-skill-md-runtime-claim.sh (red: cli.ts case labels absent from the claim) | released@2026-10-17T03:50Z | TL APPROVE (claims verified vs bin/loki:570, new guard 7/0, red 4/3 on parent); merged 10aab744d Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| PO3-HELP-ALLCMDS | loki help All commands omits keys and workspace; discoverability test passes on any prose mention | autonomy/loki (help block ~1814), tests/test-help-discoverability.sh | LOW | bash tests/test-help-discoverability.sh (red after tightening the matcher to the All commands block) | released@2026-10-17T03:50Z | TL APPROVE (4/0, 15/0, 9/0, mutation red); merged d82bf2779 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| PO4-COUNCIL-TEST-TMP | council TODO scope test uses raw mktemp; switch to loki_run_tmp helper | tests/test-council-todo-scope.sh | LOW | bash tests/test-council-todo-scope.sh (red: file has mktemp, no loki_run_tmp_create) | released@2026-10-17T03:50Z | TL APPROVE (17/0, mutation red, run dir cleaned); merged 8a1b49075 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| PO4-ANCHOR-PRECHECK | probe-free stale-anchor precheck for trust-core probe_case strings (#214 opt 3) | tests/test-trust-core-tests-detect.sh, scripts/local-ci.sh | MEDIUM | TRUST_CORE_PROBE_MODE=anchors bash tests/test-trust-core-tests-detect.sh (red: fixture stale anchor exits 0) | released@2026-10-17T03:50Z | TL APPROVE (semantics match probe, red real, 94 anchors 0.14s, hermetic 18/0); merged fe8456b1b Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| PO4-HEAL-GUARD-SCOPE | heal-docs honesty guard scans only 3 dirs; widen to all tracked files | tests/test-heal-docs-honesty.sh | LOW | bash tests/test-heal-docs-honesty.sh (red: dashboard/ caller fixture counts 0) | released@2026-10-17T03:50Z | TL APPROVE (4/0, revert-to-old-scan mutation red); merged fed6dfe2c Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| PO4-CLI-TS-HELP | cli.ts header says 8 commands and HELP omits dispatched commands | loki-ts/src/cli.ts, loki-ts/tests/commands/cli_help_routes.test.ts, loki-ts/dist | LOW | cd loki-ts && bun test tests/commands/cli_help_routes.test.ts (red: kpis/report/trust missing from HELP) | released@2026-10-17T03:50Z | TL APPROVE + wording fix (8/0, dist guard 13/0); merged db0ae9eea+458237fb6, dist 8fd495579 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| PO4-DASH-SWEEP | remove em/en dashes from 7 tracked text files incl proof-passport output | tools/proof-passport.py, 6 docs files, tests/test_proof_passport.py | LOW | python3 -m pytest tests/test_proof_passport.py (red: rendered passport contains U+2014) | released@2026-10-17T03:50Z | TL APPROVE (passport pytest 12/0, no dashes in diff); merged 43ca907a4 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| PO4-START-REPO-DIR-FIX | tests/cli/test-start-repo-directory.sh fails today; diagnose and fix | tests/cli/test-start-repo-directory.sh | MEDIUM | bash tests/cli/test-start-repo-directory.sh (red: exits 1 stubbed dispatch) | released@2026-10-17T03:50Z | TL APPROVE (root cause /var symlink confirmed, injection check intact); merged Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| PO4-CLI-SUITES-REG | 4 tests/cli suites unregistered; guard scans only tests/test-*.sh (after START-REPO-DIR-FIX) | tests/run-all-tests.sh, tests/test-registration-coverage.sh, tests/shard-durations.tsv | MEDIUM | bash tests/test-registration-coverage.sh (red: guard extended to tests/*/ names 4 files) | released@2026-10-17T03:50Z | TL APPROVE (mutation red, same-name masking refuted, shellcheck unchanged vs parent); merged af6b616fa Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| PO4-TRUST-CMD-TEST | Bun runTrust has no exit-code/flag contract test | loki-ts/tests/commands/trust.test.ts | LOW | cd loki-ts && bun test tests/commands/trust.test.ts (red vs stub; mutation return 1->0) | released@2026-10-17T03:50Z | TL APPROVE (14/0, json-branch mutation 3 red); merged Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| PO4-TODO-PLURAL | council TODO counter misses TODOs/FIXMEs plurals (after COUNCIL-TEST-TMP) | autonomy/completion-council.sh (3 patterns), tests/test-council-todo-scope.sh | HIGH | bash tests/test-council-todo-scope.sh (red: six TODOs-only files do not trip count) | released@2026-10-17T03:50Z | opus APPROVE (BSD and GNU grep identical on 16 cases, 3 site mutations red, 30 council suites green); merged 4c88ff15e Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| PO5-ASSESS-HONEST | modernize heal --assess counts plural TODOs and reports the real largest file | autonomy/loki (PYASSESS heredoc only), tests/test-assess-runtime-detection.sh | LOW | bash tests/test-assess-runtime-detection.sh | released@2026-10-17T03:50Z | 48968d0a5 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| PO5-REG-EXACT | registration coverage matches suites exactly, not by substring | tests/test-registration-coverage.sh | LOW | bash tests/test-registration-coverage.sh | released@2026-10-17T03:50Z | 135dc6368 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| PO5-ANCHOR-EQ | trust-core anchors pre-check rejects find == repl cases | tests/test-trust-core-tests-detect.sh | LOW | TRUST_CORE_PROBE_MODE=anchors bash tests/test-trust-core-tests-detect.sh | released@2026-10-17T03:50Z | 752e3c684 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| PO5-DOGFOOD-HONEST | dogfood-stats --help and labels the keyword heuristic | scripts/dogfood-stats.sh, tests/test-dogfood-stats.sh | LOW | bash tests/test-dogfood-stats.sh | released@2026-10-17T03:50Z | 65c9232b1 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| PO5-ORPHAN-SUITES | register 4 orphaned non-test-*.sh suites, guard their naming | tests/test-registration-nonstandard.sh, tests/integration/run_integration_suite.sh | LOW | bash tests/test-registration-nonstandard.sh | released@2026-10-17T03:50Z | 2db6d1358 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| PO5-DASH-BENCH | remove dashes from benchmarks/magic-ab/README.md, whole-tree dash guard | benchmarks/magic-ab/README.md, tests/test-no-dashes-tree.sh | LOW | bash tests/test-no-dashes-tree.sh | released@2026-10-17T03:50Z | 6e26b46fd Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| PO5-HELP-READONLY | measure-run.sh and guard-changed.sh treat --help as help | scripts/measure-run.sh, scripts/guard-changed.sh, tests/test-help-readonly-scripts.sh | LOW | bash tests/test-help-readonly-scripts.sh | released@2026-10-17T03:50Z | 4eba90e3f (from de07c36a6), TL APPROVE 17/0, mutation red 6 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| PO5-HELP-NOTES-BRANCHES | release-notes.sh and clean-test-branches.sh real --help | scripts/release-notes.sh, scripts/clean-test-branches.sh, tests/test-release-notes.sh, tests/test-clean-test-branches.sh | LOW | bash tests/test-release-notes.sh; bash tests/test-clean-test-branches.sh | released@2026-10-17T03:50Z | 53d295093 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| PO5-WORKSPACE-VACUOUS | test-workspace.sh fails when no assertions ran | tests/test-workspace.sh | LOW | bash tests/test-workspace.sh | released@2026-10-17T03:50Z | 43e805cef Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| PO5-HELP-INSTALL-HOOKS | install-hooks.sh --help never rewrites git config | scripts/install-hooks.sh, tests/test-install-hooks.sh | LOW | bash tests/test-install-hooks.sh | released@2026-10-17T03:50Z | fce165e70 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| D82-COSTCAP | Cost cap: subscription runs no dollar cap plus one info line; API-key runs default $100; --max-cost and budgets.per_run override; BUDGET_STOP exit 3 | autonomy/ cost-cap code, docs, tests | MEDIUM | builds, own test file green, CI green | released@2026-10-17T03:50Z | D82 10.7.0 big train Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| D82-FLAGS | Default-on: visual evidence, spec-to-contract, D61 parallel, Slack two-way, MCP tools, Control Plane, workspaces; env=0 opts out; listeners loopback only; senders inert without credential | flag defaults, docs, tests | MEDIUM | builds, own test file green, CI green | released@2026-10-17T03:50Z | D82 10.7.0 big train Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| D82-A-E2E | Playwright browser e2e with video and trace attached to the PR | e2e/verify path | MEDIUM | builds, own test file green, CI green | released@2026-10-17T03:50Z | D82 10.7.0 big train Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| D82-B-MERGE | loki merge queue | new CLI subcommand | MEDIUM | builds, own test file green, CI green | released@2026-10-17T03:50Z | D82 10.7.0 big train Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| D82-C-REVIEW | loki review PR with a deterministic risk score | new CLI subcommand | MEDIUM | builds, own test file green, CI green | released@2026-10-17T03:50Z | D82 10.7.0 big train Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| D82-D-MEMORY | Project memory across runs | memory path | MEDIUM | builds, own test file green, CI green | released@2026-10-17T03:50Z | D82 10.7.0 big train Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| D82-E-CPMOBILE | Control Plane mobile layout (roles and sign-in to 10.7.1 under D12) | dashboard UI | LOW | builds, own test file green, CI green | released@2026-10-17T03:50Z | D82 10.7.0 big train Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| D82-F-EMU | Mobile emulator tests | test harness | MEDIUM | builds, own test file green, CI green | released@2026-10-17T03:50Z | D82 10.7.0 big train Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| D82-G-REST | REST API for runs (loopback) | dashboard server API | MEDIUM | builds, own test file green, CI green | released@2026-10-17T03:50Z | D82 10.7.0 big train Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| D82-H-ACP | VS Code and JetBrains via ACP | acp adapter | MEDIUM | builds, own test file green, CI green | released@2026-10-17T03:50Z | D82 10.7.0 big train Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| D82-I-SENTRY | Sentry intake to tasks | intake path | MEDIUM | builds, own test file green, CI green | released@2026-10-17T03:50Z | D82 10.7.0 big train Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| D82-J-D50 | D50 Sonnet lift fixes | per D50 | MEDIUM | builds, own test file green, CI green | released@2026-10-17T03:50Z | D82 10.7.0 big train Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| D82-GAPS | Gap research vs Devin, Factory, 8090, Vorflux, Claude Code | docs/v10 research doc | LOW | builds, own test file green, CI green | released@2026-10-17T03:50Z | D82 10.7.0 big train Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| CP-INGEST | Control Plane zero-setup ingest: backfill plus tail of .loki/runs/*/events.jsonl from loki control serve | packages/control-plane shipper | MEDIUM | own tests green | released@2026-10-17T03:50Z | D82 10.7.0 big train Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| CP-LEGACY | loki dashboard, web, docker host side and run.sh auto-open route to the Control Plane; LOKI_LEGACY_DASHBOARD=1 restores | autonomy/loki, run.sh | MEDIUM | test-web-alias-consistency 7/7 | released@2026-10-17T03:50Z | D82 10.7.0 big train Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| CP-UI-LIVE | Control Plane live run view, overview and landing | packages/control-plane ui | LOW | live.test.tsx green | released@2026-10-17T03:50Z | D82 10.7.0 big train Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| CP-UI-SHELL | Control Plane shell, brand, import, loopback-only start endpoint | packages/control-plane ui and server | HIGH | opus APPROVE r2, suite 68/0 | released@2026-10-17T03:50Z | D82 10.7.0 big train Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| D82-WALL0 | Empty Wall seal is NOT PROVEN; nested Wall files collected | loki-ts engine10 wall and seal | HIGH | opus APPROVE r2, wall+seal 101/0 | released@2026-10-17T03:50Z | D82 10.7.0 big train Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| D83-CPE | Enterprise Control Plane UI rebuild, slices CPE-01..26 per docs/v10/CP-ENTERPRISE-UI.md, integrating on branch cpe-base | packages/control-plane, loki-ts engine10 run_pid | HIGH | per-slice Wall checks, opus on 04/07/09/14 | building@15:33Z (01,03,05,21 on cpe-base; 04,07 in opus review; 02,09 building) | D83 10.8.0 |
-| FC-09r | FC-09 rework f4eccfeac BLOCKED by rv-trust3 (reproduced): package.json pretest/posttest/test:* edits return no runner-config note; compare the whole scripts object, and have verify compare base vs head runner sections; add go.mod replace, Cargo.toml [patch], package.json overrides/imports, tsconfig paths | loki-ts/src/features/runner_config.ts plus its tests | HIGH | bun repro: a pretest-only edit caps the verdict; runner_config tests green | released@2026-10-15T23:55Z | Do not merge f4eccfeac as is. Opus reviewer. |
-| FC-09s | FC-09 sibling sweep from the FC-09r opus review (bun probe reproduced): runner_config misses (1) Cargo.toml top-level dotted keys such as patch.crates-io.serde = { path = "fake" } before [package]; (2) go.work replace directives (go.work is not in RUNNER_CONFIGS); (3) babel.config.*, .babelrc, .pnpmfile.cjs, Cargo [[test]] harness=false and Cargo [dev-dependencies] path=; also add one verify-stage case where a package.json pretest edit caps the verdict | loki-ts/src/features/runner_config.ts, loki-ts/tests/engine10/runner_config.test.ts, loki-ts/tests/engine10/verify_weak.test.ts | HIGH | each probe above caps the verdict to NOT PROVEN; a plain version bump still does not cap | released@2026-10-16T00:49Z | FC-09 sibling (L5). No core engine10 lines (4998 of 5000). |
-| FC-09t | FC-09s opus review follow-ups (all reproduced as pre-existing misses): P1 Cargo section headers with a trailing comment or inner spaces ([patch.crates-io] # local, [ patch.crates-io ], [dev-dependencies] # t) are not seen, so path= under them does not cap; Cargo [dependencies] and [workspace.dependencies] path= (parity with npm depGuard); dev-dependency git =; [[test]] path = and [lib] test = false; go.work use ./x lines and a new go.work with only use lines; .pnpmfile.mjs | loki-ts/src/features/runner_config.ts, loki-ts/tests/engine10/runner_config.test.ts | HIGH | each probe caps; plain version bumps do not cap | released@2026-10-16T01:20Z | r5 231b29015 Opus-APPROVED (120 probes), riding fv-train. r5 followed Opus BLOCK on r4 5f4e626bb ([[bin]] harness, required-features, path uncapped; Cargo dep git, package, workspace, rev and package.workspace parity added). r2 9e00d7c21 and r3 064cb191b were also Opus-BLOCKED. FC-09 sibling (L5). No core engine10 lines. |
-| FV-evidence-sha-1 | Bind integration status and exit code into the composite: In composeComposite and verifyComposite (seal_group.ts), read integration.json status/exit_code. Seal throws unless status is passed or not_configured. Verify returns TAMPERED when status is failed/interrupted or exit_code is nonzero. Add integration {status, exit_code, log_sha256, heads} to Composi | loki-ts/src/features/speed/seal_group.ts | HIGH | Extend loki-ts/tests/engine10/seal_group.test.ts: writeWs fixture (line ~341) with status:failed. Red: current code seals VERIFIED then verify passes; green: se | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-evidence-sha-2 | Bind integration.log hash and require non-null heads: In composeComposite refuse null/missing heads[repo] and, when log_sha256 is non-null, recompute sha256 of <run>/integration.log and throw on mismatch/missing. In verifyComposite do the same (TAMPERED on log mismatch) and make integrated-head mismatch TAMPERED rather than UNCHECKED (matches seal). Ke | loki-ts/src/features/speed/seal_group.ts | HIGH | Extend seal_group.test.ts tests at ~458 (null head) and ~406 (head edit): add log swap case; update null-head expectation to seal-refuse, add legacy-case UNCHEC | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-evidence-sha-3 | Show SHAs and integration status in verify output and fix stale note: Make `loki verify <run-dir>/composite.json` and the --seal-composite output print per-repo head_sha, integration status and log hash (verify_cmd.ts:132 and the composite verify branch near :111-122). Delete the stale `seal: False` and 'only when the run seals one' note in workspace.py run_integratio | loki-ts/src/engine10/verify_cmd.ts, autonomy/lib/workspace.py | MEDIUM | Extend loki-ts/tests/engine10/verify_cmd.test.ts (composite output contains each 40-hex head and 'integration: passed') and the existing workspace python test f | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-evidence-sha-4 | Correct workspace guide on what the Seal covers, reachable from chat: Update docs/WORKSPACES.md lines 39, 55-59: state integration.json, integration status, log hash and every head SHA are inside the signed composite; list the new TAMPERED conditions (failed status, log swap, head mismatch); state explicitly that deployed-SHA binding is not implemented. Remove the now | docs/WORKSPACES.md | LOW | Extend the existing docs/claims guard test if present (grep tests for WORKSPACES.md); otherwise a grep assertion in seal_group.test.ts is not needed: manual che | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-readiness-env-1 | Readiness score + findings in loki doctor --repo: Add pure function repoReadiness(profile, reqs) in repo_profile.ts returning {score 0-100, grade, findings[{id,severity,message,fix}]}. Rules from existing profile fields: no test cmd (-30), baseline not run/timed out/not attributable (-15), baseline red with N failing ids (-20, fix: 'loki start will | loki-ts/src/runner/repo_profile.ts, loki-ts/src/commands/doctor.ts | LOW | Extend loki-ts/tests/runner/harness_intelligence.test.ts REPOMEM block (near :764 and :634): red = assert readiness absent/undefined fails for profiles with no  | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-readiness-env-2 | doctor --repo builds the profile on demand (--fix applies safe repo repair): When profile is absent, `loki doctor --repo` calls the existing ensureProfile(process.cwd()) (honours LOKI_REPO_BASELINE=0, never throws) instead of printing 'none yet'; keep read-only printing when a fresh profile exists. Allow --repo --fix to mean 'build/refresh profile' (replace the exit-64 rejec | loki-ts/src/commands/doctor.ts, loki-ts/src/runner/repo_profile.ts | MEDIUM | Extend harness_intelligence.test.ts :764 test: red = absent profile in a temp git repo with package.json test script prints 'none yet'; green = doctor --repo cr | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-readiness-env-3 | Reach readiness from loki start and loki chat: Add /doctor (alias /ready) slash to loki chat delegating via _chat_do "$loki" doctor --repo (plus --json passthrough), listed in _chat_help. In loki start's existing first-run/summary output, print the one-line 'Readiness: NN/100' from the same repoReadiness helper after intake builds the profile (i | autonomy/lib/chat.sh, loki-ts/src/engine10/stages/intake.ts | LOW | Extend an existing chat test if present (grep tests/ for chat help assertions, e.g. tests/test-first-run-funnel-coverage.sh) to assert /doctor appears in /help  | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-readiness-env-4 | Docs reconcile + remove dead doctor-fix.py: Update docs/CLI-REFERENCE.md and docs/cli-reference.md (merge into one if one is a duplicate, delete the other and fix links) doctor row to list --json --fix --requirements --repo and readiness score; add a short Readiness section. Verify then delete autonomy/lib/doctor-fix.py and tests/test_doctor_ | docs/CLI-REFERENCE.md, docs/cli-reference.md, autonomy/lib/doctor-fix.py, tests/test_doctor_fix_plan.py | LOW | Existing docs-vs-help guard (grep tests/ for CLI-REFERENCE checks) must stay green; after deletion run tests/run-all-tests.sh doctor subset (test-doctor-ux.sh,  | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-docs-pin-1 | Fix `loki answer` wording everywhere: Change 'Resume a BLOCKED run' to 'Start a follow-up run from a BLOCKED run with your answer' in the single registry string and help text; run generate-stale-zero.sh so CLI-REFERENCE regenerates; fix README.md:105 and autonomy/loki:1685 help; add one line to docs/slack.md that CLI `loki answer` has t | loki-ts/src/cli/registry.ts, loki-ts/src/cli.ts, README.md, autonomy/loki, docs/slack.md, docs/CLI-REFERENCE.md | LOW | Extend loki-ts/tests registry/help snapshot test (or tests/test-docs-cli-drift.sh): red = grep 'Resume a BLOCKED' returns hits in registry.ts/README/cli.ts; gre | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-docs-pin-2 | Correct wiki/Providers.md capability table from provider files: Edit existing table (wiki/Providers.md:11-18) to match providers/*.sh: context windows, codex parallel (max 2, degraded), cline MCP yes; add Degraded column; add a one-line 'source: providers/*.sh PROVIDER_* vars' note. Mirror the same facts in README.md:116 only if it disagrees. No new doc. | wiki/Providers.md, README.md | LOW | Extend tests/test-no-stale-facts.sh (or test-docs-cli-drift.sh) with a check that for each provider the doc row's Parallel/MCP/context value equals the provider | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-docs-pin-3 | Reconcile Node floor and install claims: Make README.md:142 and docs/INSTALLATION.md:60 say Node 20+ (matches package.json engines >=20.0.0 and wiki/Installation.md:11); verify against bin/loki runtime check for the Node guard and keep the stricter source of truth. | README.md, docs/INSTALLATION.md, wiki/Installation.md | LOW | Extend tests/test-no-stale-facts.sh: red = grep 'Node.js 18' README/INSTALLATION; add assertion that min-Node string in docs equals package.json engines.node; g | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-docs-pin-4 | Stamp wiki pages to current VERSION and fix legacy-engine banner: Replace the 13 stale 10.6.6 version stamps with 11.11.0 (pin to 11.12.0 at release via generate-stale-zero.sh by adding wiki/*.md line-3 stamp to its targets), delete the 'legacy engine, being removed' banner in wiki/CLI-Reference.md:3 and drop or mark rows for commands not in registry (compound, cp | scripts/generate-stale-zero.sh, wiki/CLI-Reference.md, wiki/Architecture.md, wiki/Dashboard.md, wiki/Home.md, tests/test-no-stale-facts.sh | MEDIUM | Extend tests/test-no-stale-facts.sh to scan wiki/*.md version stamps against VERSION (and tests/lib/scan-doc-cli-drift.py to cover wiki/): red = 13 pages flagge | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-deploy-observe-1 | Re-check health after auto-rollback and record it: After a rollback exits 0, re-probe health_url with _deploy_probe_health; add post_rollback_health (healthy/FAILED_HEALTH/unchecked) and health_http_code to the loki.deploy/1 record; replace the 'NOT re-checked' message. Return distinct exit if rollback also unhealthy. | autonomy/loki, docs/SIGNED-RECEIPTS.md | MEDIUM | Extend tests/test-deploy-receipt-gate.sh section 14-18 (line ~740): stub vercel/curl, red = record lacks post_rollback_health and message still says NOT re-chec | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-deploy-observe-2 | Acceptance beyond 2xx: --health-match and artifact evidence: Add `--health-match STR` to loki deploy (and pass-through on start --deploy): probe body must contain STR (e.g. HEAD sha or version) else FAILED_HEALTH; record health_match, health_http_code, tree_sha (git rev-parse HEAD^{tree}) in loki.deploy/1. | autonomy/loki, loki-ts/src/commands/start.ts, loki-ts/src/util/receipt_signer.ts | MEDIUM | Extend tests/test-deploy-receipt-gate.sh (stub curl body): red = mismatching body still reports healthy; green = FAILED_HEALTH exit 4. Extend start-flags allowl | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-deploy-observe-3 | Surface last deploy in `loki status` / `loki chat` context: Read newest .loki/deploys/*.json and show target, head_sha, health_status, rollback, signed/VERIFIED via existing verify path in `loki status` (and the chat context that status feeds). Gives 'observing' state without a new command. | loki-ts/src/commands/status.ts, loki-ts/src/util/receipt_signer.ts, loki-ts/tests/commands | LOW | Extend the existing status command test: fixture .loki/deploys/x.json with FAILED_HEALTH; red = status prints nothing about deploy; green = prints line and flag | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-deploy-observe-4 | Sentry brief correlates alert with latest deploy and culprit owner: In build_sentry_brief/handle_sentry_event, append release/environment from payload and, from the project's .loki/deploys newest record, 'last deploy <sha7> <finished_at> health=<status>' plus git log -1 author/commit for the culprit file when resolvable. Still PR-only, brief stays one sanitized line | autonomy/trigger-server.py, autonomy/issue-providers.sh, docs/sentry-intake.md | HIGH | Extend tests/test_trigger_server_hardening.py (sentry fixture ~line 749): red = brief lacks deploy context with a seeded deploy record; green = present, control | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-outcome-metrics-1 | Record intervention type and waited minutes at the pause site: Extend the existing interventions.json write in handlePause to also keep by_type counts {steer,input,authorization,repair} (mapped from the existing pause reasons: HUMAN_INPUT.md=input, PAUSE/checkpoint=authorization, budget/council force-review=repair/steer as appropriate, enum only, no free text)  | loki-ts/src/runner/intervention.ts, autonomy/run.sh, autonomy/lib/proof-generator.py | MEDIUM | Extend loki-ts/tests/runner/autonomous.test.ts (already drives intervention signals at :167-176): red = assert interventions.json has by_type + waited_s after a | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-outcome-metrics-2 | Add effort-per-outcome block to loki trust (cost, retries, misleading claims, interventions by type): Extend the existing trust derivation (TrustRun + computeTrajectory + formatTrajectoryHuman/Json) with: per-run cost_usd (proof.cost.usd, null when unmeasured), interventions_by_type and waited_s (from slice 1, null when absent), and an 'Outcome effort' summary: accepted = verdict VERIFIED; misleadin | loki-ts/src/metrics/trust.ts, autonomy/lib/trust_trajectory.py, loki-ts/src/commands/trust.ts | LOW | Extend loki-ts/tests/metrics/trust.test.ts (intervention axis block at :161) and tests/test_trust_trajectory.py: red = fixture of 4 proofs (2 VERIFIED, 1 false_ | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-outcome-metrics-3 | Surface the metric in HANDOFF.md and the final run line on engine10: Make engine10 handoff stop saying 'not recorded' for interventions: in composeHandoff read .loki/state/interventions.json (count, by_type, waited_s) when no steer.consumed/intervention events exist, render 'interventions N (input 1, authorization 1); waited 4m' and keep 'not recorded' only when the  | loki-ts/src/util/run_summary.ts | LOW | Extend loki-ts/tests/util/run_summary.test.ts: red = write interventions.json fixture in the temp repoDir, call composeHandoff/renderHandoff, expect the by-type | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-outcome-metrics-4 | Document metric definitions and align bench report to the same names: Add one 'Outcome analytics' section to the existing docs/EVALUATING.md defining accepted outcome, misleading completion (= attribution.py false_completion = trust false_verified), cost per accepted, interventions by type, waited vs active minutes (active minutes explicitly NOT measured; only waited  | docs/EVALUATING.md, benchmarks/bench/attribution.py | LOW | Extend the existing attribution test (benchmarks/bench tests, e.g. the one asserting false_completion and cost_per_accepted in the report) with an assertion tha | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-gh-steer-1 | Trigger server: authorized issue_comment steers, unauthorized ignored: Add handle_issue_comment_event to EVENT_HANDLERS: on action=created, comment on an issue/PR with a known run (match repo#N), require comment.author_association in OWNER/MEMBER/COLLABORATOR (same set as verify_pr.ts:150), skip bot/self comments and edited/deleted, one-line-bound the body, then run `l | autonomy/trigger-server.py, docs/DEPLOYMENT.md | HIGH | Extend tests/test_trigger.py TestEventRouting: red first with MEMBER comment -> steer args fired, NONE/CONTRIBUTOR comment -> 'skipped', bot comment skipped, fo | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-gh-steer-2 | Steer carries intent revision + actor + source: Make `loki steer` (and chat /steer through the same writer) record a numbered revision header (rev N, actor, source=cli/chat/github comment URL) in HUMAN_INPUT.md, and have steer.ts consumeSteer archive it and append an entry to .loki/intent-revisions.jsonl so scope changes are an auditable revision | autonomy/loki, loki-ts/src/util/steer.ts, loki-ts/tests/e10ext/steer.test.ts | MEDIUM | Extend loki-ts/tests/e10ext/steer.test.ts: red-then-green that consumeSteer on a header-bearing file returns the guidance and appends a revision record with rev | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-gh-steer-3 | Project engine10 status onto the originating issue (single updating comment): Generalise the supervisor's failure-only CommentStep (supervisor.ts:196-198) into a status projector: at plan done, steer applied, blocked, PR opened, and done, upsert ONE marker-tagged comment (<!-- loki-status -->) on the issue via a new `issue-comment --update` mode in engine10-push.sh (find by m | loki-ts/src/engine10/supervisor.ts, autonomy/lib/engine10-push.sh, loki-ts/src/engine10/types.ts | MEDIUM | Extend the existing supervisor test (loki-ts/tests/engine10 supervisor/issue_ref_e2e.test.ts with its fake gh in tests/engine10/fixtures/issue-ref/bin/gh): red- | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-gh-steer-4 | Steer ack back to the comment + chat parity: After slice 1 steers, acknowledge on the issue with an eyes reaction/short reply naming revision N and 'applies at next plan/implement stage' (or rejection reason for unauthorized: a single line, no run details), via engine10-push.sh. Ensure `loki chat` /steer and `loki start` print the same `rev N` | autonomy/trigger-server.py, autonomy/lib/engine10-push.sh, loki-ts/src/cli/registry.ts | LOW | Extend tests/test_trigger.py: red-then-green that an authorized comment dispatch also invokes the ack command with the revision and an unauthorized one posts no | released@2026-10-16T02:04Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-work-item-1 | Canonical work-item state fold (one vocabulary) surfaced in loki status: Add pure workItemState(events) in events.ts next to fold(): maps to received/prepared/planned/executing/validating/ready_to_ship/completed + waiting_for_input(SPEC_CONFLICT)/budget_stopped(cap.hit)/failed/cancelled/stalled, using the same stage events summarize() already reads. Make summarize() (run | loki-ts/src/engine10/events.ts, loki-ts/src/commands/run_status.ts, loki-ts/src/util/run_outputs.ts, docs/v10/ENGINE.md | MEDIUM | Extend loki-ts/tests/commands/run_status.test.ts with event fixtures per state; red first (no `state` field), green after fold; reuse existing phaseOf cases to  | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-work-item-2 | Record work-item intent on run.started and link answers to parent run: Extend the existing opts.started payload (supervisor.ts:69,138) with actor (git user / LOKI_ACTOR / trigger source), policy_revision (sha256 of policies file read by policyGate, run_outputs.ts:170), budget_usd cap, and parent_run. Have runAnswer (blocked_answer.ts:74) pass parent via env LOKI_PARENT | loki-ts/src/engine10/supervisor.ts, loki-ts/src/features/blocked_answer.ts, loki-ts/src/util/run_outputs.ts | MEDIUM | Extend loki-ts/tests/features/blocked_answer.test.ts: red = launched env lacks LOKI_PARENT_RUN / started event lacks parent_run; green after wiring. Add one sup | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-work-item-3 | Surface PR reuse truthfully (existing flag) and make resume skip duplicate creation provably: Make engine10-push.sh push-pr print a second marker (e.g. line 'reused') when `gh pr list --head` found an open PR (push.sh:160-166); pr.ts parse it (pr.ts:117-126) to set existing true/false instead of null, remove the 'contract gap' comment (pr.ts:4-6). resumePublish and startRecovery already pass | autonomy/lib/engine10-push.sh, loki-ts/src/engine10/stages/pr.ts, loki-ts/src/util/run_outputs.ts | HIGH | Extend existing pr stage test and tests/test-acceptance-resume-idempotence.sh: red = replay with open PR yields existing:null; green = existing:true and gh pr c | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-work-item-4 | Durable trigger intake dedup keyed on origin+issue+head: Persist seen_delivery ids to a small JSONL under the trigger server's existing state dir (append on accept, load bounded N at startup) in trigger-server.py:1049-1086, and add a second key (event repo#issue + action + head sha) so a redelivery with a new delivery id or a server restart does not re-di | autonomy/trigger-server.py, tests/test_trigger_server_hardening.py | HIGH | Extend tests/test_trigger_server_hardening.py: red = new Dispatcher instance on same state dir re-dispatches same delivery id; green = returns duplicate. Second | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-tracker-writeback-1 | Slack allowlist fails closed: Unset LOKI_SLACK_ALLOWED_USERS rejects all (explicit '*' opts in to open) in slack_inbound.ts; add same user gate to trigger-server /slack using form user_id. Update docs/slack.md:24 and startup message. | loki-ts/src/contrib/slack_inbound.ts, autonomy/trigger-server.py, docs/slack.md | HIGH | Extend loki-ts/tests/features/slack_inbound.test.ts (unset -> NOT_ALLOWED, '*' -> allowed; red against current :91) and tests/test_trigger_server_hardening.py _ | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-tracker-writeback-2 | Phase-aware shared writeback contract in writeback.ts: Extend WritebackInput with origin {kind, ref} and phase (started/blocked/done/failed); commentText per phase; optional Jira transition (LOKI_JIRA_DONE_TRANSITION id) and Linear state (LOKI_LINEAR_DONE_STATE). Fall back to intake creds (JIRA_BASE_URL/JIRA_EMAIL/JIRA_API_TOKEN/LINEAR_API_KEY) so intak | loki-ts/src/integrations/writeback.ts, loki-ts/src/engine10/stages/pr.ts | MEDIUM | New loki-ts/tests/integrations/writeback.test.ts is justified because B6 test claimed in RELEASE-11.md:43 does not exist; stub fetch, assert comment per phase,  | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-tracker-writeback-3 | Trigger server uses one reply-target contract for Jira, Teams, Sentry: Add reply targets in _handle_jira ({kind:jira,key}), and a jira branch in notify_job_complete posting an ADF comment (reuse existing _post_json with Basic auth from JIRA_* env); make Linear/Jira branches share a small table-driven dispatcher; capture Teams serviceUrl/conversation target if verified. | autonomy/trigger-server.py | MEDIUM | Extend tests/test_trigger_server_hardening.py chat fixture: Jira webhook then completion posts comment to stubbed URL; no target when creds absent; notifier fai | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-tracker-writeback-4 | Docs and loki start wiring truth-up: Rewrite docs/trackers.md to describe actual writeback (comment, phases, transitions, env vars, opt-in) and delete the 'no write back' line; make loki start jira:/linear: refs export LOKI_WRITEBACK_ISSUE so writeback keys off the intake ref; add one line in docs/CLI-REFERENCE.md. | docs/trackers.md, docs/CLI-REFERENCE.md, loki-ts/src/commands/start.ts | LOW | Extend the existing start.ts test (loki-ts/tests, locate by git grep start.ts) to assert env LOKI_WRITEBACK_ISSUE set for jira:PROJ-123 ref and unset for plain  | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-pr-loop-1 | Gate --ship auto-merge on checks + verdict via shared merge gate: Extract the green-check/poll/merge core of cmd_merge into one helper (e.g. _merge_pr_gated <pr>) and make both `loki merge run` and the --ship auto-merge blocks (detached inner script and issue-mode path) call it. Refuse merge when PR is draft, gh pr checks != 0 after polling, or run verdict != VERI | autonomy/loki, docs/merge-queue.md | HIGH | Extend tests/test-loki-merge-queue.sh (has gh stub at :17): red test = --ship path with stubbed `pr checks` exit 1 currently still logs `pr merge`; green = no m | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-pr-loop-2 | CI repair loop: loki pr watch and run hook after PR open: Add `loki merge watch <pr>` (or `--watch` on merge run) that polls `gh pr checks`, on failure fetches failed log tail (`gh run view --log-failed`), runs one bounded repair session via existing loki issue/start run on the PR branch, pushes, and repeats up to N attempts (LOKI_PR_REPAIR_MAX, default 2) | autonomy/loki, loki-ts/src/cli/registry.ts, docs/merge-queue.md | MEDIUM | Extend tests/test-loki-merge-queue.sh with stub: checks fail once then pass after stubbed repair command; assert repair invoked once, push once, merge only afte | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-pr-loop-3 | Review-comment response commits: Reuse GhClient/defaultGh from loki-ts/src/util/pr_lessons.ts to add `loki memory`-adjacent read of OPEN review threads (`gh api pulls/N/comments`), one fix commit per actionable comment, push, and reply to each thread citing the commit sha. Register as `loki pr respond <pr>` extending an existing re | loki-ts/src/util/pr_lessons.ts, loki-ts/src/cli/registry.ts, loki-ts/tests/util/pr_lessons.test.ts | MEDIUM | Extend loki-ts/tests/util/pr_lessons.test.ts using its injected GhClient: fixture with 2 open comments -> assert 2 reply calls containing commit shas, and non-a | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-pr-loop-4 | Record merge/CI outcome in receipt and handoff; policy consent: Write merge outcome (merged / blocked:<gate> / waiting) and last checks state into .loki/state/pr.json next to the existing created record (autonomy/loki:11708) and surface in handoffSection/decisionCommands (run_summary.ts:158). Add a single policy key (e.g. merge.preauthorized + required checks) r | loki-ts/src/util/run_summary.ts, autonomy/loki, loki-ts/tests/util/run_summary.test.ts | LOW | Extend run_summary test (or nearest existing handoff test) : handoff for blocked merge shows gate name and 'waiting at: <gate>' and not 'merged'; red first sinc | released@2026-10-16T02:04Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-policy-budget-1 | Propagate run cap to group/unit children and aggregate group spend: In supervisor.ts export the resolved cap (env.LOKI_BUDGET_LIMIT=cap.usd when >0) into the env handed to maybeRunGroup (use `env`, not process.env, supervisor.ts:262) so backlog.py units inherit --max-cost; in backlog.py divide/enforce a group-wide total (sum unit costs at finish, stop launching pend | loki-ts/src/engine10/supervisor.ts, autonomy/lib/backlog.py, autonomy/lib/loki_yaml.py, docs/cost-controls.md | HIGH | Extend tests/test-backlog.sh (group total stops pending units) and loki-ts/tests/engine10/budget_cap.test.ts (env handed to group has LOKI_BUDGET_LIMIT). Red fi | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-policy-budget-2 | Live in-session cap: map worker cap to child env and fix dead BUDGET_LIMIT watcher: In session.ts childEnv set LOKI_BUDGET_LIMIT to remaining cap (LOKI_E10_MAX_COST_USD minus meter sum, floor 0.01) so providers.ts:668 applies SDK maxBudgetUsd for claude; change session.ts:195 watchBudget gate to read the same resolved cap (LOKI_E10_MAX_COST_USD) and compare against the worker meter | loki-ts/src/engine10/session.ts, loki-ts/src/e10ext/budget_cap.ts, loki-ts/src/providers/provider_guard.ts | HIGH | Extend loki-ts/tests/engine10/budget_cap.test.ts: unit-test remaining() and that childEnv for a run with LOKI_E10_MAX_COST_USD=2 carries LOKI_BUDGET_LIMIT<=2 (r | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-policy-budget-3 | Cap applies on default runner path, spec-first, and --attempts as one total: (a) runner/autonomous.ts:1176 default budgetLimit to loadDefaultMaxCostUsd() when an API key is set and no flag/env, mirroring resolveCap (reuse resolveCap, no new parser); (b) start.ts:317 push --max-cost for specFirst before returning; (c) runner/attempts.ts divide the cap across N attempts (pass  | loki-ts/src/runner/autonomous.ts, loki-ts/src/commands/start.ts, loki-ts/src/runner/attempts.ts, loki-ts/src/e10ext/budget_cap.ts | MEDIUM | Extend loki-ts/tests/commands/start tests (parseStartArgs/runEngine10 argv includes --max-cost for spec-first) and runner attempts test; red first: argv for `-- | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-policy-budget-4 | Durable budget_stopped state and persisted per-task spend across restart: On BUDGET_STOP write .loki/runs/<id>/budget.json (cap, spent, source, outcome budget_stopped) from supervisor.ts when outcome==BUDGET_STOP (extend run_summary.ts:54 and status.ts to show it), and seed capMeter on a rerun of the same task (startRecovery key) with prior spend from that file via an env | loki-ts/src/engine10/supervisor.ts, loki-ts/src/e10ext/budget_cap.ts, loki-ts/src/util/run_summary.ts, loki-ts/src/commands/status.ts, docs/cost-controls.md | MEDIUM | Extend loki-ts/tests/engine10/budget_cap.test.ts: capMeter seeded with 4 of 5 trips over() after $1; supervisor writes budget.json on BUDGET_STOP. Red: seed env | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| COST-1 | Effort rightsize default-on: implement and Wall at medium effort, fix escalation kept | loki-ts/src/contrib/effort_policy.ts, loki-ts/src/engine10/session.ts | MEDIUM | tests/engine10/effort_policy.test.ts | released@2026-10-16T01:20Z | Cost audit 2026-10-16: no measured run reaches 0.5x raw yet (best 0.68x lean config). |
-| COST-2 | Cascade default-on for low-risk tasks (sonnet first, escalate on failure) | loki-ts/src/engine10/sizing.ts, model_rank.ts | HIGH | cascade test beside fix.ts | parked@2026-10-16T00:12Z | Engine Law L1 and D50 Sonnet accuracy loss; needs CTO call plus a measured arm. Cost audit 2026-10-16: no measured run reaches 0.5x raw yet (best 0.68x lean config). |
-| COST-3 | Skip Wall when low risk and existing impacted tests cover the change (seal NOT PROVEN where skipped) | loki-ts/src/engine10/stages/wall.ts, sizing.ts | HIGH | wall tests | parked@2026-10-16T00:12Z | moat change; needs CTO call plus a measured arm. Cost audit 2026-10-16: no measured run reaches 0.5x raw yet (best 0.68x lean config). |
-| COST-4 | Gate xreview and any reviewer on risk tier (medium/high only) | loki-ts/src/engine10/stages/xreview.ts | LOW | xreview test | released@2026-10-16T01:20Z | Cost audit 2026-10-16: no measured run reaches 0.5x raw yet (best 0.68x lean config). |
-| COST-5 | Merge plan into implement via the plan chain resume (one fewer cold prefix) | loki-ts/src/engine10/stages/implement.ts | MEDIUM | conflict_resume tests | released@2026-10-16T01:20Z | Cost audit 2026-10-16: no measured run reaches 0.5x raw yet (best 0.68x lean config). |
-| COST-6 | Measure cost per accepted task vs raw Claude Code: attribution.py --execute, 8 tasks, n=3, Sonnet 5.5, receipt cost.usd vs total_cost_usd; target ratio 0.5 | benchmarks/bench/attribution.py, docs/v10/METRICS.md | MEDIUM | attribution dry-run | parked@2026-10-16T00:12Z | paid eval, needs founder go on spend. Cost audit 2026-10-16: no measured run reaches 0.5x raw yet (best 0.68x lean config). |
-| FC-09u | FC-09 siblings: pnpm-workspace.yaml overrides/packageExtensions and .yarnrc.yml packageExtensions join RUNNER_CONFIGS | loki-ts/src/features/runner_config.ts, loki-ts/tests/engine10/runner_config.test.ts | HIGH | each probe caps | parked@2026-10-16T23:12Z | After FC-09t review. Built as 12a4c80a: runner_config.test.ts 135 pass 0 fail; typecheck clean. D98 park after round 2: opus BLOCK e07885d5, real pnpm 11.1.3 applied a link: override through a double BOM and a `? [foo]` explicit key while the check reported UNCAPPED (Bun.YAML vs js-yaml 4 divergence). Carried as FC-09v. |
-| FC-09v | FC-09u carry-forward: trust parsed YAML key comparison only when both sides are in a strict plain subset (no BOM, explicit ? keys, merge keys, anchors, aliases, tags, directives, doc markers, CR, tabs); any other byte change caps | loki-ts/src/features/runner_config.ts, loki-ts/tests/engine10/runner_config.test.ts | HIGH | both FC-09u reviewer probes print CAPPED for every bypass; plain unrelated-key edit does not cap | released@2026-10-17T03:50Z | HIGH r2 APPROVE ea0a60c5: r1 bypass closed, 60 fuzz disagreement docs all cap, red-first 159/5 to 164/0, tsc rc=0; merged 14a6f92f0, dist bd008596d. Base e07885d5. Source: FC-09u round 2 HIGH review. Round 1 BLOCK cebe5641 (block-scalar parser differential reproduced with pnpm 11.1.3); round 2 per D101 caps on any byte change, building. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| FC-09w | Runner config registry matches case-insensitively, so a capitalized PNPM-Workspace.yaml or .YARNRC.yml (read by pnpm on macOS) caps trust; sweep every RUNNER_CONFIGS row; add .npmrc and patchedDependencies targets outside patches/ | loki-ts/src/features/runner_config.ts, the existing runner_config test file under loki-ts/tests/engine10 | HIGH | cd loki-ts && bun test tests/engine10/ | released@2026-10-17T03:50Z | HIGH APPROVE 14aa30cc2 (runner_config 204 pass 0 fail, tsc 0, mutations 34 and 4 red, 11 bypass probes capped) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| FC-09x | Runner config trust gaps from the FC-09w review: top-level patchedDependencies (Bun form) compared by mapping like pnpm.patchedDependencies (add to PKG_KEYS); pnpm-workspace.yaml read with CRLF-safe line split; a multi-line yaml flow map for patchedDependencies is parsed or fails closed | loki-ts/src/features/runner_config.ts, loki-ts/tests/engine10/runner_config.test.ts | HIGH | cd loki-ts && bun test tests/engine10/runner_config.test.ts | released@2026-10-17T01:58Z | v11.17.11 (npm next 11.17.11, Tests and Release green on df98addc8). TL APPROVE 437afd115; merged b97c1e635, dist 2eeec3851. |
-| CPE24-P2a | Checkpoint rollback restores only an allowlist (session.json, dashboard-state.json, CONTINUITY.md, autonomy-state.json, state, queue) and refuses nested symlinks | packages/control-plane/src/server/routes/checkpoints.ts plus test | MEDIUM | planted audit/ in a checkpoint does not overwrite .loki/audit | released@2026-10-15T23:55Z | rv-trust3 advisory on P2. |
-| CPE24-P4a | Legacy /api/control/* callers require ctx.local (or isLoopbackHost) like /v1 | packages/control-plane/src/server/legacy/routes-control.ts plus test | MEDIUM | non-loopback Host refused on legacy control | released@2026-10-15T23:55Z | rv-trust3 advisory on P4. |
-| CP-NITS1 | CP run page nits from the 10.10.2 smoke: Wall row describes the Wall ("Wrote acceptance checks (n files)" or "skipped: no checks written"); local repo with no remote shows the folder name, not REPO UNMEASURED; receipt text read from receipt.json on disk like the derived diff; diffstat failures cached (F1); leading-dash sha fixture | packages/control-plane/src/server plus ui run page plus tests | MEDIUM | CP suite green; a signed receipt on disk renders its text; a no-remote repo shows its folder name | released@2026-10-15T23:55Z | Peer smoke 21:27Z plus CP follow-up review F1. |
-| FC-01b | Monorepo visual-evidence skip reason: with backend/ and frontend/ package.json and no root manifest, say "no dev, preview or start script in backend/ or frontend/", not "no package.json" | visual evidence path in loki-ts/src plus test | LOW | monorepo fixture prints the per-package reason | released@2026-10-15T23:55Z | FC-01 sibling (Engine Law L5). |
-| FC-19b | Spec-conflict resume near the stage limit: skip the resume when under about 60s of the implement window remains, or keep the first conflict when the resume is aborted, so the run ends BLOCKED with its question instead of a limit failure | loki-ts/src/util/conflict_resume.ts plus machine.ts plus test | MEDIUM | a fake first session that uses the window then conflicts ends BLOCKED with its question | released@2026-10-15T23:55Z | review-fc19 non-blocking follow-up, from reading machine.ts runStage. |
-| CP-START | FC-20 (LATER list): root-cause the CP home Start "HTTP 404" (route mismatch, stale CP process serving a newer UI, or the loopback guard) and fix it at the shared layer (UI and server version match; a stale CP restarts or refuses a newer UI); never show a bare HTTP status, show a sentence with the next step; repo chip lists registered repos by name plus Browse; choosing a smaller model shows one muted line ("haiku: fastest, may be less accurate") and never blocks. The composer itself is redefined by CP-ASK (founder 22:03Z): greenfield-from-composer is dropped | packages/control-plane server and ui plus tests | MEDIUM | a forced 404 renders a sentence, a version-skewed UI gets the restart sentence | released@2026-10-15T23:55Z | Founder bug via steering 22:01Z, rescoped by founder 22:03Z. Do not displace FC-15 or FC-16. |
-| R15-F1 | `loki intent show <run>`: print a past run's intent card, the answer and the NOT STATED line; unknown run exits 1 | loki-ts/src/commands/run_status.ts (extend: intent subview), loki-ts/src/cli.ts (one case line), its existing run_status test file | MEDIUM | cd loki-ts && bun test on the run_status test file and tests/commands/cli_help_routes.test.ts; read-only; registered in help and completion | released@2026-10-17T03:50Z | Source: BACKLOG-D91 134-F1. Extend-never-duplicate: no new command file. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| R15-F2 | `loki quickstart --explain-match`: top 3 template scores plus confidence label; below strength 2 says no strong match | autonomy/quickstart.sh, tests/test-quickstart-explain-match.sh (new: no quickstart test owns match scoring; needs runner registration, shard row, timeout -k, shellcheck) | MEDIUM | bash tests/test-quickstart-explain-match.sh; flag-off output byte-identical; bash 3.2 | released@2026-10-17T03:50Z | Source: BACKLOG-D91 134-F4, issue 217 visibility. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| R15-E1 | `loki memory learn --recent N`: learn from the last N merged PRs with a per-PR summary (N max 20) | loki-ts/src/util/pr_lessons.ts (extend), loki-ts/src/commands/memory.ts (learn case only), loki-ts/tests/util/pr_lessons.test.ts | MEDIUM | cd loki-ts && bun test tests/util/pr_lessons.test.ts; learnFromPr unchanged | released@2026-10-17T03:50Z | Source: BACKLOG-D91 134-F3. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| R15-E2 | Reviewer brief names the repo tests that import each changed file (cap 3 plus +N more), from engine10/testmap.ts | loki-ts/src/util/reviewer_brief.ts (extend), loki-ts/tests/util/reviewer_brief.test.ts | MEDIUM | cd loki-ts && bun test tests/util/reviewer_brief.test.ts; LOKI_REVIEWER_BRIEF=0 byte-identical; static scan only | released@2026-10-17T03:50Z | Source: BACKLOG-D91 134-F2. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| R15-B1 | FC38-TIMEOUT: the two 'no bun on PATH' cases get an explicit it() timeout above their 60s spawn bound; record the failing text under 8 parallel copies first | loki-ts/tests/runner/attempts-dispatch.test.ts | LOW | 4 parallel copies, 5 of 5 green; product code untouched; stop if failure is not a timeout | rejected@2026-10-15T23:30Z | Stale premise: attempts-dispatch.test.ts already sets setDefaultTimeout(130_000); under 8 copies the only failure was the line-110 engine10 test at 130s (CPU starvation). FAILURE-CLASSES FC-38. Source: BACKLOG-D91 132-B3. |
-| R15-B2 | Issue 213: test-review-assurance-tail.sh polls child pid files with a sleep 0.01 spin that misses its window under sharded load; replace with a bounded count wait, reproduce first | tests/test-review-assurance-tail.sh | LOW | 8 of 8 parallel runs 44/0; mutation goes red; stop if not reproducible | rejected@2026-10-15T23:30Z | Failed to attribute: no pid-file failure under load; failures are wall-clock bound asserts (requirements timeout, hosted DA, semantic shard 8000ms); trial bounded wait still 43/3. FAILURE-CLASSES FC-53 (closest; add sibling line only if mechanism differs). Source: gh issue 213. |
-| CP-ASK | Founder 22:03Z: "we are not a vibe coding tool". The CP home box becomes Ask Loki: search, learn, compare runs, and ask anything about Loki Mode, past runs, receipts, repos and issues. Default provider claude (or any configured provider and model the user picks); the model gets all of that data (read-only tools or MCP over runs, receipts, events, METRICS, repos, gh issues and PRs); answers are async jobs the user can leave and come back to, listed in the CP. Read-only: Ask never edits a repo or starts a build | Architect slices first (10-40 slices, feature flag); packages/control-plane routes and ui, a read-only data layer, provider invocation | HIGH | the founder asks "compare my last two runs on FireLater" and gets a cited answer async in the CP; Ask cannot write to any repo | building@2026-10-04T00:06Z | Plan docs/v10/CP-ASK-PLAN.md (15 slices behind LOKI_CP_ASK=1, waves {1,4,6,8} {2,5,7} {3,9} 10 11 {12,13} 14 15); founder questions decided as FOUNDER-QUEUE row 20. Slice 1 (MCP read-only mode) seated. Founder direct directive 22:03Z. Architect plan first. | 00:33Z: slices 1 (9f454444a, plus fix-forward F1/F2 7bcffc70f, opus APPROVE), 4 (2a0ad3fc1) and 8 (d1b38e508) merged; flag off; next wave 2/5/6/7. 
-| FC-21 | FC-21: (a) a limit in implement still runs verify on the existing work plus the fix rounds the budget allows, never seal directly; (b) the run cap scales with task size (sizing and Project Model), with a generous subscription default set in loki.yaml; (c) implement is told its remaining time; (d) the CLI summary, CP and PR body read receipt.verdict (one outcome) | loki-ts/src/engine10 run orchestration, the budget and sizing modules, the CLI summary, plus tests | MEDIUM | a fake implement limit is followed by verify; CLI outcome equals receipt.verdict for 4 verdicts; a large task gets a larger cap; core cap under 5000 | released@2026-10-03T23:33Z | Released in v10.10.5. FireLater#17 gate on 10.10.3 PARTIAL (steering 22:08Z). P0 tier with FC-16/FC-15. Built 21fec9deb; opus review-fc21 APPROVE on merge e80abc63a (suites 1719/0, budget 27/0, tsc rc=0 with real node_modules); merged 881f1275f. Advisories A1-A4 filed as FC-21b. Ships in one train with FC-15 and FC-16. |
-| FC-21b | FC-21 follow-ups, next train (steering 23:00Z): (1) an implement limit forces PARTIAL only while checks are red or unrun; if the fix rounds make the impacted checks green with n>0 the run earns VERIFIED (L3: what ran is the evidence, not how long implement took); (2) size the run cap from the Project Model and plan (packages and files touched) or a plan-session estimate, never from task-text character count (L0); (3) the CLI outcome must equal receipt.verdict, so a cap stop after a limit cannot print BUDGET_STOP over a PARTIAL or FAILED receipt (L7, was advisory A4); (A1) machine.ts:145 mustJump keys on reason limit only, require r.killed too; (A2) a spec-conflict resume gets the full original budget in the time note and limitS, and the note lands after FINISH_LINE; (A3) yamlRunCapS matches run_cap_s at any depth under budgets, CRLF yaml falls back silently, ls-files count off by one | loki-ts/src/engine10/machine.ts, stages/implement.ts, stages/seal.ts, output.ts, src/util/run_cap.ts, project_model sizing, plus tests | HIGH | a limit then fix-green with n>0 seals VERIFIED, a limit with a red or unrun check seals PARTIAL; the cap for a short task touching many packages exceeds the cap for one file; CLI outcome equals receipt.verdict on a cap stop after a limit; a thrown limit without a kill never reaches VERIFIED; nested per_stage run_cap_s is ignored; a resumed implement gets the remaining time | released@2026-10-04T02:52Z | Plan docs/v10/FC21B-FC22-PLAN.md (slices S1 graph+yaml_key, S5 cap sizing, S4 verdict+L7+A1+A2; S4 last). From review-fc21 22:53Z plus steering 23:00Z. HIGH because it changes the verdict rule (opus reviewer). Architect plan first for the sizing source. e10ext is 1 line under its 1500 cap. Queue after the FireLater#17 gate on 10.10.4. |
-| FC-16b | FC-16 follow-ups: package_suite.ts:33 detects go by first token only (make test, GOFLAGS=x go test fall to the generic path); go -json parsing; load_owner killTree process-group kill; unittest atexit forged trailer | loki-ts/src/engine10 package_suite, load_owner, test classify, plus tests | MEDIUM | make test wrapping go test classifies with runner go; a forged unittest trailer from atexit is not a pass | released@2026-10-16T00:49Z | Engineer fix-fc16b in worktree. From review-fc16-fc02-integ rounds 4-6. package_suite results never feed seal proof today. Also owed: an end-to-end test running a go Wall file through RealBaseTestRunner (the seal.test.ts case does not guard wall.ts). | 00:33Z: review-fc16b BLOCKED 1b3f594cb (forged go events, unittest multi-Ran); fix 626b46c74 in opus re-review. 
-| FC-22 | FC-22: (a) impacted-test selection is scoped by the Project Model, touched packages plus their real dependents (manifest or import edges), never every package; (b) a selected package with no installed deps gets the Project Model's own install command run once before verify, recorded as a check with its cwd, opt-out by config | loki-ts/src/e10ext/select.ts, project_model resolve and gather, engine10 verify pre-step, plus tests | HIGH | a backend-only change in the monorepo-fc01 fixture selects no frontend test; a selected package without node_modules gets one recorded install check; no guessed command; e10ext under 1500 | released@2026-10-16T00:49Z | Plan docs/v10/FC21B-FC22-PLAN.md (S1 then S2 selection and S3 install). FireLater#17 gate on 10.10.5 (run e10-20261003T233414Z-30ca) PARTIAL only from 4 over-selected frontend tests (steering 23:47Z). HIGH because selection feeds verify proof. Architect plan first; e10ext is 1 line under its cap. Next train with FC-21b and FC-23. | 00:33Z: S1 merged 88e9e43fb (review-s1 APPROVE). S2 e9e04fe1d in opus review-s2; S3 cb6486550 in opus review-s3. 01:08Z: S3 merged 736f4d436 (review-s3 APPROVE on d2e61c2ff, 3627/0, tsc 0; discard.ts L2 tension to CTO). S2 merged b4022e6fb (review-s2 APPROVE on a62aba7b2, 3624/0, tsc 0) behind LOKI_E10_SCOPE default off. Before the flag flips: F1 root-owned keep test with a non-relative import, F2 verify test.scoped_out event test. The install library is wired by S4. 
-| FC-23 | FC-23: the Wall writes tests matching the package's module system and test conventions from the Project Model; a lint or type error inside a Wall file is harness-owned, the Wall file is regenerated once or discarded with a NOT PROVEN note, and no fix round is spent on it | loki-ts/src/engine10/stages/wall.ts, the fix-round target filter, project_model conventions, plus tests | MEDIUM | a CommonJS package gets a Wall test with no import.meta; a forced type error in a Wall file yields regenerate-or-discard and zero fix rounds | released@2026-10-04T00:51Z | released@2026-10-04T00:51Z | Merged c0a1c43c2 (38c782386, review-fc23 sonnet APPROVE; nits: duplicate NOT PROVEN line for a discarded file, merged comment in verify.ts). 
-| TEN-DEPLOY-01 | Capture the deployed public URL on every --execute path and probe it by default | autonomy/loki (_deploy_try_execute non-canary exec block and the _deploy_record arg list and JSON fields only), tests/test-deploy-receipt-gate.sh (new section after the existing 14-18 block), CHANGELOG.md | MEDIUM | see Wall in note | released@2026-10-17T02:57Z | merge 60a9bb709; TL APPROVE b14d908a4 (deploy-receipt-gate 56/0, test-deploy 6/6, shellcheck 91=91 vs main). wave 1; depends: none. Goal: After a deploy that exits 0, take the last https URL the provider CLI printed (the canary grep -Eo already does this; reuse that, do not add a second parser). Store it as deployed_url in loki.deploy/1. When no --health-url is given, probe deployed_url with _deploy_probe_health and record health_url_source=captured/flag. No URL printed: deployed_url is empty, health stays 'unchecked', and Loki never invents a URL. Print 'Live at: <url>' only when one was captured. Wall: RED: a new section stubs vercel to print 'https://app-x.vercel.app' and exit 0, and stubs curl to 200. The record lacks deployed_url, health_status is 'unchecked', and the test fails on main. GREEN: deployed_url equals the stub URL, health_status=healthy, health_url_source=captured. A second stub prints no URL: deployed_url is empty, health is 'unchecked', exit 0. A third case passes --health-url: health_url_source=flag. MUTATION: hardcode deployed_url to a constant and the no-URL case goes red. Gate: bash -n autonomy/loki && shellcheck -S warning autonomy/loki && bash tests/test-deploy-receipt-gate.sh && bash tests/test-deploy.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. v11.17.13 npm next 11.17.13 |
-| TEN-DEPLOY-02 | Signed live provenance doc (loki.provenance/1) and loki verify --url | loki-ts/src/util/receipt_signer.ts, loki-ts/tests/engine10/verify_cmd.test.ts (provenance cases; existing deploy-record tests live here), docs/SIGNED-RECEIPTS.md (one section), CHANGELOG.md. Engine10 core is not edited: verify_cmd.ts:164 already routes through deployAttestCmd, and a one-token --url passthrough there needs the budget test to stay green. | HIGH | see Wall in note | released v11.17.26@2026-10-17T05:48Z | SPLIT per CTO critic into (a) signProvenance plus --sign-provenance, (b) verify --url fetch and verdicts; build as two commits or two agents. wave 2; depends: none. Goal: Extend receipt_signer.ts, the owner of signed deploy attestations, with: signProvenance(head_sha, tree_sha, receipt_sha256, run_id, built_at), which signs with the same Ed25519 key as signDeployRecord; a `--sign-provenance FILE` dispatch in deployAttestCmd; and `loki verify --url https://host` plus a pubkey. The --url check fetches <url>/.well-known/loki-provenance.json with a timeout and size cap, checks the signature, and requires a 200 with JSON. The verdict is VERIFIED only when the signature verifies against the local JWKS or --pubkey AND the cited receipt (when present locally or via --receipt) is VERIFIED. The doc alone with an unknown kid is UNCHECKED rc 2. An edited doc is TAMPERED rc 1. A fetch failure is UNCHECKED and never VERIFIED. Optional --expect-sha SHA must equal head_sha. Wall: RED: tests serve a signed provenance doc from Bun.serve on 127.0.0.1. On main, `verify --url` is an unknown arg and exits 2, so the tests fail. GREEN: genuine doc with --pubkey gives VERIFIED rc 0. One edited byte of head_sha gives TAMPERED rc 1. An unknown kid gives UNCHECKED rc 2. A 404, a non-JSON body or a doc over 64KB gives UNCHECKED rc 2. A wrong --expect-sha gives TAMPERED rc 1. MUTATION: skip the signature verify and the edited-byte case goes red. Gate: cd loki-ts && bun test tests/engine10/verify_cmd.test.ts && bun test tests/engine10/ && bunx tsc --noEmit (the full engine10 suite runs the budget and spawn-env guards) Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
-| TEN-DEPLOY-03 | Ship the provenance doc with the build and prove the live URL serves the verified SHA | autonomy/loki (_deploy_try_execute pre-exec and post-health blocks, _deploy_record live_binding field only), tests/test-deploy-receipt-gate.sh (new section), docs/WORKSPACES.md, CHANGELOG.md | HIGH | see Wall in note | released v11.17.45 | SPLIT per CTO critic into (a) provenance file into deploy root per project type, (b) post-deploy live-binding probe; build as two commits or two agents. wave 3; depends: TEN-DEPLOY-01, TEN-DEPLOY-02. Goal: In _deploy_try_execute, after the gate passes and before the provider runs, write a signed .well-known/loki-provenance.json into the deploy root via `verify --sign-provenance`. The deploy root is public/ for nextjs and vite, the detected dist/ or build/ for static, and is refused with a reason for docker/python where no static root exists. Write it as an untracked build artifact so the dirty-tree gate is evaluated before it. After the deploy, probe <deployed_url>/.well-known/loki-provenance.json. Set live_binding=VERIFIED only when its head_sha equals the anchor. A mismatch gives FAILED_HEALTH exit 4 (stale or wrong build served). Update docs/WORKSPACES.md and replace 'deployed-SHA binding is not implemented' with what is now bound and what is not. Wall: RED: a stubbed vercel copies dist/ into a served dir and a python http.server serves it. On main, no provenance file exists and the record has no live_binding. GREEN: the file exists in dist/.well-known, live_binding=VERIFIED, and its head_sha equals git rev-parse HEAD. A stub that serves an older provenance gives FAILED_HEALTH exit 4. A docker project prints the refusal reason and records live_binding=unsupported, never VERIFIED. The dirty-tree gate still refuses a dirty tree before the file is written. MUTATION: compare against a constant instead of the anchor and the stale-serve case goes red. Gate: bash -n autonomy/loki && shellcheck -S warning autonomy/loki && bash tests/test-deploy-receipt-gate.sh && (cd loki-ts && bun test tests/engine10/verify_cmd.test.ts) Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
-| TEN-DEPLOY-04 | Verified deploy badge from loki status --badge | loki-ts/src/commands/status.ts (renderLastDeploy plus --badge flag parse only), loki-ts/tests/commands/status.test.ts, CHANGELOG.md | MEDIUM | see Wall in note | released@2026-10-17T05:06Z | wave 4; depends: TEN-DEPLOY-01 (deployed_url field); live_binding from TEN-DEPLOY-03 is read if present, and its absence omits the badge. Goal: `loki status --badge` reads the newest loki.deploy/1 record (renderLastDeploy already loads it) and verifies it through the existing verify path. It prints a markdown shields badge linking to <deployed_url>/.well-known/loki-provenance.json. The message is 'deployed: verified' (brightgreen) ONLY when the record verifies and live_binding=VERIFIED. 'deployed: unverified' (red) is printed for TAMPERED or a failed health check. In all other cases the badge is omitted with a one-line reason. It never prints green from an unchecked field. The color mapping matches the share badge (autonomy/loki:38291), and no new vocabulary is added. Wall: RED: status.test.ts fixture with a signed healthy record, live_binding=VERIFIED and deployed_url. On main, --badge is unknown and no badge line is printed. GREEN: the badge line contains 'brightgreen' and deployed_url. A record with health FAILED_HEALTH gives a red badge. An unsigned record or a missing live_binding omits the badge and prints the reason. A record with no deployed_url omits the badge. MUTATION: drop the verify call and the unsigned case goes green, so the test goes red. Gate: cd loki-ts && bun test tests/commands/status.test.ts && bunx tsc --noEmit && bash tests/test-status-surface-agrees.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
-| TEN-DEPLOY-05 | loki deploy --env-file: push env to the provider with names-only records | autonomy/loki (cmd_deploy arg parse for --env-file, _deploy_try_execute env step, _deploy_record env_keys field only), tests/test-deploy-receipt-gate.sh (new section), autonomy/completions (loki deploy flag list only), CHANGELOG.md | HIGH | see Wall in note | released v11.17.35 | SPLIT per CTO critic into (a) env-file parser, .env.example check, masking, env_keys record, (b) four provider verbs; build as two commits or two agents. wave 4; depends: TEN-DEPLOY-03 (same function, serialized to avoid conflicts). Goal: `--env-file FILE` (with --execute only) parses KEY=VALUE with no shell eval. It refuses when a key in .env.example is missing from FILE, naming the keys. Env is applied through documented verbs only: Vercel `vercel --prod -e K=V` per key (args built as an array, never through the shell); Fly `fly secrets set --stage K=V ...` before `fly deploy`; Netlify `netlify env:import FILE`; Cloudflare `wrangler secret bulk FILE`. An unsupported provider refuses with nothing run. The record stores env_keys (names, sorted) and env_source; it NEVER stores values. Values never appear in stdout, the record or the printed 'Running:' line, where they are masked as K=***. Wall: RED: a recording vercel stub logs argv. On main, --env-file is ignored and no -e args appear. GREEN: argv has `-e API_URL=x -e TOKEN=s3cr3t`. Grepping stdout, stderr and the record for s3cr3t finds nothing; env_keys=[API_URL,TOKEN]. When .env.example lists DB_URL and the env file lacks it, the command refuses with rc 1, no stub calls and DB_URL named. A value with $(touch pwned) leaves no file named pwned. MUTATION: write values into the record and the secret-grep goes red. Gate: bash -n autonomy/loki && shellcheck -S warning autonomy/loki && bash tests/test-deploy-receipt-gate.sh && bash tests/test-completion-drift.sh (or whichever completion drift test the CHANGELOG cites) Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
-| TEN-DEPLOY-06 | loki deploy --domain: attach a custom domain and prove TLS | autonomy/loki (cmd_deploy --domain parse and a post-health domain block in _deploy_try_execute, _deploy_record domain/tls fields only), tests/test-deploy-receipt-gate.sh (new section), CHANGELOG.md | MEDIUM | see Wall in note | released v11.17.38 | wave 5; depends: TEN-DEPLOY-05 (same function, serialized). Goal: `--domain example.com` (with --execute) runs documented verbs after a healthy deploy: Vercel `vercel alias set <deployed_url> <domain>`; Fly `fly certs add <domain>`. Netlify and Cloudflare print the manual dashboard step and set domain_status=manual. Then a TLS proof runs: `openssl s_client -servername <domain> -connect <domain>:443` plus `openssl x509 -noout -enddate -checkend 604800`. It records domain, tls_status (valid/expiring/invalid/unchecked) and tls_not_after, and re-probes https://<domain>/.well-known/loki-provenance.json for the same head_sha. DNS not yet pointed gives tls_status=invalid and exit 6, with the DNS record the provider needs printed. It never claims valid without the openssl check. Wall: RED: vercel, openssl and curl are stubbed. On main, --domain is ignored. GREEN: the alias set argv is recorded, tls_status=valid and tls_not_after is set. An openssl stub that fails -checkend gives expiring. An openssl handshake failure gives invalid and exit 6. A netlify project gives domain_status=manual, no alias call, and tls still checked. No openssl on PATH gives unchecked, never valid. MUTATION: default tls_status to valid and the missing-openssl case goes red. Gate: bash -n autonomy/loki && shellcheck -S warning autonomy/loki && bash tests/test-deploy-receipt-gate.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
-| TEN-DEPLOY-07 | loki github publish: receipt-stamped GitHub export from the CLI | autonomy/loki (cmd_github publish arm and its help line only), tests/test-github-publish.sh (new: no existing test owns cmd_github repo creation; test-proven-pr-check.sh covers PR checks only) plus its run-all-tests.sh registration and shard row, CHANGELOG.md | MEDIUM | see Wall in note | released@2026-10-17T03:50Z | merged efa201ffd (TL APPROVE 81346df2a) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| TEN-DEPLOY-08 | Web app deploy and GitHub push go through the gated CLI; no fabricated URLs | web-app/server.py (deploy_session ~5236-5336 and github_push_session ~5339-5395 only), web-app/tests/test_server.py (new cases), CHANGELOG.md | HIGH | see Wall in note | released v11.17.35 | SPLIT per CTO critic into (a) deploy_session, (b) github_push_session plus web-app url:null handling; build as two commits or two agents. wave 4; depends: TEN-DEPLOY-01 (deployed_url), TEN-DEPLOY-07 (github publish). Goal: Replace the bodies of deploy_session and github_push_session in web-app/server.py. Deploy runs `loki deploy --execute --dir <session_dir>` as an argv list with a timeout, then reads the newest <session>/.loki/deploys/*.json. It returns {url: deployed_url or null, health_status, live_binding, record_path, refused_reasons} and exits non-2xx on refusal. The platform param is kept as a hint only when it matches the CLI's detected provider; otherwise it returns 409 with the reason. GitHub push calls `loki github publish` (private default). Delete the hardcoded https://vercel.app, https://netlify.app and https://github.io fallbacks and the `git add -A` / `--public` path in the same change. Wall: RED: test_server.py with monkeypatched subprocess. On main, a deploy whose output has no URL returns url='https://vercel.app' (assert url is None fails), and no receipt gate is invoked. GREEN: the subprocess argv is [loki, deploy, --execute, --dir, <dir>]. A gate refusal returns 4xx with the reasons. A no-URL deploy returns url null. A github push argv contains `github publish` and never `add -A`. `grep -n 'https://vercel.app\/https://netlify.app\/"https://github.io"' web-app/server.py` exits 1. MUTATION: restore a fallback URL and the null-URL test goes red. Gate: python3 -m pytest web-app/tests/test_server.py -q && bash tests/moat/p7-no-fabricated-data.sh && bash tests/test-web-app-no-orphan-components.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
-| TEN-DEPLOY-09 | One-click from loki start and loki chat: pass the new deploy flags through | autonomy/loki (cmd_start _ps_ deploy parse block ~2625-2690 only), loki-ts/src/commands/start.ts (help string ~148-151 only), autonomy/lib/chat.sh (help line 53, system prompt line 6, _chat_deploy echo only), tests/test-help-start-flags.sh, docs/DEPLOYMENT.md, CHANGELOG.md, completions/loki.bash, completions/_loki | LOW | see Wall in note | released v11.17.39 | SPLIT per CTO critic into (a) start passthrough, (b) chat and docs text; build as two commits or two agents. wave 5; depends: TEN-DEPLOY-05, TEN-DEPLOY-06, TEN-DEPLOY-07. Goal: `loki start --deploy` passes --destination, --canary, --env-file, --domain and --github through to cmd_deploy. --github runs `loki github publish` after a successful deploy. Flag validation uses the existing _ps_ pattern (a value must not start with '-'). Bun-route start.ts help text lists them, and the PATH-slice divert keeps routing --deploy to bash. chat.sh `/deploy` help and _LOKI_CHAT_SYSTEM_PROMPT mention --domain, --env-file and `loki verify --url`, and the confirm prompt prints the full argv. docs/DEPLOYMENT.md gets one end-to-end 'brief to verified URL' section. Wall: RED: test-help-start-flags.sh asserts `loki start --help` lists --domain and --env-file, and a stubbed cmd_deploy recorder receives `--domain x.com --env-file .env` from `loki start --deploy --domain x.com --env-file .env`. It fails on main. GREEN: both pass. `--domain --env-file` (flag-shaped value) exits 2. A non-zero start exit still never deploys. MUTATION: drop the --domain forward and the recorder assertion goes red. Gate: bash -n autonomy/loki autonomy/lib/chat.sh && bash tests/test-help-start-flags.sh && (cd loki-ts && bun test tests/commands/start.test.ts && bunx tsc --noEmit) && for t in tests/test-help-*.sh; do bash "$t" || exit 1; done Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update completions/loki.bash and completions/_loki and every tests/test-help-*.sh guard (row fixed by CoS 2026-10-17: there is no autonomy/completions dir and no tests/test-help-drift.sh). |
-| TEN-ADOPTION-01 | Tour shows a receipt you can actually verify offline | autonomy/loki (cmd_demo offline branch only, ~15927-15965); skills/fixtures/demo-receipt/ (add receipt.json, the event log the log_seal check reads, pubkey.jwk; update README.md); tests/cli/test-tour-verify.sh (new: no test owns tour today, and test-proof-command.sh covers the legacy proof store) | MEDIUM | see Wall in note | released v11.17.33 | wave 3; depends: none (the fixture must come from a real sealed run; see not_codeable). Goal: `loki tour` (and `loki demo --offline`) runs the real Bun verifier against a bundled engine10 receipt.json, its event log and a public JWK, and prints VERIFIED. It then flips one byte in a copy under a run-owned temp dir and prints TAMPERED. It stays offline, needs no key and spends nothing. When Bun is absent it prints the exact verify command instead of claiming a result. The display-only disclaimer at autonomy/loki:15953-15957 goes away (the replaced text is deleted). Wall: Red first: the new test asserts the tour stdout contains VERIFIED from the verifier, and TAMPERED for the byte-flipped copy, with rc 0. On main it fails because the stdout says 'for display only'. Mutations: (a) point the tour at a receipt with one changed field: the test must see TAMPERED, not VERIFIED; (b) remove pubkey.jwk: the tour must say UNCHECKED or the verify-command fallback, never VERIFIED; (c) hide bun from PATH: output has the command and no verdict. Gate: bash tests/cli/test-tour-verify.sh && bash tests/test-help-discoverability.sh && bash scripts/local-ci.sh. Register the new test in tests/run-all-tests.sh and its shard. Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
-| TEN-ADOPTION-02 | Portable receipt bundle builder | loki-ts/src/util/receipt_bundle.ts (new: no existing module packages a receipt for third-party verify, and engine10/verify_cmd.ts is core at its line budget); loki-ts/tests/util/receipt_bundle.test.ts (new, beside the existing util tests) | HIGH | see Wall in note | released@2026-10-17T03:50Z | TL APPROVE bb4957e90, merged for v11.17.14 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| TEN-ADOPTION-03 | proof bundle/badge/share work for loki start (engine10) runs | loki-ts/src/commands/proof.ts; loki-ts/tests/commands/proof_badge.test.ts; loki-ts/tests/commands/proof.test.ts | HIGH | see Wall in note | released@2026-10-17T04:08Z | v11.17.17; TL APPROVE 260474376, merged as clean cherry-pick 029bdd1a6 |
-| TEN-ADOPTION-04 | PR body lets a reviewer verify on their own machine, plus an opt-out Loki footer | loki-ts/src/e10ext/reviewer_body.ts; loki-ts/tests/engine10/reviewer_body.test.ts; loki-ts/tests/engine10/pr_body_golden.test.ts (golden update only) | MEDIUM | see Wall in note | released@2026-10-17T04:08Z | v11.17.17; TL APPROVE batch J workflow w9sw9xytw |
-| TEN-ADOPTION-05 | loki mcp install for Claude Code, Cursor, VS Code, Windsurf | autonomy/mcp-launch.sh; tests/cli/test-mcp-launch.sh; loki-ts/src/cli/registry.ts (the mcp row only: add the install subcommand so help-drift and completions stay true) | MEDIUM | see Wall in note | released@2026-10-17T03:50Z | merged b7c99da72 (TL APPROVE 02fcdfa21) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| TEN-ADOPTION-06 | One-click IDE install links and honest npm metadata | README.md; docs/INSTALLATION.md; package.json (keywords only); tests/test-server-json-current.sh (extend: decode the deeplink payloads) | LOW | see Wall in note | released v11.17.33 | wave 2; depends: TEN-ADOPTION-05. Goal: The README MCP line (README.md:161) and a new IDE section in docs/INSTALLATION.md gain a Cursor deeplink (cursor://anysphere.cursor-deeplink/mcp/install?name=loki-mode&config=<base64 of {command:npx,args:[-y,loki-mode,mcp]}>), a VS Code link (vscode:mcp/install?<urlencoded json>) and the `loki mcp install --client X` commands. package.json keywords drop deprecated or false terms (gemini, gemini-cli) and keep the true ones. Wall: Red: the extended guard extracts the Cursor base64 config and the VS Code JSON from README.md and asserts they decode to a server that runs server.json's identifier with arg 'mcp'. It fails today because no deeplink exists. It also asserts that package.json keywords contain no deprecated provider name. Mutation: change the arg in the README payload to 'serve'; the guard must go red. Gate: bash tests/test-server-json-current.sh && bash tests/test-help-discoverability.sh && the help-drift and doc guards in scripts/local-ci.sh (no emojis, no em or en dashes). Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
-| TEN-ADOPTION-07 | Examples gallery of verifiable receipts | examples/README.md; examples/receipts/ (new dir: gallery data, no existing owner); tests/test-examples-gallery.sh (new: no existing test covers examples/; register in tests/run-all-tests.sh and its shard); package.json files entry only if examples/receipts must ship | MEDIUM | see Wall in note | released v11.17.36 | wave 4; depends: TEN-ADOPTION-02, TEN-ADOPTION-01. Goal: examples/README.md leads with a gallery of real loki start runs. Each entry is a bundle in examples/receipts/<name>/ (format from slice 02) with task, outcome, cost and the one-line verify command. A guard verifies every gallery bundle with its own pubkey and fails on any entry that is not VERIFIED or ALREADY_SATISFIED. The six v5 HTML demos stay, under a clearly labeled 'UI demos (no receipt)' heading, so nothing implies they were verified. The tour fixture from slice 01 is the first entry. Wall: Red: the guard fails today because examples/receipts/ is missing. Green once at least one bundle verifies. Mutations: (a) a byte edit in one gallery receipt turns the guard red with TAMPERED; (b) a README entry whose directory does not exist turns it red; (c) a FAILED receipt listed in the gallery turns it red. Gate: bash tests/test-examples-gallery.sh && bash scripts/structural-checks.sh && bash scripts/local-ci.sh. Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
-| TEN-ADOPTION-08 | Install smoke covers the newcomer first-touch path | scripts/smoke-install.sh | MEDIUM | see Wall in note | released v11.17.36 | wave 5; depends: TEN-ADOPTION-01, TEN-ADOPTION-05. Goal: scripts/smoke-install.sh also runs, from the packed tarball with a throwaway HOME: `loki tour` (expects the verifier's VERIFIED line from slice 01), `loki mcp install --client cursor --print` (expects valid JSON) and a stdio MCP initialize handshake returning a tools list. The packaged artifact is then proven on the exact paths the README sends a new user down. Keep it runnable by hand, and add an optional CI hook only if it stays under the 10-min command budget. Wall: Red: before slice 01 merges, the new tour assertion fails on the display-only text. Green after. Mutation: drop skills/fixtures/demo-receipt/pubkey.jwk from the packed files list in a scratch copy; the smoke must fail on the tour case, which proves it tests the shipped package and not the checkout. Gate: bash scripts/smoke-install.sh --log ~/loki-ci-logs/smoke-install-adoption.log (exit 0) && shellcheck scripts/smoke-install.sh. Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
-| TEN-COST-01 | Opt-in cost profile: loki start --cost lean / LOKI_COST_PROFILE=lean | loki-ts/src/util/cost_profile.ts (new: no existing module owns engine10 env presets; util/tier.ts is the license seam, not a cost preset), loki-ts/src/commands/start.ts (one --cost value-flag row plus one apply call), loki-ts/tests/util/cost_profile.test.ts (new, pairs with the new util), loki-ts/tests/commands/start.test.ts (one case), tests/test-help-start-flags.sh (expected flag list) | MEDIUM | see Wall in note | released v11.17.25@2026-10-17T05:39Z | wave 2; depends: none. Goal: One user-facing switch that turns on the already-built, flag-gated cost levers together, with each lever named on the start line. The lean profile sets LOKI_ROUTER=1 (the router keeps its own D89 haiku-only-with-advisor rule and escalation ladder) and LOKI_E10_TRIM=1. It only fills unset variables, so explicit user env always wins: LOKI_ROUTER=0 stays 0. Profile off or unset leaves the env byte-identical. It also writes .loki/cost-profile.json listing the levers applied, so nothing is reduced silently (D89 item 3). Works for loki start and, through the env var, for loki chat unchanged. Wall: Red first: - cost_profile.test.ts asserts resolveCostProfile('lean', {}) returns {LOKI_ROUTER:'1', LOKI_E10_TRIM:'1'}. - resolveCostProfile('lean', {LOKI_ROUTER:'0'}) keeps '0'. - An unknown profile name throws a usage error. - 'off' and unset return an empty patch. - start.test.ts: --cost lean reaches the child env and prints one line naming both levers. Mutation: remove the user-wins precedence check and confirm the LOKI_ROUTER=0 case goes red; restore. Gate: cd loki-ts && bun test tests/util/cost_profile.test.ts tests/commands/start.test.ts && bunx tsc --noEmit && bun test tests/engine10/budget.test.ts && bash ../tests/test-help-start-flags.sh && bash ../tests/test-help-changelog-drift.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
-| TEN-COST-02 | raw-lean baseline mode in the claude_code bench adapter | benchmarks/bench/adapters/claude_code.py, benchmarks/bench/tests/test_model_pin.py | LOW | see Wall in note | released@2026-10-17T02:57Z | merge 3a7942aac, dist bd6348d77; TL APPROVE 60dc6d321 (8 passed, mutation red); post-merge tsc 0 errors, 130 pass. wave 1; depends: none. Goal: An honest same-config raw Claude Code baseline that works under OAuth (no API key). run(..., lean=True) adds: --setting-sources project, --strict-mcp-config, --mcp-config '{"mcpServers":{}}', --disable-slash-commands and --tools Bash,Read,Edit,Write,Glob,Grep, the same tool set as ENGINE10_TOOLS in providers.ts:618. lean and bare together raise ValueError, never silently pick one. The row command string records lean. Wall: Red first: - test_model_pin.py asserts the exact lean argv with a stub runner. - lean=True with bare=True raises. - Default lean=False argv is byte-identical to today's. Mutation: drop --strict-mcp-config from the lean argv; the argv test goes red. Gate: python3 -I -m pytest benchmarks/bench/tests/test_model_pin.py -q Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. v11.17.13 npm next 11.17.13 |
-| TEN-COST-03 | Cost claim verdict: paired bootstrap CI and acceptance parity | benchmarks/bench/cost_claim.py (new: no bench module owns statistical claim gating; attribution.py is 1025 lines and owned by TEN-COST-04), benchmarks/bench/tests/test_cost_claim.py (new, pairs with the new module) | MEDIUM | see Wall in note | released@2026-10-17T02:57Z | merge 049a16327; TL APPROVE cab8238eb (8 passed, mutation 1 failed). wave 1; depends: none. Goal: A pure function decides whether a cost claim is PROVEN or NOT PROVEN. - Inputs: per-row results for a Loki arm and a floor arm. - Method: paired bootstrap over tasks (fixed seed) for the 95% CI of the cost-per-accepted ratio. - PROVEN_AT(target) only when all of these hold: - the CI upper bound is at most the target; - Loki's acceptance rate is at least the floor's minus 0 (no accepted-task loss); - no row is cost_partial; - engine and loki version are recorded and identical across rows; - n is at least 3 per task. - Otherwise NOT PROVEN, with every failing reason listed. - Unmeasured rows are excluded but counted in the reasons. Wall: Red first, fixtures: - Ratio about 0.4 with tight spread gives PROVEN at 0.5. - Ratio 0.45 with one cost_partial row gives NOT PROVEN, reason partial. - Loki accepts 22/24 vs floor 24/24 gives NOT PROVEN, reason acceptance. - Mixed loki versions give NOT PROVEN. - n=2 gives NOT PROVEN. - Same seed gives an identical CI. Mutation: replace the CI upper bound with the point estimate; the wide-spread fixture flips to PROVEN and goes red. Gate: python3 -I -m pytest benchmarks/bench/tests/test_cost_claim.py -q Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. v11.17.13 npm next 11.17.13 |
-| TEN-COST-04 | C-F1 arms raw-lean and loki-lean, lever ablation, verdict in the report | benchmarks/bench/attribution.py, benchmarks/bench/adapters/loki.py, benchmarks/bench/tests/test_attribution.py | MEDIUM | see Wall in note | released v11.17.28 | wave 3; depends: TEN-COST-01, TEN-COST-02, TEN-COST-03, COST-WALL-e merged (it edits attribution.py). Goal: attribution.py changes: - Adds arms raw-lean (claude_code lean=True) and loki-lean (loki with LOKI_COST_PROFILE=lean). - Adds repeatable --loki-env KEY=VALUE for one-lever ablations (allowlist: LOKI_* keys only). - Adds raw-lean to COST_FLOORS. - render_cost_table prints the TEN-COST-03 verdict per Loki arm against each floor. adapters/loki.py changes: - Accepts profile and extra_env. - Records cost_profile, lever_env and cache_read/cache_creation tokens by phase in the row, so rows from different lever configs never pool. Wall: Red first in test_attribution.py: - --dry-run --arms raw-configured,raw-lean,loki,loki-lean plans all 4 arms. - loki-lean rows carry cost_profile 'lean'. - --loki-env FOO=1 (not LOKI_) exits 2. - The rendered table has a raw-lean column and a verdict line. - A loki row with a different lever_env is not pooled into the loki arm. Mutation: drop lever_env from the pooling key; the mixed-config test goes red. Gate: python3 -I -m pytest benchmarks -q -k 'attribution or model_pin or cost_claim' && python3 -I benchmarks/bench/attribution.py --dry-run --arms raw-configured,raw-lean,loki,loki-lean Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
-| TEN-COST-05 | Per-stage cache-hit attribution in the cost breakdown | loki-ts/src/util/cost_breakdown.ts, loki-ts/tests/engine10/cost.test.ts (breakdown cases only) | MEDIUM | see Wall in note | released@2026-10-17T03:50Z | TL APPROVE 71a31207f. wave 1; depends: none. Goal: costBreakdown per_stage gains cache_read_tokens, cache_creation_tokens and cache_hit_ratio, computed as read / (read + creation), null when both are 0. This makes the cache-stable-prefix lever (CH-01/CP-01) provable per stage in every receipt and in the bench row. The usd fail-closed rules are unchanged, and the new fields are additive. Wall: Red first: - Two implement records (read 7000/creation 0 and read 0/creation 7000) give ratio 0.5. - A stage with no token keys gives null, never 0. - Existing usd and retry assertions stay green. Mutation: count cache_creation as a hit; the 0.5 case goes red. Gate: cd loki-ts && bun test tests/engine10/cost.test.ts tests/engine10/budget.test.ts && bunx tsc --noEmit Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| TEN-COST-06 | xreview claude judge: lean flags and child-ledger line | loki-ts/src/engine10/stages/xreview.ts, loki-ts/tests/engine10/xreview.test.ts | MEDIUM | see Wall in note | released@2026-10-17T03:50Z | TL APPROVE 2e40a4be8, merged for v11.17.14 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| TEN-COST-07 | Project-model discovery on the fast tier, retry on the run model | loki-ts/src/project_model/discover.ts, loki-ts/tests/project_model/project_model.test.ts | MEDIUM | see Wall in note | released@2026-10-17T03:50Z | TL APPROVE e01e37c5e. wave 1; depends: none. Goal: Discovery attempt 1 runs on fastTierModel(env) (runner/model_downgrades.ts:8). It is sonnet unless LOKI_ALLOW_HAIKU, so it never drops below sonnet without opt-in, and it is never weaker than an explicit LOKI_MODEL_OVERRIDE. The existing validation-error retry (attempt 2) runs on the run model, so a weak answer escalates, never ships. The model used is recorded on the project_model result. The schema validation and the owner=provider fallback are unchanged. Wall: Red first, with a stub SessionRunner: - Attempt 1 opts.model equals fastTierModel. - After an invalid answer, attempt 2 opts.model is undefined (run model). - With LOKI_MODEL_OVERRIDE set, both attempts use the override. Mutation: pin attempt 2 to the fast tier; the escalation test goes red. Gate: cd loki-ts && bun test tests/project_model && bunx tsc --noEmit Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| TEN-COST-08 | Documented reproducible cost proof run | docs/v10/METRICS.md, docs/EVALUATING.md | LOW | see Wall in note | released v11.17.32 | wave 4; depends: TEN-COST-04. Goal: docs/v10/METRICS.md gains a 'Cost proof (C-F1)' section that states: - the exact command (attribution.py --execute, arms raw-configured, raw-lean, raw-bare, loki, loki-lean, n=3, pinned model, --max-spend-usd); - the verdict rule from TEN-COST-03; - that results are reported against all three floors, never only the favorable one; - that a run is valid only when the recorded loki version equals VERSION. docs/EVALUATING.md links to it. This is an extension of existing docs, not a new doc. Wall: Red first: grep -n 'Cost proof (C-F1)' docs/v10/METRICS.md exits 1 before the edit. Green: - The documented dry-run command, copied verbatim, exits 0. - grep -n 'raw-lean' docs/EVALUATING.md prints a line. - No em or en dashes: grep -nP '[\x{2013}\x{2014}]' on both files exits 1. Gate: python3 -I benchmarks/bench/attribution.py --dry-run --arms raw-configured,raw-lean,raw-bare,loki,loki-lean && bash tests/test-help-changelog-drift.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
-| TEN-QUALITY-01 | Fix brief carries a bounded failure excerpt (assertion, traceback, expected/received) | loki-ts/src/util/check_result.ts (failureExcerpt), loki-ts/src/engine10/stages/verify.ts (runCheck keeps the fail output excerpt; line 315 sample; at most 3 core lines), loki-ts/tests/engine10/check_result.test.ts, loki-ts/tests/engine10/fix.test.ts, loki-ts/tests/engine10/wall_holdout.test.ts | HIGH | see Wall in note | released@2026-10-17T04:35Z | SPLIT per CTO critic into (a) pure failureExcerpt plus fixtures, (b) verify.ts wiring plus holdout test; build as two commits or two agents. wave 2; depends: none. Goal: Each failing non-holdout check's output reaches the fix session as a redacted excerpt of at most 1500 bytes, with at most 6 KB across all groups. The group format is `<rerun cmd>\n<excerpt>`. failureExcerpt() in util/check_result.ts finds the decisive block: pytest `E ` lines plus the last frame, jest/vitest Expected/Received, node AssertionError, go `--- FAIL` with the next lines, and tsc/ruff diagnostic lines. It strips ANSI, makes absolute paths repo-relative and runs util/redact.ts. The signature stays byte-identical, so stall detection at machine.ts:232 and escalation in fix.ts are unchanged. The excerpt lives in a stage-local map inside verify.ts. It is never added to VerifyCheck, never emitted in test.result, and never computed for holdout checks. Wall: Red first: fix.test.ts drives verify then fix on a fixture with a failing pytest `assert add(2,2) == 5`. Today the brief lacks `E assert 4 == 5`, so the test fails. check_result.test.ts covers one fixture each for pytest, jest, node:test, go and tsc. It also asserts the size cap and that an AKIA-style token is redacted. wall_holdout.test.ts asserts that a failing holdout's output text appears in neither failures_grouped, events.jsonl nor the fix brief. Mutations: failureExcerpt returning '' must turn fix.test red; removing the isHold filter at verify.ts:314 must turn wall_holdout red; adding the excerpt to the signature must turn the existing stall test in machine.test.ts red. Gate: cd /Users/lokesh/git/lokimode-anthropic/loki-ts && bun test tests/engine10/check_result.test.ts tests/engine10/fix.test.ts tests/engine10/wall_holdout.test.ts && bun test && npx tsc --noEmit && bun test tests/engine10/budget.test.ts; then bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
-| TEN-QUALITY-02 | Pure static-diagnostic baseline attribution (new vs pre-existing lint) | loki-ts/src/runner/repo_profile.ts, loki-ts/tests/runner/harness_intelligence.test.ts (extends its existing repo_profile describe blocks) | HIGH | see Wall in note | released@2026-10-17T03:50Z | merged 43deeafe9 (HIGH r2 APPROVE 05cafda44) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| TEN-QUALITY-03 | Wire static attribution into verify so pre-existing lint never drives fix rounds | loki-ts/src/engine10/stages/verify.ts (runLintChecks only; at most 4 core lines, helper calls live in repo_profile.ts), loki-ts/tests/engine10/verify_lint.test.ts | HIGH | see Wall in note | released@2026-10-17T04:08Z | v11.17.17; TL APPROVE batch J workflow w9sw9xytw |
-| TEN-QUALITY-04 | Repo map indexes methods and whole large files; cache key versioned | loki-ts/src/engine10/repomap.ts, loki-ts/src/engine10/cache.ts (one-token key rename; net core growth at most 5 lines), loki-ts/tests/engine10/repomap.test.ts, loki-ts/tests/engine10/cache.test.ts | MEDIUM | see Wall in note | released@2026-10-17T03:50Z | TL APPROVE cc1c1b67d. wave 1; depends: none. Goal: repomap.ts records indented Python def and async def under the most recent top-level class as `Class.method`. It raises the symbol-scan cap from 20 KB to 256 KB per file and caps symbols at 300 per file. cache.ts renames the cache file to repomap2-${tree}.json, so a map cached before methods existed is never read. The RepoMap shape is unchanged (symbols are still strings), so isRepoMap and every caller keep working. Wall: Red first: repomap.test.ts writes a 60 KB Python file with `class QuerySet:` and `def bulk_create(self, objs):` past byte 20,000, and asserts the map has `QuerySet.bulk_create`. A file with 1000 defs yields at most 300 symbols. cache.test.ts: a stale repomap-<tree>.json written in the old format is ignored, so a fresh build happens. Mutations: restore the 20 KB cap and the test goes red; restore the old cache filename and the stale test goes red. Gate: cd /Users/lokesh/git/lokimode-anthropic/loki-ts && bun test tests/engine10/repomap.test.ts tests/engine10/cache.test.ts tests/engine10/intake.test.ts tests/engine10/sizing.test.ts && bun test && npx tsc --noEmit && bun test tests/engine10/budget.test.ts; then bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| TEN-QUALITY-05 | Identifier-aware relevance ranking (traceback paths, exact identifier tokens, stopwords) | loki-ts/src/engine10/relevant_files.ts, loki-ts/src/util/relevance.ts (new; justified above), loki-ts/tests/engine10/plan.test.ts | MEDIUM | see Wall in note | released@2026-10-17T05:06Z | wave 2; depends: none (gains compound with TEN-QUALITY-04 Class.method symbols). Goal: selectRelevantFiles and selectRelevantFilesWithReason keep their signatures, but rank by these rules: (a) A repo path named in the task or in a traceback frame ranks first. This covers `File "a/b.py", line N`, `a/b.ts:12:3` and dotted modules `pkg.mod.Name` resolved to a mapped path. (b) Exact token matches only. Tokens come from splitting camelCase, snake_case, dots and slashes; substring matches no longer count. (c) Weights: basename stem 3, symbol 2, path segment 1. (d) A fixed stopword list. (e) Ties keep repo-map order. Reasons still name the matched tokens. New file util/relevance.ts: relevant_files.ts sits in engine10 core at 4964 of 5000 lines, so the scoring moves out and relevant_files.ts becomes a thin delegate with net negative core lines. Wall: Red first, in plan.test.ts: - The task 'add a retry flag' must not select address.py. - A task containing a pytest traceback `File "src/pkg/query.py", line 88` ranks src/pkg/query.py first, ahead of 7 keyword-noise files. - `bulk_create` selects the file whose symbol is QuerySet.bulk_create. - `parseConfig` matches the symbol parse_config. Existing callers stay green: decompose.test.ts, warm.test.ts, already_done_cleanup.test.ts and the e10ext brief tests. Mutation: restore `hay.includes(w)` and the address case goes red; drop the traceback rule and the traceback case goes red. Gate: cd /Users/lokesh/git/lokimode-anthropic/loki-ts && bun test tests/engine10/plan.test.ts tests/engine10/decompose.test.ts tests/features/warm.test.ts && bun test && npx tsc --noEmit && bun test tests/engine10/budget.test.ts; then bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
-| TEN-QUALITY-06 | Signature digest of top relevant files in the implement/fix brief | loki-ts/src/util/ts_signatures.ts, loki-ts/src/e10ext/context.ts (at most 5 lines, e10ext stays under 1500), loki-ts/tests/e10ext/full_job_brief.test.ts | MEDIUM | see Wall in note | released@2026-10-17T03:50Z | TL APPROVE d7a7eecb9. wave 1; depends: none. Goal: util/ts_signatures.ts gains signatureDigest(repoDir, files, maxBytes=4000): - TS/JS through the existing lexer. - Python def and class headers up to the colon, with methods indented under their class. - Deterministic order: the order of the files argument. - Unreadable files are skipped. briefContext (e10ext/context.ts) appends a 'Key signatures (read the files for bodies):' block for the first 5 relevant files after the Relevant files block. The block is off with LOKI_E10_SIGS=0. The unit-brief path (unitBrief) is unchanged. Placement is after FIXED_RULES and the task, so the cache-stable prefix keeps its bytes. Wall: Red first: the brief for a fixture repo with models.py `def bulk_create(self, objs, batch_size=None):` under class QuerySet contains that header under `class QuerySet`. A TS fixture shows `export function add(a: number, b: number): number`. Two calls give byte-identical output, and the 4000-byte cap holds with 40 large files. LOKI_E10_SIGS=0 gives a brief byte-identical to today's golden. The FIXED_RULES prefix is unchanged. Mutation: drop the cap and the cap test goes red; reverse the file order and the stability/order test goes red. Gate: cd /Users/lokesh/git/lokimode-anthropic/loki-ts && bun test tests/e10ext/full_job_brief.test.ts tests/e10ext/unit_mode.test.ts tests/features/wall_manifest*.test.ts && bun test && npx tsc --noEmit && bun test tests/engine10/budget.test.ts; then bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| TEN-QUALITY-07 | Fix rounds see the current diff (fix the dead diff_stat reader) | loki-ts/src/runner/session_resume.ts, loki-ts/src/engine10/stages/fix.ts (replace the dead read; at most 2 core lines), loki-ts/tests/engine10/fix.test.ts, loki-ts/tests/engine10/fix_resume.test.ts | MEDIUM | see Wall in note | released@2026-10-17T03:50Z | TL APPROVE 8f6092d77, merged for v11.17.14 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| TEN-QUALITY-08 | Lean-path reproduce-first instruction (flagged until measured) | loki-ts/src/engine10/stages/implement.ts (one line), loki-ts/tests/engine10/implement.test.ts | MEDIUM | see Wall in note | released v11.17.33 | wave 3; depends: none (flag flip gated on TEN-QUALITY-09 results). Goal: Only when LOKI_E10_REPRO=1 is set, buildImplementBrief's no-plan line (implement.ts:39, the lean path with no Wall) adds a fixed, task-independent sentence: 'If the task reports a bug, first add a new test function that reproduces it, run it and see it fail, then fix the code and run that test again.' This matches how Claude Code works on SWE-bench-style issues. It stays default-off: the prompt-ablation program showed that added prompt text can hurt. TEN-QUALITY-09's A/B decides the flip. If it is flipped on, the sentence moves into FIXED_RULES (the cache-stable prefix) under the harness invariant. Wall: Red first: with LOKI_E10_REPRO=1 the lean brief contains the sentence. With the flag unset, the brief is byte-identical to a golden captured before the change. A plan-present brief never contains it. Mutation: an inverted flag check turns both cases red. Gate: cd /Users/lokesh/git/lokimode-anthropic/loki-ts && bun test tests/engine10/implement.test.ts tests/engine10/lean_session.test.ts && bun test && npx tsc --noEmit && bun test tests/engine10/budget.test.ts; then bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
-| TEN-QUALITY-09 | Offline localization-recall eval on the pinned SWE-bench subset | benchmarks/swebench/loader.py, benchmarks/bench/tests/ (extend the existing loader test file there; grep for its current name before adding) | LOW | see Wall in note | released@2026-10-17T03:50Z | TL APPROVE db3196348. wave 1; depends: none. Goal: benchmarks/swebench/loader.py gains gold_files(patch), which parses the paths in the gold patch's diff headers, and a `localization` subcommand. For each pinned instance with a checkout at $LOKI_SWEBENCH_REPOS/<repo>@<base_commit>, it runs `bun -e` importing buildRepoMap and selectRelevantFiles from loki-ts/src. It writes recall@8 and recall@20 JSON with per-instance hits. An instance without a checkout is listed as skipped with its reason, never scored 0. Offline only, with no network. This gives TEN-QUALITY-04/05 a before/after number versus E-98d's 4/7, and gives TEN-QUALITY-08's paid A/B a pre-registered harness to run through the existing claude_code and loki adapters. Wall: Red first: gold_files on a recorded 2-file patch returns both paths and ignores /dev/null. The localization command on a temp git repo fixture plus a stub instance gives recall@8 = 1.0 when the gold file is named in the problem statement. A missing checkout appears as skipped with recall None, never 0. Mutation: count skipped as 0 and the skip test goes red. Gate: cd /Users/lokesh/git/lokimode-anthropic && python3 -I -m pytest benchmarks/bench/tests -q && bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| TEN-UX-01 | Empty-folder first run: loki start "<brief>" sets up a repo and checks Claude login before any spend | loki-ts/src/util/first_run_repo.ts (new; justification: no existing module owns setting up an empty folder as a repo, and core has about 36 lines left so the logic cannot live in preflight.ts); loki-ts/src/engine10/preflight.ts (call the helper and the login check, net +3 lines max); loki-ts/src/commands/doctor.ts (export claudeAuthStatusLoggedIn only, and let it take an argv/env so preflight reuses it; no second parser); loki-ts/tests/engine10/preflight.test.ts; docs/v10/FAILURE-CLASSES.md (row first) | MEDIUM | see Wall in note | released@2026-10-17T05:06Z | SPLIT per CTO critic into (a) empty folder becomes a repo, (b) Claude login check in preflight plus doctor export; build as two commits or two agents. wave 2; depends: none. Goal: In an empty folder with no git repo, `loki start "<brief>"` runs git init -q, sets the default branch to main and makes an empty initial commit, then continues. It prints one line: `initialized a new git repository in <dir> (LOKI_AUTO_GIT_INIT=0 to refuse)`. A folder that is not empty and has no repo is never initialised automatically: it stays fatal, and the message gives the exact commands (git init && git add . && git commit -m init). A missing git identity stays fatal with the exact git config command; the identity is never set automatically. When the provider is claude and no ANTHROPIC_API_KEY or CLAUDE_CODE_OAUTH_TOKEN is set, preflight runs `claude auth status` (5s timeout, using the run env's PATH and LOKI_CLAUDE_CLI). A clear loggedIn:false is fatal and names the fix `claude login (or set ANTHROPIC_API_KEY)`. An unknown or empty answer is a warning only, never fatal, so a stub CLI still works. Wall: Red first: preflight.test.ts gains cases that fail on main today: (a) empty temp folder, no repo: checkPreflight returns fatal null, the folder now has .git and HEAD resolves; (b) folder holding one file, no repo: fatal contains `git init && git add . && git commit -m init`, and no .git is created; (c) LOKI_AUTO_GIT_INIT=0 on an empty folder: still fatal, no .git; (d) a fake claude on PATH printing {"loggedIn":false} gives a fatal containing `claude login`; (e) fake printing {} or exiting 1 gives fatal null plus one warning; (f) ANTHROPIC_API_KEY set: the fake claude is never called (it writes a marker file; assert the file is absent). Mutations: (1) drop the emptiness check, so case (b) must go red; (2) treat the unknown login answer as fatal, so case (e) must go red; (3) delete the export in doctor.ts, so the build/typecheck must go red. Gate: cd loki-ts && bun test tests/engine10/preflight.test.ts tests/engine10/budget.test.ts tests/commands/doctor.test.ts && bun test && bunx tsc --noEmit; then bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
-| TEN-UX-02 | Failure-specific Next line: every failed start names the exact fix | loki-ts/src/util/run_summary.ts (nextOf only); loki-ts/src/engine10/supervisor.ts (line 393 argument only; rebase after Q18-07 if it lands first); loki-ts/tests/util/run_summary.test.ts | LOW | see Wall in note | released@2026-10-17T02:57Z | merge 63cdd70ec, dist bd6348d77; TL APPROVE f450cf65f (94 pass, 2 mutations red); post-merge tsc 0 errors, 130 pass. wave 1; depends: none (rebase onto Q18-07 if supervisor.ts:313 moved). Goal: nextOf takes the run's reason and outcome and returns one concrete command per failure class: provider authentication failed -> `claude login` (or that provider's fix line from setup-requirements.json via requirementFix); provider credit exhausted -> `loki start ... --provider <other>` or check billing; '<check> failed: ...' -> `loki chat --attach` (ask why) plus `loki undo` when files changed; spec conflict (BLOCKED) -> `loki answer --text "..."`; STALLED -> `loki chat --attach`; engine ended before sealing a receipt -> `loki doctor`. The existing verified, done-unverified and budget branches stay byte-identical. The supervisor call site passes res.reason on the same line, with zero net core lines. Wall: Red first: run_summary.test.ts adds one table row per reason string that output.ts:74 reasonOf really produces (copy the literals, do not paraphrase), each asserting the exact Next command. These fail today because nextOf returns loki doctor/loki undo. A pin asserts the old outputs for verified, done-unverified, stopped and failed-without-reason, so default output does not drift. A source-scan test asserts every literal reason produced at output.ts:74 has a nextOf mapping (catches new reasons with no mapping). Mutation: make nextOf ignore the reason argument, so every new row must go red; remove the supervisor argument, so a contract test in tests/features/contract.test.ts that runs the summary with fatal:auth must go red. Gate: cd loki-ts && bun test tests/util/run_summary.test.ts tests/features/contract.test.ts tests/engine10/budget.test.ts && bun test && bunx tsc --noEmit Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. v11.17.13 npm next 11.17.13 |
-| TEN-UX-03 | Funnel on the default engine10 route: first_run_blocked at preflight and build_verified at seal | loki-ts/src/util/funnel.ts (new; justification: telemetry.sh is the owner and this file is the only TS bridge to it, replacing the private copy in doctor.ts); loki-ts/src/commands/doctor.ts (emitFirstRunBlocked becomes a call to the helper; remove the spawn code); loki-ts/src/engine10/cli.ts (one call after main, at most +2 lines); autonomy/telemetry.sh (_loki_known_blocker keys and a loki_emit_build_verified_enum function); tests/test-first-run-funnel-coverage.sh | MEDIUM | see Wall in note | released@2026-10-17T05:34Z v11.17.24 | wave 3; depends: TEN-UX-01 (shares doctor.ts; also needs the not_a_repo fatal text to exist). Goal: Move the detached, opt-out-respecting telemetry.sh spawn from doctor.ts:1047-1069 into one TS helper (emitFunnel(kind, key)), and delete the copy in doctor.ts in the same change. Call it from engine10/cli.ts after the supervisor returns: preflight exit 2 sends first_run_blocked with a bounded key; a VERIFIED or ALREADY_SATISFIED exit sends build_verified carrying only headline=VERIFIED and route=engine10. No other field is sent. Add keys not_a_repo and git_identity to _loki_known_blocker (telemetry.sh:204), and add an allowlisted build_verified variant that takes enum args instead of a proof.json path. All existing opt-outs still apply because everything goes through _loki_analytics_enabled. Wall: Red first: test-first-run-funnel-coverage.sh gains (a) a wiring assertion that engine10/cli.ts reaches emitFunnel on a preflight exit 2 and on a VERIFIED exit, and (b) a run with a stub telemetry.sh in a throwaway HOME, analytics forced on, with no network: loki_telemetry is replaced by a recorder function. Assert that one first_run_blocked blocker=not_a_repo line is recorded for a start in a non-empty folder with no repo, and that a second identical run records nothing (once-per-install marker). Assert DO_NOT_TRACK=1 and LOKI_TELEMETRY_DISABLED=1 each record zero lines. Assert the recorded payload contains no path, home dir or brief text (grep the recorder file for the temp folder path and the brief: must be absent). Mutations: emit a raw blocker string instead of the enum, so the no-path assertion must go red; drop the marker write, so the second-run assertion must go red; leave doctor's old spawn copy in place, so a grep guard counting `telemetry.sh` spawns in loki-ts/src (exactly 1) must go red. Gate: bash tests/test-first-run-funnel-coverage.sh && bash tests/test-first-run-blocked-signal.sh && cd loki-ts && bun test tests/engine10/budget.test.ts tests/commands/doctor.test.ts && bun test; then bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
-| TEN-UX-04 | loki doctor --fix: consent-gated installs and Claude login, plus its first tests | loki-ts/src/commands/doctor_fix.ts; loki-ts/src/commands/doctor.ts (pass --yes through to runDoctorFix only; rebase after TEN-UX-01/03 if they touch the same hunk); loki-ts/tests/commands/doctor.test.ts (extend; no doctor_fix test exists today) | MEDIUM | see Wall in note | released v11.17.33 | wave 4; depends: TEN-UX-03 (doctor.ts edit order only). Goal: On a TTY, `loki doctor --fix` offers each missing default-provider install as a y/N question before running it: `npm install -g @anthropic-ai/claude-code`, then `claude login` when evaluateClaudeLogin returns fail. `--fix --yes` runs the same steps without asking, for scripted onboarding. Without a TTY and without --yes, it prints the commands only, exactly as today. System package managers and sudo are never run. Every step that runs reports `fixed:` or `failed: <first stderr line>`, and the command exits non-zero when a required step still fails. Command execution is behind an injectable runner, so tests never install anything. Wall: Red first: doctor.test.ts gains applyDoctorFixes/runDoctorFix cases with an injected has() and runner: (a) claude missing, tty=false, no --yes: the runner is never called and the npm command is printed; (b) claude missing, --yes: the runner gets exactly [npm, install, -g, @anthropic-ai/claude-code]; (c) runner fails: output has `failed:` and the exit code is non-zero; (d) jq missing with --yes: the runner is never called for jq (system package, print only); (e) claude present and logged out with --yes: the runner gets [claude, login]. These fail today because doctor_fix has no runner, no --yes and no exit code. Mutations: drop the tty/--yes gate, so (a) must go red; let system packages through the runner, so (d) must go red. Gate: cd loki-ts && bun test tests/commands/doctor.test.ts tests/commands/doctor_router.test.ts && bun test && bunx tsc --noEmit; bash tests/test-doctor-ux.sh; bash tests/test-doctor-single-impl.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
-| TEN-UX-05 | loki chat startup readiness check and slash-command suggestions | autonomy/lib/chat.sh; tests/test-doctor-ux.sh (already owns the chat assertions, P12-16) | LOW | see Wall in note | released@2026-10-17T05:25Z v11.17.23 | wave 3; depends: none (the folder message text refers to TEN-UX-01 behaviour; write it to whichever behaviour is on main). Goal: When cmd_chat starts (after the TTY check), print at most 3 readiness lines, once, using existing helpers only. (1) The provider CLI for _CHAT_PROVIDER is missing (any provider, not only claude): print `_loki_req_fix_line <provider>` and a hint to try `/provider claude`. (2) claude is logged out: print `claude login (or set ANTHROPIC_API_KEY)`. (3) The folder is not a git repo: say that `/run` will set up an empty folder (TEN-UX-01) or needs `git init` for a non-empty one. When everything is ready, print nothing extra, so a working setup sees no new text. An unknown slash command prints `unknown command: /stat (did you mean /status?)` by unique-prefix or single-edit match against the _chat_help list. The hint for a missing non-Claude provider replaces the bare 'cannot load provider X' at chat.sh:259/:271 with the fix line. Wall: Red first: test-doctor-ux.sh adds cases that drive cmd_chat through `script`/a pty helper already used there (or calls the new _chat_readiness function directly). With PATH holding no codex and LOKI_PROVIDER=codex, the output contains the codex fix string from setup-requirements.json. With a fake claude printing {"loggedIn":false}, the output contains `claude login`. In a non-git temp folder, the output mentions git. With every check passing (fake claude logged in, inside a repo), the readiness output is empty. `/stat` suggests `/status`; `/zzzz` prints no suggestion. Mutations: print readiness lines unconditionally, so the all-ready empty assertion must go red; hardcode the claude fix for every provider, so the codex fix assertion must go red. bash -n and shellcheck on chat.sh. Gate: bash tests/test-doctor-ux.sh && bash tests/test-loki-steer.sh && bash tests/test-first-run-bash32.sh && shellcheck autonomy/lib/chat.sh; then bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
-| TEN-UX-06 | Dashboard page: empty state, auto-select of the live run, stage progress strip, readable timeline, theme and narrow-screen layout | loki-ts/src/util/dashboard_page.ts; loki-ts/tests/engine10/dashboard_entry.test.ts (extend; it already serves the real page from a fixture events.jsonl) | LOW | see Wall in note | released@2026-10-17T03:50Z | merged 0a45be416 (TL APPROVE d933581dc; follow-up: test that a later click survives the next poll) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| TEN-UX-07 | Dashboard server panels: Reason, Next step and current stage elapsed | loki-ts/src/runner/engine10_dashboard.ts (formatPanels and summarizeRun only); loki-ts/tests/engine10/dashboard.test.ts | LOW | see Wall in note | released@2026-10-17T04:08Z | v11.17.17; TL APPROVE batch J workflow w9sw9xytw |
-| TEN-UX-08 | First-run gate: empty-folder loki start scenario and the install-to-first-success time budget | scripts/first-run-gate.sh; tests/test-first-run-gate.sh; docs/v10/METRICS.md (row 14 text only, written by --real runs, not by the engineer) | MEDIUM | see Wall in note | released v11.17.25@2026-10-17T05:39Z | wave 4; depends: TEN-UX-01 (empty-folder start must work), TEN-UX-02 (Next wording). Goal: Add `--entry start-empty` to scripts/first-run-gate.sh. It installs (with --installed) or uses the tree, creates an empty folder under the run-owned temp directory, sets git identity through GIT_* env vars only, and runs `loki doctor` then `loki start "<brief>"` with the existing stub claude. It asserts: the folder was set up as a repo, Outcome is VERIFIED, a receipt is sealed, Next is present, and install+doctor+start wall time on the stub is <= 120s, recorded as `install_to_first_success_s`. The stub run measures harness overhead only. With --real, it appends the measured time-to-first-sealed-result row to docs/v10/METRICS.md, replacing the 'not measured' row at METRICS.md:14 with a dated measurement and its command. In stub mode it never writes METRICS. Wall: Red first: test-first-run-gate.sh adds fake-loki modes for the new entry: (a) a fake that leaves the folder without a repo: FAIL repo-init; (b) a fake that sleeps past an injected budget FRG_BUDGET_S=1: FAIL first-success-budget; (c) a fake with no Next line: FAIL next-line; (d) a well-behaved fake: all PASS and the report has `install_to_first_success_s=<int>`. The new entry does not exist today, so these fail. Mutations: drop the budget comparison, so (b) must go red; parse the time field as a string compare, so a budget of 9 vs a measured 10 must go red. Tests use loki_run_tmp_create/cleanup only, never /tmp globs. Gate: bash tests/test-first-run-gate.sh && bash scripts/first-run-gate.sh --stub --entry start-empty; then bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
-| TEN-GATES-01 | FC row plus pure check-provenance classifier in check_result.ts | loki-ts/src/util/check_result.ts, loki-ts/tests/engine10/check_result.test.ts, docs/v10/FAILURE-CLASSES.md | HIGH | see Wall in note | released@2026-10-17T03:50Z | merged 0970d5887 (HIGH r2 APPROVE 10be1a1bd; FAILURE-CLASSES append conflict kept both sections) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| TEN-GATES-02 | Seal: receipt checks carry provenance; VERIFIED requires agent-independent proof | loki-ts/src/engine10/stages/seal.ts, loki-ts/src/engine10/types.ts, loki-ts/tests/engine10/seal.test.ts, docs/v10/DECISIONS.md | HIGH | see Wall in note | released v11.17.33 | wave 3; depends: TEN-GATES-01, Q18-05b (seal.ts in flight). Goal: In seal.ts replace hasExecutedProof at seal.ts:190 with hasExogenousProof (wallGreenOnBase still counts); when only agent_authored/llm_judge checks passed, verdict caps at PARTIAL and not_proven gains 'only agent-authored tests executed (no agent-independent proof)'. Each receipt check gains additive optional provenance (types.ts ReceiptCheck provenance?: ...; omitted key keeps older receipts byte-stable for verification). renderReceiptMd splits '### Agent-independent checks' and '### Agent-authored / advisory checks'. Opt-out LOKI_EXOGENOUS_PROOF=0 (record the default-on decision in DECISIONS.md under the D99 grant). Net-zero line change in engine10 core (fold into existing lines or move helpers to util). Wall: Red first in seal.test.ts: fake verify outputs with one passing check on a test file ADDED in the diff and no Wall -> expect PARTIAL plus the not_proven line (today VERIFIED); same check on a pre-existing file -> VERIFIED; receipt.json checks carry provenance; receipt.md has both sections. Mutation: revert to hasExecutedProof -> red. LOKI_EXOGENOUS_PROOF=0 restores old verdict. Gate: cd loki-ts && bun test tests/engine10/seal.test.ts tests/engine10/seal_verify_roundtrip.test.ts tests/engine10/budget.test.ts && bun test && bunx tsc --noEmit Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
-| TEN-GATES-03 | loki verify reports agent-independent evidence and adds --require-exogenous | loki-ts/src/engine10/verify_cmd.ts, loki-ts/tests/engine10/verify_cmd.test.ts | HIGH | see Wall in note | released@2026-10-17T04:08Z | v11.17.17; TL APPROVE batch J workflow w9sw9xytw |
-| TEN-GATES-04 | TS-callable app boot and HTTP health probe over app-runner.sh | loki-ts/src/util/app_probe.ts (new), loki-ts/tests/util/app_probe.test.ts (new) | MEDIUM | see Wall in note | released@2026-10-17T05:25Z v11.17.23 | SPLIT per CTO critic into (a) app boot and health, (b) functional-verify run and artifact write; build as two commits or two agents. wave 2; depends: none. Goal: New loki-ts/src/util/app_probe.ts (justification: no TS module owns app boot; app-runner.sh is bash-only and deep.ts:121-122 names this missing surface). appProbe(repoDir, lokiDir, {specText?, timeoutMs}) sources autonomy/app-runner.sh in a bash child (token-free env via plainTestEnv), runs app_runner_init, app_runner_start, app_runner_health_check, reads .loki/app-runner/health.json, then (when specText given) runs autonomy/lib/functional-verify.py against the URL and writes .loki/quality/functional-results.json in the shape proof-generator.py:841-870 reads. ALWAYS calls app_runner_stop in finally (stops only the PID app-runner recorded). Returns ReceiptCheck-shaped results: 'app boot' and 'http probe' with result pass/fail/not_run and reason; missing runtime or no app detected = not_run, never fail. Wall: Red first: fixture repo with a static index.html (app-runner static-site path, as tests/test-app-runner-static-site.sh) -> app boot pass + health.json ok; fixture whose start command exits 1 -> fail; empty repo -> not_run. Assert no process left on the recorded PID after return. Mutation: drop the stop call -> leftover-PID assertion red. Gate: cd loki-ts && bun test tests/util/app_probe.test.ts && bun test && bunx tsc --noEmit; register the new test file per the structural guards (select-tests.sh --guards-only rows, shard registration) Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
-| TEN-GATES-05 | Spec-derived API auth probe in functional-verify.py | autonomy/lib/functional-verify.py, tests/test_functional_verify.py | HIGH | see Wall in note | parked@2026-10-17T03:30Z | HIGH r1 BLOCK; re-sliced as TEN-GATES-05b |
-| TEN-GATES-06 | Deep verify: real app boot and secure-scan rules on engine10 | loki-ts/src/engine10/stages/deep.ts, loki-ts/tests/engine10/deep.test.ts | HIGH | see Wall in note | released v11.17.35 | wave 3; depends: TEN-GATES-04, Q18-04 (deep.ts in flight). Goal: Replace runAppBoot's hard-coded not_run (deep.ts:105-130) with a call to util/app_probe.ts, pushing its 'app boot' and 'http probe' checks; extend the existing 'security scan' check to also run autonomy/lib/secure-scan.py over changed files (HIGH active finding = fail, scanner absent = not_run). DEEP_NOT_PROVEN entries clear only for checks that actually ran. Net-zero lines in engine10 core (app boot body shrinks to the call). Wall: Red first in deep.test.ts: injected appProbe fake returning pass -> 'app boot' check result pass (today always not_run); a changed file with a committed PEM private key -> security scan fail with secure-scan rule id; secure-scan missing -> not_run. Mutation: ignore secure-scan exit -> red. Gate: cd loki-ts && bun test tests/engine10/deep.test.ts tests/engine10/deep_wiring.test.ts tests/engine10/budget.test.ts && bun test && bunx tsc --noEmit Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
-| TEN-GATES-07 | loki start route: collect app health and functional facts before the proof | loki-ts/src/runner/proof.ts, loki-ts/tests/runner/proof.test.ts | MEDIUM | see Wall in note | released v11.17.26@2026-10-17T05:48Z | wave 3; depends: TEN-GATES-04. Goal: In runner/proof.ts, before spawning proof-generator.py, call util/app_probe.ts with the run's PRD text (LOKI_PROOF_APP_PROBE=0 opts out) so .loki/app-runner/health.json and .loki/quality/functional-results.json exist on the primary route; the proof's healthcheck and functional facts stop being permanently not_run. Still never throws; probe failure leaves the facts absent (not_run), never fabricated. Wall: Red first in proof.test.ts: inject a fake probe that writes both artifacts -> generator facts.healthcheck/functional ran=true; probe throwing -> generator still invoked, facts not_run. Mutation: skip probe -> red. Gate: cd loki-ts && bun test tests/runner/proof.test.ts tests/runner/proof_run_id_pointer.test.ts && bun test && bunx tsc --noEmit Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
-| TEN-GATES-08 | loki start route: secure-scan as an exogenous security_scan gate | loki-ts/src/runner/quality_gates.ts, loki-ts/tests/runner/quality_gates.test.ts | MEDIUM | see Wall in note | released@2026-10-17T04:08Z | v11.17.17; TL APPROVE batch J workflow w9sw9xytw |
-| TEN-GATES-09 | loki start route: write build-results.json (wire the dead pythonBuildCheck) | loki-ts/src/util/python_build_check.ts, loki-ts/src/runner/autonomous.ts, loki-ts/tests/util/python_build_check.test.ts | MEDIUM | see Wall in note | released@2026-10-17T03:50Z | merged f24496198 (TL APPROVE 09a2ae73f) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| TEN-GATES-10 | Proof headline: VERIFIED needs one agent-independent fact beside the agent's suite | autonomy/lib/proof-generator.py, tests/test_proof_generator.py, docs/v10/DECISIONS.md | HIGH | see Wall in note | released v11.17.35 | wave 4; depends: COST-WALL-f (proof-generator.py in flight), TEN-GATES-07, TEN-GATES-08, TEN-GATES-09 (facts must exist before tightening, or every primary-route run downgrades). Goal: In proof-generator.py the tests_verified branch (:2045-2055) returns VERIFIED only when at least one exogenous fact also passed: build verified, healthcheck ok, functional passed, security clean that actually ran, or an exogenous quality gate passed; otherwise VERIFIED WITH GAPS with degraded item 'no agent-independent evidence (only the agent's own test suite passed)'. Gap record is additive; LOKI_PROOF_REQUIRE_EXOGENOUS=0 opt-out; decision recorded in DECISIONS.md under D99. Wall: Red first in test_proof_generator.py: facts with tests verified + nonempty diff and nothing else -> 'VERIFIED WITH GAPS' plus the degraded item (today VERIFIED); add build verified -> VERIFIED; only an advisory code_review pass -> still WITH GAPS. Mutation: count advisory gates as corroboration -> red. Gate: python3 -m pytest -q tests/test_proof_generator.py tests/test_proof_degraded_disabled_gates.py tests/test_proof_verify.py; bash tests/test-proven-pr-receipt.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
-| TEN-STABILITY-01 | bench-suite argv survives hyperfine 1.20 (unblocks v11.17.6 backstop) | loki-ts/scripts/bench-suite.ts; NEW loki-ts/tests/scripts/bench_suite_argv.test.ts (no existing test owns bench-suite.ts: grep -rl bench-suite loki-ts/tests tests returns nothing) | LOW | see Wall in note | released@2026-10-17T02:57Z | merge d67b2af14, dist bd6348d77; TL APPROVE f1bcf7679 (4 pass, typecheck rc=0); post-merge tsc 0 errors, 130 pass. wave 1; depends: none. Goal: Stop building 'VAR=1 cmd' hyperfine commands. Pass the env as 'env LOKI_LEGACY_BASH=1 <shim> <cmd>' (also 'env BUN_FROM_SOURCE=1'), which works on apt hyperfine 1.18 and brew 1.20 alike. Export a pure argv builder from the script so it can be tested. Write the --export-json files under a mkdtemp dir, not fixed /tmp/bench-*.json paths. Exit non-zero when any command is SKIPPED because hyperfine itself refused the argv, not only when every command was skipped. Wall: RED: the test puts a fake 'hyperfine' on PATH that exits 1 with the real 1.20 message when any positional command matches ^[A-Z_]+=. It runs the builder and fails today, because both benchPair (bench-suite.ts:76) and benchRoute (:108) emit LOKI_LEGACY_BASH=1 first. GREEN after the fix. MUTATION: revert one call site to the VAR= form; the test goes red. A second mutation: a partial SKIP must exit 1. GATE: cd loki-ts && bun test tests/scripts/bench_suite_argv.test.ts && bun run typecheck && bun test (full, per the slice-gate rule). Then run real hyperfine locally: cd loki-ts && bun run scripts/bench-suite.ts --runs 1 --warmup 0 (hyperfine 1.20.0 is installed on this machine) must print no 'Cannot run'. After merge: gh workflow run nightly.yml, and the macOS 1.3.13 leg must be green. Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. v11.17.13 npm next 11.17.13 |
-| TEN-STABILITY-02 | promote.yml walks back to the newest promotable next build (D96 exact-SHA rule) | .github/workflows/promote.yml (Derive and validate version, Require a green nightly, Require a green Post-Release Smoke steps); tests/test_release_next_tag.py (nightly-gate and version-derivation cases); tests/test-promote-smoke-sha.sh; docs/v10/DECISIONS.md (one D102 entry) | HIGH | see Wall in note | rejected@2026-10-17T03:30Z | superseded by TEN-RELEASE-INSTANT (D102): promote.yml deleted, every release moves latest and next |
-| TEN-STABILITY-03 | pre-push runs the R8 global guard rows on every push to main | .githooks/pre-push; tests/test-pre-push-hook.sh | MEDIUM | see Wall in note | parked@2026-10-17T04:27Z | parked under D102 (instant releases): a 300s guards-only run on every main push delays npm; guards stay on release.sh and CI as fix-forward signals. wave 2; depends: none (TEN-STABILITY-04 adds rows; the hook reads the tsv at run time). Goal: On a push whose remote ref is refs/heads/main, run 'bash scripts/impacted-gate.sh --guards-only' against the pushed tip in a clean detached worktree. Reuse release.sh's worktree pattern: per-row timeout, run-owned tmp via loki_run_tmp_create. Place it before the PRE_PUSH_SKIP exit, next to the release-notes and gitleaks gates, so routine PRE_PUSH_SKIP=1 merge pushes cannot skip it. A red row aborts the push and names the row. LOKI_PREPUSH_SKIP_GUARDS=1 is the only bypass and prints a loud warning. Branch pushes and deletes are untouched. Target time is under 120s with IMPACTED_JOBS=4. Over 180s fails closed with a timeout message, never passes silently. Wall: RED: test-pre-push-hook.sh gains a case where a stub impacted-gate (IMPACTED_TEST_MODE=1 with an IMPACTED_SUITES_FILE listing a failing suite) is red and stdin carries refs/heads/main with LOKI_RELEASE_MANAGER=1 PRE_PUSH_SKIP=1. Today the hook exits 0; after the fix it exits 1 and names the row. GREEN cases: all rows green gives exit 0; a branch push never invokes the gate; the bypass env warns and exits 0; a gate timeout gives exit 1. MUTATION: move the block after the PRE_PUSH_SKIP check and the PRE_PUSH_SKIP case goes red. GATE: bash tests/test-pre-push-hook.sh && bash tests/test-pre-push-gitleaks.sh && shellcheck .githooks/pre-push && bash tests/test-no-tmp-sweep.sh. Then time it: time bash scripts/impacted-gate.sh --guards-only on main must stay under 180s, or re-slice. Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
-| TEN-STABILITY-04 | global-guards.tsv covers every repo-wide guard that reached main red | scripts/global-guards.tsv; tests/test-select-tests.sh | LOW | see Wall in note | released@2026-10-17T02:57Z | merge 3e542a7fc; TL APPROVE 07aa41ad1 (select-tests 117/0, fast-gate 25/0, shard-coverage 19/0). wave 1; depends: none. Goal: Add as R8 rows the repo-wide guards that turned main red on 2026-10-16 even though no slice diff selected them: - tests/cli/test-completions-coverage.sh - loki-ts/tests/engine10/budget.test.ts - loki-ts/tests/engine10/l2_destructive_registry.test.ts - loki-ts/tests/engine10/pr_body_golden.test.ts - loki-ts/tests/commands/cli_help_routes.test.ts - tests/test-select-tests.sh (FC-89 walker markers) Also add a meta-assertion to test-select-tests.sh: every loki-ts test file that carries '// select: walk-all-src' is either an R8 row or selected by R-rules for any loki-ts/src diff. A new repo-wide guard then cannot silently stay out of R8. Wall: RED: a new test-select-tests.sh case asserts that --guards-only lists each of the 6 targets. It fails today because they are absent from the 17 rows. GREEN after adding the rows. MUTATION: delete one row and its case goes red. Add a fixture walker test without an R8 row and the meta-assertion goes red. GATE: bash tests/test-select-tests.sh && bash tests/test-fast-gate.sh && bash tests/test-shard-coverage.sh. Then time bash scripts/impacted-gate.sh --guards-only and record the added seconds in tests/shard-durations.tsv only if a row is new there. The fast-gate plan for a docs-only diff must stay under 60s per shard. Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. v11.17.13 npm next 11.17.13 |
-| TEN-STABILITY-05 | WC-01b wall_concurrent stops racing the 5s bun timeout | loki-ts/tests/engine10/wall_concurrent.test.ts | LOW | see Wall in note | released@2026-10-17T02:57Z | merge 516e4a4f1; TL APPROVE 5fa97f2d5 (13/0 x3, 13/0 under 12x load at --timeout 1500). wave 1; depends: none. Goal: Make the WC-01b suite hermetic and fast. Build the git fixture once in beforeAll: copy a template repo per test instead of running git init, add and commit per test (wall_concurrent.test.ts:15-20). Give the concurrency case an explicit timeout sized from measured CI duration, and keep every assertion unchanged. Cause measured in nightly 38938949858: 5004.82ms against the 5000ms default. Wall: RED: cd loki-ts && bun test --timeout 1500 tests/engine10/wall_concurrent.test.ts fails today on this machine under 'yes > /dev/null' x4 CPU load (record the measured ms). GREEN: the same command passes after the fixture change, and plain bun test passes 20/20 in a loop: for i in $(seq 20); do bun test tests/engine10/wall_concurrent.test.ts // break; done. MUTATION: swap the expected order of implement:start and author:end and the test still fails, so the assertion is intact. GATE: cd loki-ts && bun run typecheck && bun test (full). Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. v11.17.13 npm next 11.17.13 |
-| TEN-STABILITY-06 | pulse PROMOTION_LAG violation with the blocking reason | scripts/v10-pulse.sh; tests/test-v10-pulse.sh | MEDIUM | see Wall in note | released@2026-10-17T03:50Z | TL APPROVE ce461a4d1. wave 1; depends: none. Goal: In the npm section of v10-pulse.sh (near :830-863), emit 'VIOLATION PROMOTION_LAG' when next != latest and latest's publish time is more than 6h older than next's (threshold set by LOKI_PULSE_PROMOTION_LAG_H). Include the first PROMOTE-BLOCK or FATAL line from the newest non-skipped Promote run (gh run list -w Promote, then gh run view --log-failed). Also include the failing step names of the newest measured Nightly. The CoS acts on the top violation each turn, so a red bench is triaged within one turn instead of 13h. Fail soft: an API error prints UNKNOWN and never crashes the pulse. Wall: RED: test-v10-pulse.sh gains a fixture with stubbed npm and gh: latest 11.10.1 published 2026-10-15T00:00Z, next 11.17.6 published 2026-10-16T23:40Z, and Promote log containing 'PROMOTE-BLOCK: the newest nightly at the promoted SHA ... is failure'. Expect a PROMOTION_LAG line carrying that reason; today none is printed. GREEN cases: next==latest gives no violation; lag under the threshold gives none; gh failure gives UNKNOWN with rc 0. MUTATION: invert the threshold comparison and both lag cases go red. GATE: bash tests/test-v10-pulse.sh && shellcheck scripts/v10-pulse.sh && bash scripts/v10-pulse.sh on the real repo prints the violation today (latest 11.10.1 vs next 11.17.6). Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| TEN-STABILITY-07 | nightly classifies flips vs stable reds across same-SHA legs | .github/workflows/nightly.yml (new flake-classify job only); scripts/nightly-flake-tracker.sh (--gh-run mode); tests/test-nightly-flake-tracker.sh | MEDIUM | see Wall in note | released@2026-10-17T05:06Z | wave 2; depends: none (TEN-STABILITY-01 only matters for a green run). Goal: Add one nightly.yml job, flake-classify (needs all test jobs, if: always(), never sets the run conclusion). It downloads the bun-test job logs of this run via gh api. The 3-4 bun legs run identical loki-ts tests at one SHA. It feeds the logs to scripts/nightly-flake-tracker.sh and writes FLIP and STABLE-FAIL lines plus the BOARD: slice lines to the step summary. Extend the tracker with a '--gh-run RUN_ID' fetch mode so the workflow holds no parsing logic. Experimental bun=latest legs are labelled so a flip there is reported as drift. Wall: RED: test-nightly-flake-tracker.sh gains a --gh-run case with a stub gh serving two job logs at one SHA. In one log WC-01b is (pass), in the other it is (fail) [5004.82ms]. Expect 'FLIP <sha7> WC-01b'. Today --gh-run is a usage error (exit 2). GREEN: FLIP printed, exit 1; with both logs failing, STABLE-FAIL is printed. MUTATION: make the tracker ignore the [ms] suffix strip, and the FLIP case goes red. GATE: bash tests/test-nightly-flake-tracker.sh && bash tests/test-workflow-no-masked-failures.sh && python3 -m pytest -q tests/test_release_next_tag.py (nightly structure cases) && actionlint .github/workflows/nightly.yml if installed. The new job name must not start with 'Full suite (backstop)' (promote.yml:185 counts that prefix). Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
-| TEN-FC-ROWS | FAILURE-CLASSES rows for every TEN bug-fix slice lacking one (QUALITY-01/02/03/07, COST-06, DEPLOY-08, STABILITY-01/05, UX-02) | docs/v10/FAILURE-CLASSES.md | LOW | bash tests/test-structural-checks.sh | released@2026-10-17T02:57Z | merge 8cdb33633, dist bd6348d77; TL APPROVE 7e6f47482 (structural 25/0); post-merge tsc 0 errors, 130 pass. wave 1; CTO critic MISSING item. One row per class with user-visible vs raw, law broken, siblings, mechanism, fixture. Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. v11.17.13 npm next 11.17.13 |
-| TEN-CORE-TRIM | Free engine10 core headroom (4964 of 5000) by moving pure helpers out of engine10 into src/util with no behavior change | loki-ts/src/engine10/*, loki-ts/src/util/* | MEDIUM | cd loki-ts && bun test tests/engine10/ tests/runner/spawn_env_guard.test.ts && bunx tsc --noEmit | released@2026-10-17T02:57Z | merge 096174f2a, dist bd6348d77; TL APPROVE f0f82a4e8 (core 4931/5000, 143 pass); post-merge tsc 0 errors, 130 pass. wave 1; CTO critic MISSING item. Target at least 60 lines freed; budget guard must stay green; no logic change. Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. v11.17.13 npm next 11.17.13 |
-| TEN-SECURE-SCAN-UTIL | One util/secure_scan.ts wrapper over secure-scan.py shared by TEN-GATES-06 and TEN-GATES-08 | loki-ts/src/util/secure_scan.ts (new: no TS owner of secure-scan.py exists), loki-ts/tests/util/secure_scan.test.ts | MEDIUM | cd loki-ts && bun test tests/util/secure_scan.test.ts && bunx tsc --noEmit | released@2026-10-17T02:57Z | merge 47a9e4aae, dist none; TL APPROVE 3c1ce036d (9 pass, tsc rc=0). wave 1; CTO critic MISSING item. Removes the duplicate wrappers the CTO critic found. Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. v11.17.13 npm next 11.17.13 |
-| TEN-BADGE-UTIL | One verdict-to-shields-colour badge helper reused by status --badge, proof badge and share badge | autonomy/loki (existing share badge at about 38261-38315), tests/test-share-badge.sh or the existing badge test | LOW | bash tests/test-cli-commands.sh | released@2026-10-17T02:57Z | merge 8bdf1e7fd; TL APPROVE a7e86caa0 (test-cli-commands 37/0, test-share-command 8/0). wave 1; CTO critic MISSING item. Replaces three badge makers with one. Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. v11.17.13 npm next 11.17.13 |
-| TEN-STABILITY-08 | Pin hyperfine in nightly.yml and allow re-measuring a SHA whose nightly failed (dedupe at nightly.yml:78-82) | .github/workflows/nightly.yml | MEDIUM | actionlint .github/workflows/nightly.yml | released@2026-10-17T02:57Z | merge 488bc9771, dist bd6348d77; TL APPROVE 7a2843888 (actionlint rc=0, cache-scope 13/0, pins sha256-checked); post-merge tsc 0 errors, 130 pass. wave 1; CTO critic MISSING item. Without re-measure, one flake makes a SHA unpromotable forever. Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. v11.17.13 npm next 11.17.13 |
-| TEN-DEPLOY-01b | deploy --execute non-canary path streams provider output live (tee to a run-owned temp file) while still capturing the URL | autonomy/loki; tests/test-deploy-receipt-gate.sh | LOW | bash tests/test-deploy-receipt-gate.sh | released@2026-10-17T03:50Z | TL APPROVE 9f4409d5c, merged for v11.17.14 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| TEN-UX-02b | Run summary auth-failure next step uses the active provider's login or requirementFix line instead of hardcoded claude login | loki-ts/src/util/run_summary.ts; loki-ts/tests/util/run_summary.test.ts | LOW | cd loki-ts && bun test tests/util/run_summary.test.ts | released@2026-10-17T02:57Z | TL APPROVE 9a3d118d2, merge 672b74c79. Follow-up from TEN-UX-02 TL review: run_summary.ts:66 tells codex and cline users to run claude login. v11.17.13 npm next 11.17.13 |
-| TEN-GROUP-AUTH | Group runs keep USER, LOGNAME and SHELL and report per-unit cost | loki-ts/src/features/speed/run_group.ts, fix_units.ts, tests | MEDIUM | cd loki-ts && bun test tests/features | released@2026-10-17T03:50Z | TL APPROVE 40c81fe7a Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| TEN-COST-18 | cost_claim CLI for the C-F1 cost proof | benchmarks C-F1 harness | LOW | see note | released@2026-10-17T03:50Z | TL APPROVE 8281fdcb8 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| TEN-COST-20 | C-F1 seeds ship tests | benchmarks C-F1 seeds | LOW | see note | released@2026-10-17T03:50Z | TL APPROVE 0d1a37eed Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| TEN-COST-17 | Raw token classes in the Claude Code ledger | C-F1 harness ledger, test_model_pin.py | HIGH | pytest test_model_pin.py | released@2026-10-17T03:50Z | HIGH r2 APPROVE 232f1fbec Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| TEN-RELEASE-INSTANT | Every release publishes npm latest and next immediately (D102) | .github/workflows/release.yml, promote.yml removed | HIGH | see note | released@2026-10-17T03:50Z | HIGH r3 APPROVE 7e0e38c77; D98 round-limit exception recorded under D99 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| TEN-GATES-05b | Spec-derived auth probe: negation window fixes | autonomy/lib/functional-verify.py, tests/test_functional_verify.py | HIGH | pytest tests/test_functional_verify.py | released@2026-10-17T04:48Z | HIGH r2 BLOCK aaf27e569: trailing-slash redirect false green, curly apostrophe and article negation false reds; r3 under D99 |
-| TEN-RELEASE-INSTANT-F1 | Empty CUR from a failed npm view fails closed; rename the stale publish step | .github/workflows/release.yml | LOW | see note | released@2026-10-17T03:50Z | TL APPROVE 29ca496f1, ships v11.17.16 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| TEN-COST-18-F1 | cost_claim: a non-object JSON row is skipped, not an AttributeError | C-F1 harness cost_claim | LOW | see note | released@2026-10-17T03:50Z | TL APPROVE 924cec1c8, ships v11.17.16 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| TEN-GROUP-AUTH-F1 | kpis iteration_count does not count group cost records | loki-ts kpis | LOW | see note | released@2026-10-17T04:31Z | r1 BLOCK 1c59103ad (writer kind unasserted); r2 adds writer-reader test and stats.ts sibling |
-| TEN-COST-09 | Skip a Wall that cannot run | engine10 wall stage | HIGH | see note | released@2026-10-17T04:48Z | architect cost plan |
-| TEN-COST-10 | Plan on haiku for small and normal tasks | engine10 plan stage | MEDIUM | see note | rejected@2026-10-17T04:35Z | D99: FC-35 pins the router-on plan to opus and router-off must stay byte-identical, so the haiku plan pin was dead code (HIGH BLOCK bc80a88b6); quality outranks cost. architect cost plan |
-| TEN-COST-11 | Wall on haiku, re-authored on sonnet on failure | engine10 wall stage | HIGH | see note | released v11.17.27 | architect cost plan |
-| TEN-COST-12 | 5-minute cache TTL by default | runner cache settings | MEDIUM | see note | released@2026-10-17T04:35Z | architect cost plan |
-| TEN-COST-13 | Lean prefix by default | runner prompt prefix | MEDIUM | see note | released@2026-10-17T04:31Z | architect cost plan |
-| TEN-COST-14 | Wall brief output budget | engine10 wall brief | LOW | see note | released@2026-10-17T04:24Z | architect cost plan |
-| TEN-COST-15 | Plan output trim | engine10 plan stage | LOW | see note | parked@2026-10-17T04:35Z | parked with TEN-COST-10 (rejected). architect cost plan |
-| TEN-COST-16 | Implement on haiku first (opt-in) | engine10 implement stage | HIGH | see note | released v11.17.26@2026-10-17T05:48Z | architect cost plan |
-| TEN-COST-19 | Group cost in loki rows of C-F1 | C-F1 harness | LOW | see note | released v11.17.32 | after COST-04 |
-| TEN-COST-21 | C-F1 .venv and keep_evidence | C-F1 harness | LOW | see note | released v11.17.33 | after COST-04 and COST-20 |
-| TEN-COST-22 | Cache read pricing correction | model-pricing.json | LOW | see note | rejected@2026-10-17T03:30Z | premise false: Sonnet 5.5 cache read is $0.10 (0.05x) already |
-| TEN-COST-23 | Investigate multi-unit launcher exit 1 | features/speed launcher | HIGH | see note | released@2026-10-17T04:35Z | architect cost plan |
-| TEN-COST-24 | Opt-in Batch API path for single-shot judge calls under an API key | judge call sites | MEDIUM | see note | released v11.17.25@2026-10-17T05:39Z | never used in loki start; subscription runs gain nothing from batch |
-| TEN-GATES-03-F1 | verify --require-exogenous fails closed with --allow-unsigned and ignores zero-test checks | loki-ts/src/engine10/verify_cmd.ts; loki-ts/tests/engine10/verify_cmd.test.ts | HIGH | an UNSIGNED agent-only receipt with --require-exogenous --allow-unsigned exits 4; an exogenous pass with n=0 does not count toward k | released v11.17.25@2026-10-17T05:39Z | from GATES-03 HIGH review non-blocking findings 1 and 2; batch O |
-| TEN-ADOPTION-03-F1 | proof share scan catches tokens (ghp_, AKIA, sk-ant) and proof registry lists badge, md, bundle | autonomy/lib/secure-scan.py or loki-ts/src/util/secure_scan.ts; loki-ts/src/commands/proof.ts; loki-ts/src/cli/registry.ts; tests | MEDIUM | a bundle with a ghp_ token in events.jsonl shows a finding in the share preview; registry proof subcommands include badge, md, bundle | released v11.17.25@2026-10-17T05:39Z | from ADOPTION-03 TL review notes 1 and 2; batch O |
-| TEN-QUALITY-03-F1 | lint baseline abort test proves the in-flight rerun is killed | loki-ts/tests/engine10/verify_lint.test.ts | LOW | removing signal from AbortSignal.any in verify.ts turns the test red | released v11.17.25@2026-10-17T05:39Z | from QUALITY-03 TL review non-blocking finding 1; batch O |
-| TEN-P9-FIX | P0: first-run login probe spawns the provider CLI with the withheld env | loki-ts/src/commands/doctor.ts, loki-ts/tests/engine10/preflight.test.ts, docs/v10/FAILURE-CLASSES.md | HIGH | bash tests/moat/p9-rule-of-two.sh all CASE PASS; reverting doctor.ts turns preflight.test.ts red | released@2026-10-17T05:34Z v11.17.24 | culprit 08a8ae052 (TEN-UX-01); opus HIGH APPROVE cc74ce7cc |
-| TEN-SEC-GITLEAKS-01 | fixture builds the fake AWS key at runtime; pre-push gitleaks scans merges first-parent like CI | .githooks/pre-push, tests/test-security-audit-config.sh, tests/test-pre-push-gitleaks.sh, loki-ts/tests/engine10/check_result.test.ts | HIGH | G1 red when the flag is dropped from the call line; evil-merge case refused rc=1 | released@2026-10-17T05:34Z v11.17.24 | opus HIGH r2 APPROVE d39b7b8af |
-| TEN-UX-01-F1 | supervisor calls initEmptyRepo before refusing a non-repo folder | loki-ts/src/engine10/supervisor.ts, an existing supervisor/cli test file | MEDIUM | first-run-gate --stub --entry start-empty repo-init line passes; removing the call goes red | released v11.17.25@2026-10-17T05:39Z | FC-TEN-UX-01 recurrence; found by TEN-UX-08 TL review; workflow wplxouy32 |
-| TEN-P9-FIX-F1 | doctor login probe reuses withholdGithubTokens instead of a hand-built copy | loki-ts/src/commands/doctor.ts, loki-ts/src/runner/github_token.ts (export only if needed), loki-ts/tests/engine10/preflight.test.ts | HIGH | p9 probe all PASS; a new channel added to withholdGithubTokens is withheld from the probe too | released v11.17.33 | P9-FIX HIGH review non-blocking 1; extend-never-duplicate |
-| TEN-SEC-GITLEAKS-01-F1 | local-ci gitleaks step uses --diff-merges=first-parent and joins the G1 comparison set; G1 reads the mode at any indentation | scripts/local-ci.sh, tests/test-security-audit-config.sh | LOW | dropping the flag from local-ci.sh turns G1 red; indented reassignment turns G1 red | released v11.17.33 | SEC-GITLEAKS-01 HIGH r2 non-blocking |
-| TEN-UX-03-F1 | build_verified payload asserted to carry only headline and route | tests/test-first-run-funnel-coverage.sh | LOW | adding an extra arg to loki_emit_build_verified_enum turns the test red | released v11.17.33 | UX-03 TL review non-blocking 1 |
-| TEN-RELEASE-FAST | one-command ship: scripts/release.sh --ship --notes FILE bumps, writes the CHANGELOG section, rebuilds dist, commits, checks ancestry and gitleaks, waits for an in-flight Release run, pushes and verifies origin/main | scripts/release.sh, tests/test-release-sh.sh (extend; it owns release.sh) | HIGH | --ship on a fixture repo with a fake origin completes all phases and prints per-phase timings; a non-ancestor origin, a gitleaks hit, a forbidden staged file and a CHANGELOG c[7] mismatch each abort before push (red mutation per guard) | released v11.17.33 | D103; target under 90s wall for the whole ship |
-| TEN-SEC-PREPUSH-MERGE-WARN | pre-push .gitleaksignore-growth warning diffs merges against the first parent only, so a merge of an older slice no longer reports lines main already had | .githooks/pre-push (line ~621 diff-tree -m), tests/test-security-audit-config.sh or the existing pre-push test that owns this warning; docs/v10/FAILURE-CLASSES.md (row first) | LOW | pushing a merge of a branch based before an ignore line was added prints no warning; a commit that really adds an ignore line still warns (red mutation: put -m back) | released v11.17.28 | v11.17.25 push printed 5 false warnings for merges c6d3894f1..0a16434e1 while git diff 7d4d0ffb2 HEAD -- .gitleaksignore was empty |
-| TEN-COST-16-F1 | haiku-first downgrade row: router-override test, and the cascade override is reported only when cascadeDowngrade(run model) is non-null | loki-ts/src/runner/model_downgrades.ts, loki-ts/tests/engine10/session_l1_model.test.ts | LOW | router+haiku-first names the router override; cascade on a sonnet run reports the haiku-first row, matching implement.ts:106 precedence | released v11.17.29 | COST-16 r2 TL non-blocking N2, N3 |
-| TEN-COST-25 | fix: --cost lean stops forcing a plan session: drop LOKI_ROUTER from the lean profile (router makes plan.ts:65 plan every small task and overrides haiku-first) and add LOKI_IMPLEMENT_HAIKU_FIRST=1 plus the COST-26 sizing knobs | loki-ts/src/util/cost_profile.ts, loki-ts/tests/util/cost_profile.test.ts | MEDIUM | red: resolveCostProfile('lean') yields LOKI_ROUTER=1 and no LOKI_IMPLEMENT_HAIKU_FIRST; green: lean env has LOKI_IMPLEMENT_HAIKU_FIRST=1, no LOKI_ROUTER, and the COST-26 knobs; balanced/max unchanged | released v11.17.32 | depends: TEN-COST-26, TEN-COST-16-F1. goal: cost-2x lever; C-F1 run4 small tasks were 1.415x raw from fixed plan+Wall cost (cf1-20261017T025219Z, plan_skipped=false on all 31) |
-| TEN-COST-26 | feature: sizing knobs LOKI_E10_SMALL_MAX_CHARS (default 600, unchanged) and opt-in LOKI_E10_SMALL_NO_RUNNER=1 so a missing test runner no longer forces normal (smallTaskPath still routes it to wall) | loki-ts/src/engine10/sizing.ts (at most 3 core lines), loki-ts/tests/engine10/sizing.test.ts | MEDIUM | red: a 700-char task with LOKI_E10_SMALL_MAX_CHARS=800 sizes normal, and a no-runner task with LOKI_E10_SMALL_NO_RUNNER=1 sizes normal; green: both small, defaults byte-identical | released v11.17.29 | goal: C-F1 run4 sized all 31 tasks normal (19 'no test runner detected', 12 also >600 chars at 683/724); core budget 4937/5000 |
-| TEN-COST-27 | enhancement: loki start reads cost.profile from loki.yaml as the team default; --cost flag and LOKI_COST_PROFILE env still win | loki-ts/src/commands/start.ts (cost flag resolution near line 279 only; not the help block DEPLOY rows own), loki-ts/tests/commands/start.test.ts | LOW | red: loki.yaml cost.profile: lean with no flag resolves balanced; green: resolves lean, flag and env override it, invalid value warns and falls back | released v11.17.33 | depends: TEN-COST-25. goal: teams opt in to the lean lever once; reuse util/yaml_key.ts yamlKey |
-| TEN-SPEED-01 | feature: cost_claim reports a paired elapsed_s ratio (raw/loki) with the same bootstrap CI as the cost ratio | benchmarks/bench/cost_claim.py, benchmarks/bench/tests/test_cost_claim.py | LOW | red: cost_claim JSON has no time_ratio key for paired rows carrying elapsed_s; green: time_ratio and time_ci present, rows missing elapsed_s are excluded and counted | released v11.17.29 | goal: speed has no measured number today (cost_claim has no time metric; attribution.py:351-355 already writes elapsed_s); first SPEED row |
-| TEN-SPEED-02 | enhancement: bench-suite times loki verify --fast and records p95 to migration_bench.jsonl | loki-ts/scripts/bench-suite.ts, loki-ts/tests/scripts/bench_suite_argv.test.ts | LOW | red: benchRouteArgv has no verify --fast route and no p95 field; green: argv test asserts the route and the record carries p95_ms | released v11.17.33 | goal: METRICS lists verify --fast p95 as not measured; fills it with a repeatable command |
-| TEN-UX-09 | feature: loki control stop stops the detached control plane via instance.json PID plus a /health identity check, never by name | loki-ts/src/commands/control.ts, loki-ts/tests/commands/control.test.ts, loki-ts/src/cli/registry.ts (control row sub list only), completions/_loki and completions/loki.bash (control subcommands only) | MEDIUM | red: loki control stop is an unknown subcommand (control.ts:175-181 handles serve/status/prune/backfill); green: stop ends the recorded PID, refuses a PID whose /health does not match, exits 0 when nothing runs | released v11.17.29 | goal: bare loki leaves a nohup control serve with no stop (observed PID 50904 + server.js on 47821); reuse restartStaleControlPlane control.ts:52-70 |
-| TEN-UX-10 | fix: bare loki prints next steps (give work with loki start "<brief>"; stop the UI with loki control stop) after the URL instead of the URL alone | autonomy/loki (_loki_control_ui only), tests/test-control-plane.sh | LOW | red: bare loki stdout is exactly the URL line; green: the URL line is first and both next-step lines follow; --json or non-TTY output unchanged if it has a contract | released v11.17.32 | depends: TEN-UX-09. goal: first-run UX; today a new user sees only http://127.0.0.1:47821 and a background daemon |
-| TEN-UX-11 | enhancement: the run summary Time line marks the first sealed PR in a repo (time to first sealed PR) so METRICS row 14 can be read from run output | loki-ts/src/engine10/output.ts (Time line input field only), loki-ts/tests/engine10/output.test.ts | LOW | red: summary with firstSealed=true renders the same Time line as any run; green: Time line appends 'first sealed PR in this repo' only when set, golden for other runs unchanged | released v11.17.33 | goal: time to first sealed PR is not measured (METRICS row 14); caller wiring is a follow-up row |
-| TEN-UX-12 | fix: the preflight 'could not confirm the Claude login' warning never adds a stdout line in quiet mode (stderr only) | loki-ts/src/engine10/preflight.ts (warning emit at line ~28 only), loki-ts/tests/engine10/preflight.test.ts | LOW | red: quiet run with an unanswered auth status prints 9 stdout lines (e2e.test.ts:130 A-130 limit 8); green: warning on stderr, quiet stdout within 8 lines | released v11.17.36 | depends: TEN-P9-FIX-F1 (owns preflight.test.ts). goal: quiet-mode contract and a likely cause of the red main Tests runs |
-| TEN-ADOPTION-09 | feature: engine10 pr stage routes a gitlab.com pinned origin to engine10-push-gitlab.sh push-mr and accepts the MR URL | loki-ts/src/engine10/stages/pr.ts, loki-ts/tests/engine10/pr.test.ts | HIGH | red: gitlab origin calls DEFAULT_PUSH_SH engine10-push.sh (pr.ts:42) and an MR URL fails PR_URL_RE (pr.ts:72); green: push-mr is invoked and the MR URL is recorded; github path byte-identical | released v11.17.36 | goal: GitLab teams; the script and tests/test-engine10-push-gitlab.sh exist but nothing in loki-ts/src references it |
-| TEN-ADOPTION-10 | fix: reviewer instructions name the receipt-check action with a copyable uses: line pinned to the current version instead of 'adds the receipt-check action' | loki-ts/src/e10ext/reviewer_body.ts, loki-ts/tests/engine10/pr_body_golden.test.ts | LOW | red: reviewer body line 54 has no uses: reference; green: body contains uses: <repo>/.github/actions/receipt-check@v<VERSION> and the golden is updated | released v11.17.33 | goal: .github/actions/receipt-check exists (tests/test-receipt-check-action.sh) but no user-facing text tells a reviewer how to add it |
-| TEN-GATES-11 | feature: build autonomy/lib/ablation.py to the tests/moat/p8-load-bearing-proof.sh contract and promote the 3 P8 ablation lines in tests/moat/pending.txt | autonomy/lib/ablation.py (new: the p8 header names this exact path and no module owns it), tests/test_ablation.py (new: the new module's own test), tests/moat/pending.txt (3 P8 lines only) | HIGH | red: bash tests/moat/p8-load-bearing-proof.sh fails, ablation.py missing; green: P8.ablation-runtime-change-load-bearing, P8.ablation-dead-code-not-sealed, P8.ablation-na-docs-only pass and leave pending.txt; restore is byte-for-byte | released v11.17.29 | goal: moat 2/9 proven; consumer already built (proof-generator.py:874 _collect_ablation, :2052 headline refusal), producer missing |
-| TEN-GATES-12 | enhancement: loki start proof path runs ablation.py before proof-generator so quality/ablation.json exists on engine10 runs | loki-ts/src/runner/proof.ts (pre-proof hook only), loki-ts/tests/runner/proof.test.ts | HIGH | red: an engine10 run with a load-bearing change leaves no quality/ablation.json; green: file present with status load_bearing, ablation failure is recorded not_applicable and never blocks the proof | released v11.17.32 | depends: TEN-GATES-07, TEN-GATES-11. goal: the P8 property reaches real runs, not just the moat script |
-| TEN-GATES-13 | feature: seeded-defect corpus at benchmarks/seeded-defects/manifest.json (schema loki.seeded-defects/v2, >=100 defects, generated) and promote P4.seeded-defect-corpus-present | benchmarks/seeded-defects/ (new dir: the p4 contract names this path), tests/moat/pending.txt (1 P4 line only) | HIGH | red: P4.seeded-defect-corpus-present fails, directory absent; green: manifest validates, count >=100, generator rerun is byte-identical, pending line removed | released v11.17.32 | depends: TEN-GATES-11 (shared pending.txt, one line each). goal: Seal accuracy cannot be measured without the corpus |
-| TEN-DEPLOY-10 | feature: loki status --probe re-probes the last deploy health URL and exits non-zero on regression | loki-ts/src/commands/status.ts (renderLastDeploy region only), loki-ts/tests/commands/status.test.ts | MEDIUM | red: --probe is an unknown flag; green: healthy URL exits 0, a 500 or timeout exits 1 with the URL and status, no last deploy exits 0 with a note | released v11.17.33 | goal: post-deploy watch; deploy health is recorded once and never rechecked |
-| TEN-STABILITY-09 | fix: engine10 stub e2e suites answer claude auth status so the P9 login probe never stalls or warns in stub runs | loki-ts/tests/engine10/e2e.test.ts (and its stub fixture only) | MEDIUM | red: on main the A-130 quiet, Rule of Two canary, cost cap, eval PR, issue-ref and SIGINT e2e cases fail; green: all pass with the stub answering auth status | released v11.17.31 | depends: none; first confirm still red on 7d4d0ffb2/0463f084b. goal: main Tests failed 11 of 13 recent runs; e2e.test.ts untouched since TEN-UX-01 |
-| TEN-STABILITY-10 | fix: pulse merged-not-released check reads merges with one git log pass indexed by slice ID instead of one git log per row | scripts/v10-pulse.sh (lookup near line 1993 and check_merged_not_released_stale only), tests/test-v10-pulse.sh | MEDIUM | red: a board with 50 merged rows runs 50 git log calls and one timeout raises RuntimeError for row D63-C5; green: one git call, same rows flagged, git failure still reported UNKNOWN not 'nothing to flag' | released v11.17.30 | goal: pulse at 05:51Z reported 'git log --merges failed for row D63-C5: rc=None: TIMEOUT'; the anti-drift signal goes dark under load |
-| TEN-QUALITY-10 | fix: a traceback or file:line path missing from a truncated repo map (cap 2000) is still ranked when git tracks it | loki-ts/src/util/relevance.ts, loki-ts/src/engine10/relevant_files.ts (at most 2 core lines), loki-ts/tests/engine10/plan.test.ts | MEDIUM | red: repo with 2500 files and a traceback naming file 2400 never lists it as relevant; green: it ranks first; untracked or absent paths still ignored | released v11.17.33 | goal: repomap.ts:19,34 MAX_FILES=2000 takes the first 2000 ls-files entries, so large repos lose explicit file hints |
-| TEN-QUALITY-11 | enhancement: a Python repo with uv.lock and no .venv runs tests and lint through uv run as the project interpreter | loki-ts/src/engine10/stages/verify.ts (resolveTool only, at most 3 core lines), loki-ts/tests/engine10/verify.test.ts | MEDIUM | red: uv.lock repo without .venv gets interpreter system and 'tests ran on the system interpreter' NOT PROVEN (verify.ts:43,339); green: interpreter project via uv run; no uv on PATH keeps today's system result | released v11.17.36 | goal: avoid a false PARTIAL for uv projects; verify.ts has no uv handling today |
-| TEN-QUALITY-12 | enhancement: repo map cap configurable (LOKI_E10_REPOMAP_MAX_FILES) and truncation drops vendored or generated dirs before source | loki-ts/src/engine10/repomap.ts (at most 3 core lines), loki-ts/tests/engine10/repomap.test.ts | LOW | red: 2500-file repo with 1500 vendor/ files maps mostly vendor and ignores the env knob; green: knob honored, vendor/ node_modules dist dropped first, default 2000 unchanged | released v11.17.36 | goal: plan context quality on large repos; complements TEN-QUALITY-10 with no shared file |
-| TEN-DEPLOY-04-F1 | register --badge in dispatcher route, help, registry and completions | loki-ts/src/commands/run_status.ts, registry.ts, cli.ts, autonomy/loki, help-core.sh, completions | LOW | help-changelog drift and completions coverage pass; removing the route line turns the status test red | released@2026-10-17T05:34Z v11.17.24 | TL APPROVE 50579a177 |
-| TEN-COST-11-F1 | enhancement: direct test for the machine.ts wall-stage distrust call (TEN-COST-11 review follow-up) | loki-ts/tests/engine10/machine.test.ts | LOW | wall base run green while implement changed files must yield already_satisfied false and base_run unproven; red mutation: delete the distrustGreenBase call at machine.ts:221 turns the test red; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10/machine.test.ts | released v11.17.37 | goal: pin the fail-closed branch (machine.ts:221) that has no direct test; test only, no src change |
-| TEN-COST-28 | feature: per-stage share of spend printed in the cost summary (plan, wall, implement, fix, xreview) with the top stage named | loki-ts/src/engine10/cost.ts, loki-ts/tests/engine10/cost.test.ts | MEDIUM | red: summary shows only a total; green: stage shares sum to 100 percent, unmetered stages say unmetered not 0; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10/cost.test.ts | released v11.17.37 | goal: make the 2x cost proof attributable; grep cost.ts for an existing by-stage field first |
-| TEN-COST-29 | enhancement: flag a cache-cold stage (cache read under 30 percent of input) with one line in the cost breakdown | loki-ts/src/util/cost_breakdown.ts, loki-ts/tests/engine10/cost_unmetered.test.ts | LOW | red: a stage with 5 percent cache reads prints no hint; green: one 'cache cold: <stage>' line, none when all stages are warm or unmetered; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10/cost_unmetered.test.ts | released v11.17.38 | goal: surface the biggest cost lever (prefix cache hit) per run |
-| TEN-COST-30 | fix: an unknown cost.profile value in loki.yaml or --cost (for example 'leen') warns once and names the valid profiles instead of silently using default | loki-ts/src/util/cost_profile.ts, loki-ts/tests/util/cost_profile.test.ts | MEDIUM | red: 'leen' resolves to default with no message; green: one stderr warning naming lean and default, valid values unchanged and quiet mode keeps stdout clean; cd loki-ts && bunx tsc --noEmit && bun test tests/util/cost_profile.test.ts | released v11.17.38 | goal: a typo must not forfeit the cost win silently; follows TEN-COST-27 |
-| TEN-SPEED-03 | feature: run summary Time line names the slowest stage and its share of wall time | loki-ts/src/util/run_summary.ts, loki-ts/tests/util/run_summary.test.ts | LOW | red: Time line has total only; green: 'slowest: <stage> NN%' appended, omitted when stage durations are missing; cd loki-ts && bunx tsc --noEmit && bun test tests/util/run_summary.test.ts | released v11.17.37 | goal: speed work needs a visible per-run bottleneck |
-| TEN-SPEED-04 | enhancement: repo map and test map reused across fix rounds when the git tree hash is unchanged | loki-ts/src/engine10/cache.ts, loki-ts/tests/engine10/cache.test.ts | MEDIUM | red: second fix round rebuilds the map with identical tree; green: cache hit counted, miss when tree hash differs; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10/cache.test.ts | released v11.17.38 | goal: cut seconds per fix round; read cache.ts key first and skip if the tree hash is already in the key |
-| TEN-SPEED-05 | fix: back-to-back loki start runs reuse a successful claude login probe for 10 minutes instead of re-spawning the CLI every time | loki-ts/src/engine10/preflight.ts, loki-ts/tests/engine10/preflight.test.ts | MEDIUM | red: two starts inside 10 min spawn the probe twice; green: second reuses the result, a failed probe is never cached, TTL expiry re-probes; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10/preflight.test.ts | released v11.17.38 | goal: shave start latency without hiding a logged-out state |
-| TEN-QUALITY-13 | feature: cross-review (xreview) prompt carries the intent card Acceptance lines and the verdict names any line left unmet | loki-ts/src/engine10/stages/xreview.ts, loki-ts/tests/engine10/xreview.test.ts | MEDIUM | red: reviewer prompt omits acceptance lines; green: prompt includes them, verdict lists unmet lines, absent card keeps today's prompt byte-identical; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10/xreview.test.ts | released v11.17.37 | goal: review checks what the user asked, not only the diff |
-| TEN-QUALITY-14 | enhancement: Wall authoring prompt requires one negative-case assertion (rejects bad input or fails before the fix) per acceptance line | loki-ts/src/engine10/stages/wall.ts, loki-ts/tests/engine10/wall.test.ts | MEDIUM | red: prompt has no negative-case rule; green: rule present, prompt size growth under 400 chars, existing wall tests green; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10/wall.test.ts | released v11.17.38 | goal: stronger Wall checks reject wrong implementations; wall.ts line budget applies (shrink-or-flat) |
-| TEN-QUALITY-15 | fix: fix rounds stop retrying the same model when the failing test set is identical two rounds in a row and escalate once | loki-ts/src/engine10/stages/fix.ts, loki-ts/tests/engine10/fix.test.ts | MEDIUM | red: identical failure signature loops on the same model to the round cap; green: escalates once then stops with a stalled reason; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10/fix.test.ts | released v11.17.38 | goal: stop wasted fix spend; grep stallClimb in unit_model.ts and reuse it, do not duplicate |
-| TEN-GATES-14 | feature: loki verify --explain lists each gate with exogenous or agent-influenced and the evidence it read | loki-ts/src/engine10/verify_cmd.ts, loki-ts/tests/engine10/verify_cmd.test.ts | HIGH | red: --explain is an unknown flag; green: one line per gate, exit code unchanged, --json carries the same fields; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10/verify_cmd.test.ts | released v11.17.37 | goal: make the moat legible to buyers; read-only output, no verdict change |
-| TEN-GATES-15 | enhancement: Seal receipt records the seeded-defect corpus version and catch rate used for the ablation gate | loki-ts/src/engine10/stages/seal.ts, loki-ts/tests/engine10/seal_verify_roundtrip.test.ts | HIGH | red: receipt lacks corpus id; green: corpus version and rate in the signed payload and loki verify rejects a tampered value; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10/seal_verify_roundtrip.test.ts | released v11.17.47 | goal: tie the load-bearing claim to evidence; builds on TEN-GATES-12/13 (released) |
-| TEN-GATES-16 | fix: loki verify reports DRIFT, not OK, when HEAD moved after the seal and the changed paths overlap the sealed diff | loki-ts/src/util/seal_drift.ts, loki-ts/tests/engine10/log_seal.test.ts | HIGH | red: sealed run then an amend on a sealed path still verifies OK; green: DRIFT with the path named, unrelated commits keep OK; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10/log_seal.test.ts | released v11.17.38 | goal: a seal must not vouch for code it did not see; read seal_drift.ts first and extend it |
-| TEN-UX-13 | feature: loki undo --dry-run prints the diffstat it would revert and changes nothing | loki-ts/src/commands/undo.ts, loki-ts/tests/commands/undo.test.ts | LOW | red: --dry-run unknown or applies the revert; green: diffstat printed, tree and HEAD unchanged, exit 0; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/undo.test.ts | released v11.17.37 | goal: safe undo; new test file because no existing test owns undo.ts (rollback.test.ts covers rollback.ts only) |
-| TEN-UX-14 | enhancement: loki queue list shows age and status columns and a count footer | loki-ts/src/commands/queue.ts, loki-ts/tests/commands/queue.test.ts | LOW | red: list prints ids only; green: id, age, status columns and 'N queued' footer, empty queue prints a next step; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/queue.test.ts | released v11.17.38 | goal: queue is inspectable at a glance |
-| TEN-UX-15 | fix: shell completions list flags added after the completion table was written (--probe, --badge, --cost) from the registry | loki-ts/src/commands/completion.ts, loki-ts/tests/commands/cli_help_routes.test.ts | LOW | red: completion output lacks a registered flag; green: every flag in registry.ts appears for its command; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/cli_help_routes.test.ts | released v11.17.38 | goal: no hand-maintained drift; derive from registry |
-| TEN-ADOPTION-11 | feature: loki trust prints a copyable README badge snippet for the last sealed run | loki-ts/src/commands/trust.ts, loki-ts/tests/commands/trust.test.ts | MEDIUM | red: no snippet; green: markdown snippet pointing at the verified badge, absent when no sealed run (prints the next step); cd loki-ts && bunx tsc --noEmit && bun test tests/commands/trust.test.ts | released v11.17.38 | goal: every sealed repo advertises Loki; reuse the TEN-DEPLOY-04 badge output |
-| TEN-ADOPTION-12 | enhancement: after an upgrade the next loki start prints a one-line what-is-new once | loki-ts/src/util/update_check.ts, loki-ts/tests/util/update_check.test.ts | LOW | red: no notice after version change; green: one line once per version, none in quiet or CI mode; cd loki-ts && bunx tsc --noEmit && bun test tests/util/update_check.test.ts | released v11.17.38 | goal: retention; no network call added |
-| TEN-DEPLOY-11 | feature: loki rollback prints the provider rollback command (names only, no secrets) for the last deploy record | loki-ts/src/commands/rollback.ts, loki-ts/tests/commands/rollback.test.ts | MEDIUM | red: rollback ignores deploy records; green: prints provider command from the record, nothing when no record, no env values; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/rollback.test.ts | released v11.17.37 | goal: complete the deploy loop; read-only, never executes the provider command |
-| TEN-DEPLOY-12 | fix: loki status --probe retries once after 5 seconds before reporting a regression, so a cold start is not a false alarm | loki-ts/src/commands/status.ts, loki-ts/tests/commands/status.test.ts | MEDIUM | red: first 503 then 200 exits non-zero; green: retry passes exit 0, two failures exit non-zero, retry visible in output; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/status.test.ts | released v11.17.38 | goal: stop false regressions; depends on TEN-DEPLOY-10 (released v11.17.33) |
-| TEN-STABILITY-11 | enhancement: run_pid detects a reused PID by comparing process start time and treats it as dead | loki-ts/src/util/run_pid.ts, loki-ts/tests/engine10/run_pid.test.ts | MEDIUM | red: unrelated live process with the recorded PID blocks a new run; green: start-time mismatch treated as stale; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10/run_pid.test.ts | released v11.17.37 | goal: no phantom lock after reboot; never kill by name or pattern |
-| TEN-STABILITY-12 | fix: a truncated outbox entry left by a crash is quarantined and skipped, not fatal to the next start | loki-ts/src/util/outbox.ts, loki-ts/tests/util/outbox.test.ts | MEDIUM | red: half-written JSON entry throws on drain; green: entry moved to a quarantine name, the rest drain, one warning printed; cd loki-ts && bunx tsc --noEmit && bun test tests/util/outbox.test.ts | released v11.17.38 | goal: crash-safe delivery |
-| TEN-SECURITY-01 | feature: the pre-PR secure scan also matches provider keys (sk-ant, AIza, xox[bp]-, ghp_) in added lines and blocks with the file and line | loki-ts/src/util/secure_scan.ts, loki-ts/tests/util/secure_scan.test.ts | HIGH | red: fixture with a runtime-built sk-ant key passes the scan; green: blocked naming file:line without echoing the secret, clean diff passes; cd loki-ts && bunx tsc --noEmit && bun test tests/util/secure_scan.test.ts | released v11.17.38 | goal: no leaked key in a Loki PR; fixtures build keys at runtime (gitleaks rule); grep first, extend patterns only |
-| TEN-SECURITY-02 | fix: redact() strips URL userinfo (https://user:pass@host) and Authorization headers from logged and receipted output | loki-ts/src/util/redact.ts, loki-ts/tests/util/redact.test.ts | HIGH | red: https://u:p@host survives redact; green: userinfo replaced, plain URLs and existing redactions unchanged; cd loki-ts && bunx tsc --noEmit && bun test tests/util/redact.test.ts | released v11.17.38 | goal: close a credential-in-log path; new test file because no existing test owns redact.ts |
-| TEN-GATES-17 | fix: a pre-existing test file the run edited must not count as agent-independent proof for loki verify --require-exogenous (reviewer finding on the n-key fix: status M edits keep provenance exogenous) | loki-ts/src/util/check_result.ts, loki-ts/tests/engine10/seal.test.ts | HIGH | red: a sealed run whose only passing check is a test file the run modified (status M, assertions weakened or replaced) passes --require-exogenous with rc 0; green: that check is advisory and --require-exogenous exits 4 while an untouched exogenous test still counts; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10/seal.test.ts tests/engine10/verify_cmd.test.ts tests/engine10/budget.test.ts | released v11.17.38 | Source: HIGH review of c958f563c. Grep checkProvenance and the A-119 edit rule first; decide whether to reuse the weakened-test detector instead of a blanket M rule, so legit test fixes stay exogenous. Record the call in DECISIONS.md if it changes D104. |
-| TEN-STABILITY-13 | P0 fix-forward: engine10 core is 5006 lines against the 5000 cap (budget.test.ts red on main since at least v11.17.35); bring core to 4950 or below without behavior change | loki-ts/src/engine10 (non-modernize) files only, plus the util or e10ext module that already owns any moved helper | MEDIUM | red: cd loki-ts && bun test tests/engine10/budget.test.ts fails with core is 5006 lines; green: same command passes with core at or below 4950, bun test tests/engine10 and bunx tsc --noEmit pass | released v11.17.38 | Move pure helpers out of the largest core files into the module that owns their concern (extend, never duplicate); delete dead code first; never squeeze lines by joining statements. Source: combined-tree run after v11.17.36. |
-| TEN-SECURITY-03 | fix: the bash secret scanners miss Anthropic keys (sk-ant-...) and the bash run_secure_scan applies the token rule only to browser-served files | autonomy/lib/secret-scan.sh, autonomy/verify.sh (secret pattern near 1177 and run_secure_scan only), the existing test that owns secret-scan.sh | HIGH | red: a runtime-built sk-ant key in a committed non-browser file passes both bash scanners; green: both report it by file and line without echoing the key, clean fixture passes; bash -n on both files plus the owning test | released v11.17.38 | Source: TEN-SECURITY-01 HIGH review (non-blocking item 5). Reuse one pattern list across both scripts if one already exists; fixtures build keys at runtime (gitleaks rule). |
-| TEN-STABILITY-14 | P0 fix-forward: four loki-ts/tests/util structural guards are red on main (model_output_regex_guard: wall.ts count mismatched after TEN-STABILITY-13 moved classifiers to util/check_result.ts; full_env_spawn_guard: doctor.ts mismatched and util/funnel.ts unlisted; registration_list_guard: stale commands/status.ts entry; start_flag_parity_guard: --cost undeclared) | the four allowlist or table files those guards load, plus the src file only when the honest fix is in code (for example funnel.ts spawning with the full env) | MEDIUM | red: cd loki-ts && bun test tests/util/model_output_regex_guard.test.ts tests/util/full_env_spawn_guard.test.ts tests/util/registration_list_guard.test.ts tests/util/start_flag_parity_guard.test.ts has 4 fails; green: 0 fails and bun test tests/util tests/engine10 has 0 fails | released v11.17.39 | Each allowlist entry needs a true reason; a full-env spawn in funnel.ts is fixed in code (allowlisted env) unless it is a documented passthrough. Three were red at ac43fb498 (v11.17.37). Source: combined-tree run before v11.17.38. |
-| TEN-COST-31 | feature: loki report kpis --since <Nd or YYYY-MM-DD> limits the iteration totals to a window and the human output names the window | loki-ts/src/commands/kpis.ts, loki-ts/src/metrics/kpis.ts, loki-ts/tests/commands/kpis.test.ts | MEDIUM | red: `loki report kpis --since 7d` exits 1 with unknown arg; green: iterations older than the window are excluded from cost and token totals, output says "since <date>", bad value exits 1; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/kpis.test.ts | released v11.17.40 | Gap: grep -n -e '--since' loki-ts/src/commands/kpis.ts returned 0 hits; the flag loop at kpis.ts:66-80 accepts only --json and help. Engineer confirms the iteration file mtime or timestamp field in metrics/kpis.ts before filtering. |
-| TEN-COST-32 | enhancement: a BUDGET_STOP run's next line names the exact recovery (loki start --max-cost <higher> or the resume command) instead of the generic loki status | loki-ts/src/util/run_summary.ts, loki-ts/tests/util/run_summary.test.ts | LOW | red: nextOf for a BUDGET_STOP run returns "loki status"; green: next line contains "--max-cost" and the run id; cd loki-ts && bunx tsc --noEmit && bun test tests/util/run_summary.test.ts | released v11.17.41 | Gap: run_summary.ts:62-67 returns "loki status" for every stopped result; grep -n 'max-cost' loki-ts/src/util/run_summary.ts returned 0 hits. Keep the change in util/ (engine10/output.ts is at the line cap): key on the outcome the summary input already carries. |
-| TEN-COST-33 | feature: loki queue run --max-total-cost <usd> stops the queue before the next item once cumulative spend reaches the cap and says so in the digest | loki-ts/src/commands/queue.ts, loki-ts/tests/commands/queue.test.ts, loki-ts/src/cli/registry.ts | MEDIUM | red: queue run has no total cap, a 3-item queue runs all 3 with injected spend 2 each and cap 3; green: stops after item 2, remaining items stay queued, digest line names the cap; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/queue.test.ts tests/cli/registry_guard.test.ts | released v11.17.44 | Gap: grep -nE 'max-cost or total or spend' loki-ts/src/commands/queue.ts shows only the governor forecast (queue.ts:213-235); no cumulative cap. Serialize on queue.ts after TEN-STABILITY-15 and TEN-UX-16. |
-| TEN-COST-34 | enhancement: the run summary Spend line adds "of which $X on retries" when retry sessions cost money | loki-ts/src/util/run_summary.ts, loki-ts/tests/util/run_summary.test.ts | LOW | red: a summary input with retry_usd 0.40 prints no retry figure; green: Spend line ends with "($0.40 on retries)", nothing printed when retry_usd is 0 or null; cd loki-ts && bunx tsc --noEmit && bun test tests/util/run_summary.test.ts | released v11.17.40 | Gap: costBreakdown computes retry_usd and retry_sessions (util/cost_breakdown.ts:17-43) and engine10/cost.ts:168 attaches it, but grep -rn retry_usd loki-ts/src outside cost_breakdown.ts returned 0 hits, so no reader. If the breakdown does not reach the summary input, thread it through spendText in run_summary.ts:166 only. |
-| TEN-SPEED-06 | enhancement: loki doctor runs its independent CLI version and network probes concurrently (Promise.all) so the report takes the slowest probe, not the sum | loki-ts/src/commands/doctor.ts, loki-ts/tests/commands/doctor.test.ts | MEDIUM | red: a test with three injected probes of 200ms each takes at least 600ms; green: under 350ms and the output order is unchanged; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/doctor.test.ts | released v11.17.41 | Gap: grep -c 'spawnSync or execSync' loki-ts/src/commands/doctor.ts is 11 against 4 Promise.all uses. Output ordering must stay byte-identical (doctor_router and doctor_count tests). Do not touch claudeLoginProbeCached (TEN-SPEED-05). |
-| TEN-SPEED-07 | feature: fix-round verification runs the previously failing test files first (pytest --ff style, bun/vitest file order) and stops at first failure when the runner supports it | loki-ts/src/util/check_result.ts, loki-ts/src/e10ext/select.ts, loki-ts/tests/e10ext/select.test.ts | MEDIUM | red: fix-round test command is identical to the round-1 command; green: command lists last-round failing files first for bun test, pytest and jest, unchanged for unknown runners; cd loki-ts && bunx tsc --noEmit && bun test tests/e10ext/select.test.ts tests/util | released v11.17.40 | Gap: grep -rnE 'failed.?first or lastFailed or --ff or --bail' loki-ts/src returned 0 hits. Engineer finds the verify command builder; if the only wiring point is inside engine10 core, land the pure helper in e10ext/ and wire with a net-zero line change. |
-| TEN-SPEED-08 | fix: back-to-back loki start runs reuse a successful gh auth status probe for 10 minutes like the Claude login probe | loki-ts/src/commands/doctor.ts, loki-ts/src/engine10/preflight.ts, loki-ts/tests/engine10/preflight.test.ts | MEDIUM | red: two checkPreflight calls with --pr spawn gh auth status twice; green: second call within 10 minutes spawns once, a failed probe is never cached; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10/preflight.test.ts tests/engine10 | released v11.17.40 | Gap: engine10/preflight.ts:36-38 spawns gh --version and gh auth status on every PR run; TEN-SPEED-05 cached only claudeLoginProbeCached (preflight.ts:30). Put ghAuthProbeCached beside claudeLoginProbeCached in doctor.ts; preflight.ts may change by net zero lines (4949 of 5000 core cap). |
-| TEN-QUALITY-16 | feature: before the commit stage the run formats only its own changed files with the repo's own formatter when the repo already configures one (ruff format, prettier, gofmt, cargo fmt) | loki-ts/src/e10ext/commit_filter.ts, loki-ts/src/runner/repo_profile.ts, loki-ts/tests/e10ext/commit_filter_guard.test.ts | MEDIUM | red: a run that leaves an unformatted py file commits it unformatted; green: changed files are formatted, unchanged files untouched, no formatter config means no-op; cd loki-ts && bunx tsc --noEmit && bun test tests/e10ext tests/runner/harness_intelligence.test.ts | released v11.17.41 | Gap: grep -rnE 'ruff format or prettier --write or eslint --fix or gofmt -w or cargo fmt' loki-ts/src returned 0 hits. Detect config only (pyproject [tool.ruff], .prettierrc, rustfmt.toml); never install a formatter. Reviewer PRs stay small because no unrelated reformat. |
-| TEN-QUALITY-17 | enhancement: a failing test that passes on one immediate rerun is classified flaky (not fail) so fix rounds are not spent on it | loki-ts/src/util/check_result.ts, loki-ts/tests/util/check_result.test.ts | MEDIUM | red: a check that fails then passes on rerun is classified fail; green: classified flaky with the rerun evidence, a deterministic fail stays fail; cd loki-ts && bunx tsc --noEmit && bun test tests/util | released v11.17.40 | Gap: grep -nE 'rerun or re-run or retryOnce' loki-ts/src/util/check_result.ts returned 0 hits; the flaky label exists only for Playwright output (check_result.ts:162) and the summary renderer (run_summary.ts:192). A flaky result must never count as agent-independent proof. If no check_result.test.ts exists, add cases to the nearest test that imports it. |
-| TEN-QUALITY-18 | feature: a TypeScript repo with tsconfig.json and a typescript dependency but no typecheck script gets a tsc --noEmit typecheck command in the repo profile | loki-ts/src/runner/repo_profile.ts, loki-ts/tests/runner/harness_intelligence.test.ts | LOW | red: profile for such a repo has no typecheck command; green: entry "typecheck: <runner> tsc --noEmit" sourced from tsconfig.json, a script named typecheck still wins; cd loki-ts && bunx tsc --noEmit && bun test tests/runner/harness_intelligence.test.ts | released v11.17.40 | Gap: repo_profile.ts:296 picks typecheck only from package scripts named typecheck, type-check or tsc, while Python gets a config-based mypy fallback at repo_profile.ts:311; grep -n tsconfig loki-ts/src/runner/repo_profile.ts returned 0 hits. |
-| TEN-GATES-18 | feature: Seal risk summary flags a dependency manifest change (package.json deps, pyproject deps, go.mod) with no matching lockfile change | loki-ts/src/util/check_result.ts, loki-ts/tests/util/check_result.test.ts, loki-ts/tests/engine10 L0 guard allowlist (widened at review) | HIGH | red: diff touching package.json dependencies only produces no finding; green: advisory finding "manifest changed without lockfile", clean when both change or only scripts change; cd loki-ts && bunx tsc --noEmit && bun test tests/util tests/engine10 | released v11.17.40 | Gap: check_result.ts:272 classifies lockfile paths and :312 flags deleted tests, but nothing pairs a manifest with its lockfile (grep -nE 'manifest.*lock' returned only the classifier). Advisory only, never turns a VERIFIED into a fail; needs FAILURE-CLASSES row. |
-| TEN-GATES-19 | feature: the signed receipt records the toolchain that ran the checks (bun, node, python3, git versions) so a verifier can see what produced the proof | loki-ts/src/util/composite_seal.ts, loki-ts/src/util/receipt_signer.ts, loki-ts/tests/engine10/seal_group.test.ts | HIGH | red: receipt payload has no toolchain field; green: receipt carries toolchain {bun,node,python3,git}, absent tools recorded as null, old receipts still verify; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10 tests/util/receipt_bundle.test.ts | released v11.17.40 | Gap: grep -rnE 'node_version or toolchain or bun_version or python_version' loki-ts/src/util loki-ts/src/engine10 returned 0 hits. Schema is additive and optional so verify of pre-existing receipts is unchanged; moat file set, two unanimous reviewers. |
-| TEN-GATES-20 | enhancement: secure-scan.py reports files_scanned and the Seal treats a scan of zero files as not_run instead of a clean pass | autonomy/lib/secure-scan.py, loki-ts/src/util/secure_scan.ts, loki-ts/tests/util/secure_scan.test.ts | HIGH | red: scanning an empty directory returns ok with total 0 and no file count; green: result carries summary.files_scanned, zero files yields not_run in the wrapper; cd loki-ts && bunx tsc --noEmit && bun test tests/util/secure_scan.test.ts && bash tests/test-secure-scan.sh | released v11.17.40 | Gap: scan() at autonomy/lib/secure-scan.py:600-630 returns only rules_version, findings, summary.total and by_severity; grep -n 'files_scanned or scanned' loki-ts/src/util/secure_scan.ts returned 0 hits. Serialize with TEN-SECURITY-06/07 (same python file). |
-| TEN-UX-16 | feature: loki queue remove <issue...> and loki queue clear take items out of the queue | loki-ts/src/commands/queue.ts, loki-ts/src/cli/registry.ts, loki-ts/tests/commands/queue.test.ts | LOW | red: `loki queue remove 12` prints the usage error; green: remove drops the normalized ref and reports "N removed, M left", clear empties the file, missing ref exits 0 with "not queued"; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/queue.test.ts tests/cli/registry_guard.test.ts | released v11.17.44 | Gap: runQueue dispatches only add, list, run (queue.ts:384-390) and registry.ts:174 declares the same three subcommands; grep -nE 'queue.*(remove or rm or clear)' loki-ts/src returned 0 hits. Serialize after TEN-STABILITY-15. |
-| TEN-UX-17 | feature: loki undo --list prints the recent runs that can be undone (run id, verdict, files changed, age) | loki-ts/src/commands/undo.ts, loki-ts/tests/commands/undo.test.ts | LOW | red: `loki undo --list` prints the usage text and exits 2; green: lists newest first from the runs dir, exits 0, empty state says "no runs to undo"; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/undo.test.ts | released v11.17.40 | Gap: undo.ts:156 USAGE lists only --plan and --dry-run forms and :180 requires a run id; grep -rnE '"--list"' loki-ts/src/commands returned 0 hits. New test file only if grep -rl runUndo loki-ts/tests finds none. Read-only: no git writes. |
-| TEN-UX-18 | enhancement: loki doctor --quiet prints only failed and warned checks plus the summary footer | loki-ts/src/commands/doctor.ts, loki-ts/tests/commands/doctor.test.ts | LOW | red: doctor --quiet is rejected or prints every pass row; green: only non-pass rows and the footer, exit code unchanged, --json unaffected; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/doctor.test.ts | released v11.17.44 | Gap: grep -nE 'quiet or -q\b' loki-ts/src/commands/doctor.ts returned 0 hits; the footer tally is at doctor.ts:1026. Update the usage text at doctor.ts:1052 and the start_flag_parity or help-drift guards if they list doctor flags. |
-| TEN-UX-19 | enhancement: loki start --help ends with three copyable examples (brief, PRD file, issue ref) | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | LOW | red: start help text has no Examples section; green: help lists loki start "<brief>", loki start ./prd.md, loki start owner/repo#123 and the quick-start docs agree; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/start.test.ts tests/commands/cli_help_routes.test.ts | released v11.17.41 | Gap: grep -nE 'Examples?:' loki-ts/src/commands/start.ts returned 0 hits. Check the bash help route (autonomy/help-core.sh) is not the one users reach; if it is, change the one that owns the text and keep the other byte-equal per the help-drift guard. |
-| TEN-ADOPTION-13 | feature: loki proof share --dry-run runs the secret scan and prints what would be published without publishing | loki-ts/src/commands/proof.ts, loki-ts/tests/commands/proof.test.ts | MEDIUM | red: `proof share <id> --dry-run` is treated as an unknown arg or publishes; green: prints the file list and scan verdict, publishes nothing, exit 0 clean and 1 when the scan blocks; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/proof.test.ts | released v11.17.40 | Gap: grep -n 'dry' loki-ts/src/commands/proof.ts returned 0 hits; share dispatch is at proof.ts:890 and its token scan came from TEN-ADOPTION-03-F1. |
-| TEN-ADOPTION-14 | enhancement: loki proof list --json prints the proof index as machine-readable JSON | loki-ts/src/commands/proof.ts, loki-ts/tests/commands/proof.test.ts | LOW | red: `proof list --json` prints the text table; green: JSON array of {id, verdict, created} sorted newest first, text output unchanged; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/proof.test.ts | released v11.17.41 | Gap: only show handles --json (proof.ts:47 and :149 args.includes("--json") inside show); the list arm at proof.ts:873 ignores it. Serialize after TEN-ADOPTION-13 (same file). |
-| TEN-ADOPTION-15 | enhancement: loki self-update --check also reports the installed version, the latest published version and whether an update is available | autonomy/loki, tests/test-self-update.sh | MEDIUM | red: --check prints only the detected package manager; green: also prints "installed X, latest Y, update available yes/no", offline prints "latest unknown" and exits 0; bash tests/test-self-update.sh | released v11.17.40 | Gap: autonomy/loki:14665 and :14694 document --check as "Print detection result" only. Reuse the registry lookup already in loki-ts/src/util/update_check.ts:97 instead of a second fetch. If tests/test-self-update.sh does not exist, extend the test that owns cmd_self_update (grep -l self-update tests/*.sh). |
-| TEN-DEPLOY-13 | fix: loki status --probe reports a regression when the health URL redirects to a different host (login page, provider not-found page) even though the final status is 200 | loki-ts/src/commands/status.ts, loki-ts/tests/commands/status.test.ts | MEDIUM | red: probe of a URL that redirects to another host returning 200 prints "Deploy health OK"; green: prints a failure naming the final host and exits 1, same-host redirects (http to https, trailing slash) still pass; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/status.test.ts | released v11.17.40 | Gap: status.ts:865 fetches with redirect follow and accepts 200-399 without comparing res.url to the recorded health_url host, so a redirect to a shared provider page reads healthy. |
-| TEN-DEPLOY-14 | feature: loki status --probe --json prints the probe result as one JSON object (url, ok, status, attempts, reason) | loki-ts/src/commands/status.ts, loki-ts/tests/commands/status.test.ts | LOW | red: --probe --json prints text lines; green: single JSON object, exit codes unchanged (0 healthy or nothing to probe, 1 regression); cd loki-ts && bunx tsc --noEmit && bun test tests/commands/status.test.ts | released v11.17.41 | Gap: status.ts:1023-1031 parses --probe and the usage text allows --json only without --probe; probe output at status.ts:850-880 is text only. Serialize after TEN-DEPLOY-13 (same region). |
-| TEN-DEPLOY-15 | enhancement: loki doctor disk check measures the current repo directory and the temp directory volumes, not only the home directory | loki-ts/src/commands/doctor.ts, loki-ts/tests/commands/doctor.test.ts | LOW | red: checkDisk reads statfs of homedir only; green: result reports the minimum free GB across home, cwd and tmpdir and names which volume is low; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/doctor.test.ts | released v11.17.44 | Gap: checkDisk at doctor.ts:353-365 calls statfsSync(homedir()) only; builds and worktrees write under cwd and tmpdir, which can be a separate full volume. Keep the DiskCheck JSON shape backwards compatible (add a field, do not rename). Serialize after TEN-SPEED-06 and TEN-UX-18 (same file). |
-| TEN-STABILITY-15 | fix: queue add on a corrupt queue file quarantines it and warns instead of silently overwriting every queued item | loki-ts/src/commands/queue.ts, loki-ts/tests/commands/queue.test.ts | MEDIUM | red: a truncated queue.json followed by queue add leaves a file holding only the new item; green: the bad file is renamed to queue.json.corrupt-<ts>, a warning is printed once, the new item is added to a fresh file; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/queue.test.ts | released v11.17.41 | Gap: readQueue returns [] on any JSON error (queue.ts:79-86) and queueAdd then writeQueue overwrites (queue.ts:108-124). Same class as TEN-STABILITY-12 (outbox quarantine at util/outbox.ts:28-33); reuse that pattern and add the row to FAILURE-CLASSES.md. |
-| TEN-STABILITY-16 | enhancement: loki start sweeps stale temp files left by a killed atomic write (name.tmp.<deadpid>.<n>) older than 1 hour in the .loki state dirs | loki-ts/src/util/atomic.ts, loki-ts/tests/util/atomic.test.ts | MEDIUM | red: a leftover state.json.tmp.99999.1 with a dead pid stays forever; green: swept when pid is dead and mtime older than 1h, a live pid or fresh file is untouched, only exact tmp names matched; cd loki-ts && bunx tsc --noEmit && bun test tests/util | released (already shipped before the row: loki-ts/src/runner/state.ts:444 sweepOrphanTmpFiles) | Gap: grep -rnE '\.tmp\.' loki-ts/src shows temp names created at util/atomic.ts:89 and run_control.ts:13 with no sweeper anywhere. Never glob outside .loki; reuse processStartTime or kill -0 from util/run_pid.ts for the liveness test; wire from a util/ entry point, not engine10 core. |
-| TEN-STABILITY-17 | feature: loki doctor lists orphan runs (a run dir whose owner process died before run.completed) with the resume or undo command for each | loki-ts/src/commands/doctor.ts, loki-ts/tests/commands/doctor.test.ts | MEDIUM | red: doctor ignores a run dir with a dead pid and no run.completed event; green: a warn row names the run id and "loki resume" or "loki undo", live and completed runs produce no row; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/doctor.test.ts | released v11.17.44 | Gap: runOwnerAlive (util/run_pid.ts:59) is consumed only by util/run_outputs.ts:156; grep -n runOwnerAlive loki-ts/src/commands/doctor.ts returned 0 hits. Warn level only, never fails doctor. Serialize after TEN-DEPLOY-15 (same file). |
-| TEN-STABILITY-18 | P0 fix-forward: nightly 39016259458 reds still red on main e32ee1b5d (pr_body_golden not-recorded producer util/check_result.ts; sizing wall brief 726 vs cap 616; router_optout_golden wall stage haiku for development; verify.test uv resolution CI-only via Bun.which PATH; test-sigpipe-guard 1737 vs ceiling 1728; help-changelog-drift loki verify --require-exogenous; test-ui-bare-loki exact-match on new control lines; test-local-ci-gitleaks scope) | the failing tests, loki-ts/src/util/check_result.ts, loki-ts/src/engine10/stages/wall.ts, loki-ts/src/engine10/stages/verify.ts, verify help and completions, scripts/local-ci.sh, docs/v10/FAILURE-CLASSES.md | MEDIUM | red: each named test fails on e32ee1b5d; green: cd loki-ts && bun test tests/engine10/pr_body_golden.test.ts tests/engine10/sizing.test.ts tests/engine10/router_optout_golden.test.ts tests/engine10/verify.test.ts tests/util; bash tests/test-sigpipe-guard.sh; bash tests/test-help-changelog-drift.sh; bash tests/test-ui-bare-loki.sh; bash tests/test-local-ci-gitleaks.sh | released v11.17.42 | Diagnosis 2026-10-17 by nightly diag agent; one FAILURE-CLASSES row per class |
-| TEN-STABILITY-19 | P0 fix-forward: moat P8.ablation-dead-code-not-sealed positive control headline VERIFIED WITH GAPS (expected VERIFIED) and first-run-gate --stub FAILED with dirty tracked tree M sum.js at intake.ts:61 | tests/moat/p8-*.sh or the ablation producer, scripts/first-run-gate.sh, loki-ts/src/engine10/stages/intake.ts only if the honest fix is there | HIGH | red: bash tests/moat/run.sh prints moat suite: FAIL (1 rule failure(s)); bash scripts/first-run-gate.sh --stub fails 7 assertions; green: both exit 0 | released v11.17.42 | Diagnosis 2026-10-17; never weaken a moat assertion to pass |
-| TEN-STABILITY-20 | Fix help-changelog-drift red after v11.17.42: list report kpis --since and undo --list in Bun help, autonomy/loki help and both completions | completions/loki.bash, completions/_loki, loki-ts/src help, autonomy/loki, docs/v10/FAILURE-CLASSES.md | LOW | merged 3c4e2fcd9 | released v11.17.43 |
-| TEN-STABILITY-26 | fix: `loki control backfill --repo` with no value silently falls back to the first positional or cwd and ships that dir; fail with one error line naming --repo and exit 2 (same class as TEN-STABILITY-21) | loki-ts/src/commands/control.ts, loki-ts/tests/commands/control.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/control.test.ts -t "backfill repo missing value"` fails (exit 0, ingests cwd); green: passes, `--repo DIR` and bare DIR unchanged | released v11.17.46 | Gap: control.ts:234 `flag(rest, "--repo") ?? rest.find(...) ?? cwd`; flag() at :33 returns undefined for a trailing flag, missingValue() at :38 exists but is not applied here |
-| TEN-UX-24 | fix: the second `control` help block in autonomy/loki (cmd_control, ~line 34902) lists only serve, backfill, status; add prune, stop and `status --json` so it matches the Bun usage in control.ts | autonomy/loki, tests/test-help-discoverability.sh | LOW | red: `bash tests/test-help-discoverability.sh` fails on a new assertion that bash `loki control --help` names prune, stop and status --json; green: passes and `bash tests/test-help-changelog-drift.sh` still exits 0 | released v11.17.46 | Gap: control.ts:22 documents prune --repo/--before; the bash fallback help (LOKI_LEGACY_BASH) omits it |
-| TEN-UX-25 | fix: bash `cmd_provider` default arm (autonomy/loki:7488) prints help and returns 0 for an unknown subcommand; return 2 with one "unknown subcommand" line (TS side fixed in TEN-UX-20); chain after TEN-UX-24 | autonomy/loki, tests/test-help-discoverability.sh | LOW | red: `bash tests/test-help-discoverability.sh` fails on `loki provider frobnicate` expecting exit 2; green: passes, `loki provider` and `loki provider --help` still exit 0 | released v11.17.46 | Gap: the `*)` arm at autonomy/loki ~7517 echoes the help block with no return code; chain after TEN-UX-24 |
-| TEN-UX-26 | fix: sibling sweep of bash commands whose default arm prints help and exits 0 on an unknown subcommand (cmd_config ~14144 and cmd_api ~15932 are the first candidates; confirm each with a probe, skip any that already fail non-zero); make each exit 2 with an "unknown subcommand" line; chain after TEN-UX-25 | autonomy/loki, tests/test-help-discoverability.sh | LOW | red: `bash tests/test-help-discoverability.sh` fails on `loki config frobnicate` and `loki api frobnicate` expecting exit 2; green: passes, bare and --help forms still exit 0 | released v11.17.46 | Gap: FAILURE-CLASSES row required (siblings exist); chain after TEN-UX-25 |
-| TEN-UX-27 | fix: `loki doctor --quiet` writes `Install:` hint lines to stderr while the WARN/FAIL row goes to stdout, so the hint prints detached from its row; write each hint directly under its row on the same stream | loki-ts/src/commands/doctor.ts, loki-ts/tests/commands/doctor.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/doctor.test.ts -t "install hint follows its row"` fails (hint absent from stdout); green: passes and `bunx tsc --noEmit` exits 0 | released v11.17.46 | Gap: doctor.ts:1276 `process.stderr.write(... Install: ...)` after `process.stdout.write(formatToolLine(c))` at :1274 |
-| TEN-QUALITY-22 | test: pin the doctor disk text-mode "on <name> volume" label (home, cwd, tmp) so the low-volume name cannot regress; chain after TEN-UX-27 | loki-ts/src/commands/doctor.ts, loki-ts/tests/commands/doctor.test.ts | LOW | red: mutate lowestVolume to return null low_volume and `cd loki-ts && bun test tests/commands/doctor.test.ts -t "disk text volume label"` fails; green: passes unmutated | released v11.17.46 | Gap: doctor.test.ts:161 covers the JSON low_volume only; no test renders the text line; chain after TEN-UX-27 |
-| TEN-SPEED-10 | enhancement: `loki doctor --json` (buildDoctorJson) awaits checkSentrux, checkMemoryHealth and requirementsSection one after another; run them with Promise.all and keep output byte-identical; chain after TEN-QUALITY-22 | loki-ts/src/commands/doctor.ts, loki-ts/tests/commands/doctor.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/commands/doctor.test.ts -t "json checks run concurrently"` fails (elapsed ~ sum of stubbed 200ms probes); green: passes and `bun test tests/commands/doctor_router.test.ts tests/commands/doctor_count.test.ts` exit 0 | released v11.17.46 | Gap: doctor.ts:940-946 serial awaits; the text path already batches runAllToolChecks; chain after TEN-QUALITY-22 |
-| TEN-QUALITY-23 | test: help-changelog-drift guards exact completion cases; assert every `loki` subcommand and flag named in CHANGELOG appears as a literal case in completions/loki.bash and completions/_loki so a flag typo fails | tests/test-help-changelog-drift.sh, completions/loki.bash, completions/_loki | LOW | red: introduce a typo `--sinse` in completions/loki.bash and `bash tests/test-help-changelog-drift.sh` must exit 1 naming it; green: reverted typo exits 0 | released v11.17.46 | Gap: current test greps for substrings loosely, a misspelled flag in a different case arm still passes |
-| TEN-GATES-22 | feature: the per-run signed receipt (not only the composite) records the toolchain {bun,node,python3,git}, absent tools null, old receipts still verify (follow-up from the TEN-GATES-19 review) | loki-ts/src/util/receipt_signer.ts, loki-ts/tests/engine10/seal_group.test.ts | HIGH | red: `cd loki-ts && bun test tests/engine10/seal_group.test.ts -t "per-run receipt toolchain"` fails (no toolchain key); green: passes, `bun test tests/engine10 tests/util/receipt_bundle.test.ts` and `bunx tsc --noEmit` exit 0 | released v11.17.46 | Gap: collectToolchain is used only by composite_seal.ts:54; receipt_signer.ts has no toolchain reference |
-| TEN-COST-39 | fix: a malformed `.loki/metrics/budget.json` is discarded and returns null, so spend resets to zero and the cap is silently disarmed; rebuild budget_used from the efficiency records (readEfficiencyDir) and warn once | loki-ts/src/runner/budget.ts, loki-ts/tests/runner/budget.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/runner/budget.test.ts -t "corrupt budget state rebuilds used"` fails (used 0); green: passes and `bun test tests/runner/autonomous_budget.test.ts` exit 0 | released v11.17.46 | Gap: budget.ts:305-318 returns null on parse failure and the caller treats null as no spend |
-| TEN-COST-40 | fix: `loadDefaultMaxCostUsd` silently falls back to the literal 100 when model-pricing.json is unreadable; print one stderr warning naming the file and the fallback; chain after TEN-COST-39 | loki-ts/src/runner/budget.ts, loki-ts/tests/runner/budget.test.ts | LOW | red: `cd loki-ts && bun test tests/runner/budget.test.ts -t "pricing file missing warns"` fails (no warning); green: passes, warning emitted once per process | released v11.17.46 | Gap: budget.ts:24-33 swallows every read error; chain after TEN-COST-39 |
-| TEN-STABILITY-27 | fix: `LOKI_E10_STALL_S=abc` or `LOKI_E10_STALL_KILL_S=-5` is silently ignored and the default applies; warn once on stderr naming the variable and the value used | loki-ts/src/runner/watchdog.ts, loki-ts/tests/runner/watchdog.test.ts | LOW | red: `cd loki-ts && bun test tests/runner/watchdog.test.ts -t "invalid stall env warns"` fails (no warning); green: passes, valid and unset values unchanged | released v11.17.46 | Gap: watchdog.ts:8-17 return the default with no diagnostic |
-| TEN-STABILITY-28 | fix: `loki undo <run> --bogus` ignores unknown flags and proceeds; validate against the known set (--list --plan --dry-run --json --allow-unsigned --yes --close-pr --help) and exit 2 with one line naming the flag | loki-ts/src/commands/undo.ts, loki-ts/tests/commands/undo.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/commands/undo.test.ts -t "unknown flag"` fails (exit 0 or applies); green: passes, all valid combinations unchanged | released v11.17.46 | Gap: undo.ts:218-238 uses args.includes for each flag with no unknown-flag check; a typo such as `--dry-rn` falls through to apply |
-| TEN-STABILITY-29 | fix: `loki rollback <id> --forse` and other unknown flags are ignored (the typo drops --force silently); validate against known flags and exit 2 | loki-ts/src/commands/rollback.ts, loki-ts/tests/commands/rollback.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/rollback.test.ts -t "unknown flag"` fails; green: passes, --json and --force unchanged | rejected (already shipped by 8d630fa59 TEN-DEPLOY-16) | Gap: rollback.ts:77,116,128 use rest.includes only |
-| TEN-STABILITY-30 | fix: `loki start ./prd.md` with a mistyped or missing path treats the path string as an inline brief and starts a paid run on it; when the spec looks like a path (contains / or ends in .md/.txt/.yaml/.json) and does not exist, exit 2 "PRD file not found: <path>" | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/commands/start.test.ts -t "missing prd path"` fails (run starts); green: passes, real files and plain briefs unchanged | released v11.17.46 | Gap: start.ts:376 `existsSync(spec) ? readFileSync : spec` falls through to the literal string; verify the same fall-through on the --prd flag before building |
-| TEN-COST-41 | enhancement: `loki start` prints one line before the first iteration stating the effective per-run cap and where it came from (flag, env, loki.yaml, default $100) so a silent default cap is visible; skip if already printed (check first); chain after TEN-STABILITY-30 | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/start.test.ts -t "cap source line"` fails (no line); green: passes for flag, env and default sources | released v11.17.46 | Gap: capNote exists in e10ext/budget_cap.ts (start.ts:425); confirm it covers the legacy default path; chain after TEN-STABILITY-30 |
-| TEN-STABILITY-31 | fix: `listCheckpoints` silently skips a checkpoint whose metadata.json is corrupt or fails validation, so it vanishes from rollback choices with no trace; collect skipped ids and warn once on stderr | loki-ts/src/runner/checkpoint.ts, loki-ts/tests/runner/checkpoint.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/runner/checkpoint.test.ts -t "corrupt metadata warns"` fails (no warning); green: passes, valid listing order unchanged | released v11.17.46 | Gap: checkpoint.ts:414-436 readCheckpointSafe returns null in a bare catch |
-| TEN-QUALITY-25 | test: pin provider failover classification (rate limit vs outage vs killed vs clean exit) and nextProvider ordering with a fake installed() probe | loki-ts/src/runner/provider_failover.ts, loki-ts/tests/runner/provider_failover.test.ts | MEDIUM | red: mutate classifyOutage to return null for exit 137 and `cd loki-ts && bun test tests/runner/provider_failover.test.ts` fails; green: passes unmutated and `bunx tsc --noEmit` exits 0 | released v11.17.46 | Gap: no tests/runner file names provider_failover; new test file justified because no existing file owns it (verify with grep first) |
-| TEN-UX-28 | enhancement: `loki queue run` prints a progress line `[n/m] <ref>` before each item and the digest links each item verdict; skip if already present (check first) | loki-ts/src/commands/queue.ts, loki-ts/tests/commands/queue.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/queue.test.ts -t "progress line per item"` fails; green: passes and the existing digest test still exits 0 | released v11.17.46 | Gap: queue.ts run loop (~line 290-320) records results only in the final digest |
-| TEN-SPEED-11 | enhancement: `loki report kpis --since 7d` should skip run directories whose newest mtime is before the cutoff instead of parsing every run, with identical output | loki-ts/src/commands/kpis.ts, loki-ts/tests/commands/kpis.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/kpis.test.ts -t "since skips old runs"` fails (old run files read, counted by a spy); green: passes and output byte-identical on the fixture | released v11.17.46 | Gap: kpis.ts:96 computeKpis receives sinceMs; confirm it filters after reading (read computeKpis first, drop if already pruned by mtime) |
-| TEN-SECURITY-11 | fix: the SARIF secret scan misses common token formats (Hugging Face `hf_`, SendGrid `SG.`, Twilio `SK`+32 hex, Azure storage `AccountKey=`); add Tier 1 patterns that report label only, never the matched text, and mirror them in autonomy/lib/secret-scan.sh in the same change | loki-ts/src/commands/export_sarif.ts, loki-ts/tests/commands/export_sarif.test.ts, autonomy/lib/secret-scan.sh | MEDIUM | red: `cd loki-ts && bun test tests/commands/export_sarif.test.ts -t "extra token formats"` fails (0 findings); green: passes with label-only output and `bash tests/test-secret-scan.sh` exits 0 | released v11.17.46 | Gap: export_sarif.ts:12-24 lists 12 formats; none cover those four; parity with secret-scan.sh required |
-| TEN-DEPLOY-19 | fix: `loki start --deploy --health-url X --domain Y` accepts any string; validate --health-url is http or https with a host and --domain is a bare hostname, exit 2 with one line naming the flag, before any run work; chain after TEN-COST-41 | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/commands/start.test.ts -t "deploy flag validation"` fails (exit 0); green: passes, valid URLs unchanged | released v11.17.46 | Gap: start.ts:158 lists the deploy flags as value flags with no validation; verify on the Bun route and the bash route; chain after TEN-COST-41 |
-| TEN-DEPLOY-20 | fix: `loki start --deploy --env-file ./missing.env` is accepted and fails only after the build; check the file exists and is readable up front and exit 2; chain after TEN-DEPLOY-19 | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/start.test.ts -t "env-file missing"` fails (exit 0); green: passes, existing file unchanged | released v11.17.46 | Gap: start.ts:158 --env-file is passed through unchecked; chain after TEN-DEPLOY-19 |
-| TEN-ADOPTION-22 | enhancement: `loki provider list` marks each provider CLI as installed or missing and prints the install command for a missing one (reuse the table doctor.ts providerInstall) | loki-ts/src/commands/provider.ts, loki-ts/tests/commands/provider.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/provider.test.ts -t "list shows install hint"` fails; green: passes with a stubbed which() and `bunx tsc --noEmit` exits 0 | released v11.17.46 | Gap: check provider.ts list output first; doctor.ts:1263 holds the only install-hint table, move it to a shared export rather than copying |
-| TEN-ADOPTION-23 | fix: `loki completion fish` or an unknown shell must print the supported shells and exit 2; `loki completion` with no shell prints usage; check current behaviour first and drop if already correct | loki-ts/src/commands/completion.ts, loki-ts/tests/commands/cli_help_routes.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/cli_help_routes.test.ts -t "completion unknown shell"` fails; green: passes, bash and zsh output unchanged | rejected (already correct on read, dropped per row note) | Gap: completion.ts has no dedicated test file; extend cli_help_routes.test.ts rather than add one |
-| TEN-GATES-23 | enhancement: record each quality gate's wall-clock duration in the gate result so `loki status` and the receipt can show which gate dominates a slow run; additive field only, old readers ignore it | loki-ts/src/runner/quality_gates.ts, loki-ts/tests/runner/quality_gates.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/runner/quality_gates.test.ts -t "gate duration recorded"` fails (no duration_ms); green: passes and `bun test tests/runner/quality_gates_inconclusive.test.ts` exits 0 | released v11.17.46 | Gap: grep duration in quality_gates.ts first; if present, narrow the row to surfacing it in status |
-| TEN-GATES-24 | fix: `loki verify-pr` on a PR with no receipt must exit with a code distinct from "receipt present, verdict fail" and say which it is; check current exit codes first and drop if already distinct | loki-ts/src/commands/verify_pr.ts, loki-ts/tests/commands/verify_pr.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/commands/verify_pr.test.ts -t "no receipt exit code"` fails; green: passes, existing verdict exits unchanged | released v11.17.46 | Gap: a CI caller cannot tell missing proof from failed proof if both exit 1 |
-| TEN-SPEED-12 | enhancement: cache the repo profile (LOKI_REPO_PROFILE=1 path) keyed on HEAD sha and dirty flag so a resumed run does not rescan the tree | loki-ts/src/runner/repo_profile.ts, loki-ts/tests/runner/autonomous.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/runner/autonomous.test.ts -t "repo profile cache hit"` fails (scan runs twice); green: passes, cache invalidates on a new commit | released v11.17.46 | Gap: autonomous.ts:633 calls the profiler each start; read repo_profile.ts first and drop if a cache exists |
-| TEN-QUALITY-26 | fix: `loki wiki show <bad-section>` should list the valid sections (architecture, modules, data-flow) in the error and exit 2; extend the wiki test | loki-ts/src/commands/wiki.ts, loki-ts/tests/commands/wiki.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/wiki.test.ts -t "bad section lists valid"` fails; green: passes, valid sections unchanged | released v11.17.46 | Gap: wiki.ts:51 prints the section list only in the usage branch; check the unknown-section branch first |
-| TEN-UX-29 | fix: `loki report kpis --since` with no value, or followed by another flag, reports an empty invalid value and consumes the next flag; print "--since requires a value" and exit 1 without swallowing the next token; chain after TEN-SPEED-11 | loki-ts/src/commands/kpis.ts, loki-ts/tests/commands/kpis.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/kpis.test.ts -t "since missing value"` fails (message names an empty value); green: passes, `--since 7d` and `--since=7d` unchanged | released v11.17.46 | Gap: kpis.ts:87 `args[++i] ?? ""` eats the next token; chain after TEN-SPEED-11 |
-| TEN-QUALITY-27 | test: the "corrupt budget state rebuilds used from efficiency records" case in budget.test.ts asserts only budget_used; also assert limit, budget_limit and exceeded for BUDGET_LIMIT unset, below the cap and at the cap, so a rebuild can never silently disarm the cap | loki-ts/tests/runner/budget.test.ts | LOW | red: mutate rebuildBudgetState to return `exceeded: false` and `limit: 0` and run `cd loki-ts && bun test tests/runner/budget.test.ts -t "rebuilds"`, it fails; green: restored source passes | released v11.17.48 | Gap: budget.test.ts:278-290 checks `.budget_used` only; budget.ts:316-325 computes limit, budget_limit and exceeded with no test; seed from the TEN-COST-39 review |
-| TEN-QUALITY-28 | test: control.test.ts has only the missing-value cases for `backfill --repo`; add the positive `backfill --repo DIR` case (ships DIR, not cwd) and the bare `backfill DIR` case, with an injected env so nothing is sent | loki-ts/tests/commands/control.test.ts | LOW | red: mutate control.ts:235 to ignore `--repo` and run `cd loki-ts && bun test tests/commands/control.test.ts -t "backfill repo DIR"`, it fails; green: restored source passes | released v11.17.48 | Gap: control.test.ts:171-180 is the only backfill block and covers only exit 2; the positive path is unpinned; seed from the TEN-STABILITY-26 review |
-| TEN-COST-42 | fix: the bash readers of default_max_cost_usd (run.sh `_loki_budget_default`, autonomy/loki `loki_budget_default_usd`) fall back to 100 with no word when model-pricing.json is present but unreadable or has no parsable key; print one stderr warning naming the file, as the TS side does (TEN-COST-40), and keep the 100 fallback | autonomy/run.sh, autonomy/loki, tests/test-pricing-parity.sh | MEDIUM | red: add a case in tests/test-pricing-parity.sh that points the reader at an unreadable copy and expects a warning on stderr; `bash tests/test-pricing-parity.sh` fails; green: passes and a healthy file prints nothing extra | released v11.17.48 | Gap: run.sh:571 `sed ... 2>/dev/null` then `case '' ) 100.00`; autonomy/loki:79 `[ -f ... ] && sed` with no else branch; absent-file stays silent (that is the documented fallback), unreadable or keyless must warn |
-| TEN-COST-44 | enhancement: readEfficiencyDir skips malformed efficiency records silently, so a rebuilt budget undercounts spend with no hint; count the skipped files and have rebuildBudgetState include the count in its existing one-line warning; chain after TEN-QUALITY-27 | loki-ts/src/runner/budget.ts, loki-ts/tests/runner/budget.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/runner/budget.test.ts -t "skipped malformed"` fails (warning has no count); green: passes, the returned records and the 4-decimal cost are unchanged | released v11.17.48 | Gap: budget.ts:280-286 `catch { // ignore malformed file }`; budget.ts:320 warns only with the record count; chain after TEN-QUALITY-27 (same test file) |
-| TEN-COST-45 | fix: `loki estimate --provider bogus` and `--model nosuchmodel` are accepted and priced through whatever the resolver returns, while `loki start` rejects an unknown provider with exit 2; validate against the same provider list and print one error line naming the fix, exit 1 | loki-ts/src/runner/router/cost_preview.ts, loki-ts/tests/runner/cost_preview.test.ts | LOW | red: `cd loki-ts && bun test tests/runner/cost_preview.test.ts -t "unknown provider"` fails (exit 0); green: passes, claude, codex and a known model unchanged | released v11.17.48 | Gap: cost_preview.ts:151 stores any `--provider` value; start.ts:272 is the validating counterpart (VALID_PROVIDERS); confirm the run-history fixture prints a number for a bogus provider before filing the fix |
-| TEN-STABILITY-32 | fix: a set but unparseable LOKI_E10_CAP_S ("abc", "0", "-5") or loki.yaml budgets.run_cap_s is dropped by envCapS and yamlRunCapS and the 900s default silently applies in four readers; make the one helper return a warning once on stderr naming the bad value and the default used (never loosen the cap) | loki-ts/src/engine10/types.ts, loki-ts/src/util/run_cap.ts, loki-ts/tests/engine10/cap.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/engine10/cap.test.ts -t "invalid cap warns"` fails (no output); green: passes, valid values and the unset case print nothing | released v11.17.48 | Gap: types.ts:23 `Number.isFinite(n) && n > 0 ? n : null` with no diagnostic; consumers worker.ts:41, supervisor.ts:163, run_cap.ts:60 all read it; sibling of TEN-STABILITY-27 which covered only LOKI_E10_STALL_S |
-| TEN-STABILITY-33 | fix: `loki start ./prd.md --brief --yes` (and --prd, --completion-promise, --aider-model, --aider-flags, --cline-model) takes the next flag token as the value, so a forgotten value becomes a paid run on the text "--yes"; a value that starts with "-" or is empty must print one error naming the flag and exit 2 (use `--flag=-x` for a dash-leading value) | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/commands/start.test.ts -t "value flag swallows flag"` fails (parse succeeds with brief "--yes"); green: passes and `cd loki-ts && bunx tsc --noEmit` exits 0 | released v11.17.48 | Gap: start.ts:29 argVal returns args[i+1] with no flag-shape check; TEN-COST-36 only covered the six numeric flags; chain before TEN-UX-32 |
-| TEN-UX-32 | fix: `loki start ./a.md --prd ./b.md --brief "x"` silently picks --prd and drops the others; when two or more of positional spec, --prd and --brief are given with different values, print which one wins or refuse with exit 2 naming all of them; chain after TEN-STABILITY-33 | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/commands/start.test.ts -t "conflicting spec sources"` fails (exit 0); green: passes, a single source and `--prd` equal to the positional are unchanged | released v11.17.48 | Gap: start.ts `prdFlag ?? briefFlag ?? spec` precedence with no conflict check; chain after TEN-STABILITY-33 (same file) |
-| TEN-COST-43 | fix: `loki start prd.md --budget-limit 5 --budget 50` reads the first flag and silently drops the second, so the cap the user meant last can be the one ignored; differing values must print one error naming both flags and exit 2; chain after TEN-UX-32 | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/commands/start.test.ts -t "conflicting budget flags"` fails (cap 5 applied, no message); green: passes, equal values and a single flag unchanged | released v11.17.48 | Gap: start.ts `posNum(argVal(args, "--budget-limit") ?? argVal(args, "--budget"))`; chain after TEN-UX-32 (same file) |
-| TEN-DEPLOY-21 | fix: `loki start prd.md --deploy --destination prod`, `--auto-rollback` or `--health-match` without `--health-url`, and `--canary` with a non-production destination are only rejected by `loki deploy` AFTER the paid build finishes; reject them in deployFlagError before the run; chain after TEN-COST-43 | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/commands/start.test.ts -t "deploy flags fail before build"` fails (returns null for each case); green: passes, valid combinations unchanged | released v11.17.48 | Gap: start.ts deployFlagError checks only --health-url, --domain and --env-file; the destination enum, health-url requirement and canary rule live at autonomy/loki:11176-11256 and run after cmd_start (autonomy/loki:2733); chain after TEN-COST-43 (same file) |
-| TEN-DEPLOY-22 | fix: the bash `start` parser (autonomy/loki `_ps_*`) has the same late validation for `--destination`, `--health-match`/`--auto-rollback` without `--health-url`, and `--canary` with a non-production destination; copy the three checks next to the existing "apply only with --deploy" guard so the bash route fails before cmd_start | autonomy/loki, tests/test-deploy.sh | MEDIUM | red: add cases to tests/test-deploy.sh that run `loki start --deploy --destination prod` and expect exit 2 before any start output; `bash tests/test-deploy.sh` fails; green: passes | released v11.17.48 | Gap: autonomy/loki:2696 checks only that deploy flags need --deploy; enum and pairing checks sit in cmd_deploy at 11176 and 11245-11256; message text must match cmd_deploy so one doc covers both |
-| TEN-STABILITY-34 | fix: `loki queue list --bogus`, `queue clear extra` and `queue run --bogus` ignore unknown flags and extra args (queueRun only looks for --no-pr and --max-total-cost); reject with the usage line and exit 2, so a mistyped --no-pr cannot open PRs | loki-ts/src/commands/queue.ts, loki-ts/tests/commands/queue.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/queue.test.ts -t "unknown flag"` fails (exit 0); green: passes, valid forms unchanged | released v11.17.48 | Gap: queue.ts:262 `args.includes("--no-pr")` with no allow-list; queueList(d) and queueClear(d) are called without their args at queue.ts:475-481; sibling of TEN-DEPLOY-16 |
-| TEN-ADOPTION-25 | feature: `loki queue list --json` printing the queued refs as a JSON array so scripts and editors can read the queue; plain output stays byte identical; chain after TEN-STABILITY-34 | loki-ts/src/commands/queue.ts, loki-ts/tests/commands/queue.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/queue.test.ts -t "list json"` fails (unknown flag); green: passes, text output golden unchanged | released v11.17.48 | Gap: queue.ts has no --json for list (the only --json at :353 is the usage governor call); chain after TEN-STABILITY-34 (same file) |
-| TEN-STABILITY-35 | fix: preflight passes a git repo with no commits (git init, nothing committed) and the run then dies inside worktree creation with a raw "invalid reference: HEAD"; add a HEAD check and the fatal line `repository has no commits; run: git add . && git commit -m init` | loki-ts/src/engine10/preflight.ts, loki-ts/tests/engine10/preflight.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/engine10/preflight.test.ts -t "no commits"` fails (fatal is null); green: passes, a repo with one commit and the empty-folder auto-init path unchanged | released v11.17.48 | Gap: preflight.ts checks only `rev-parse --is-inside-work-tree` and the git identity; first_run_repo.ts:11 even tells a non-empty folder user to run `git init` first, which leaves exactly this state |
-| TEN-STABILITY-36 | enhancement: preflight has no free-disk check, so a full volume fails mid-run in worktree or event-log writes; warn under 2 GB free and refuse under 200 MB on the repo volume with a message naming the volume, reuse statfsSync like the doctor disk check; chain after TEN-STABILITY-35 | loki-ts/src/engine10/preflight.ts, loki-ts/tests/engine10/preflight.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/engine10/preflight.test.ts -t "low disk"` fails (no warning, injected statfs ignored); green: passes, normal disk prints nothing | released v11.17.48 | Gap: no statfs in src/engine10; doctor.ts:405 already computes it for `loki doctor`; thresholds overridable by LOKI_MIN_FREE_MB; chain after TEN-STABILITY-35 (same file) |
-| TEN-SPEED-14 | enhancement: checkPreflight awaits `rev-parse` before it starts the two `git config` reads; start all three together and re-run the work-tree check only when auto-init ran, saving one git spawn on every `loki start`; chain after TEN-STABILITY-36 | loki-ts/src/engine10/preflight.ts, loki-ts/tests/engine10/preflight.test.ts | LOW | red: `cd loki-ts && bun test tests/engine10/preflight.test.ts -t "parallel git reads"` fails (spawn order is serial); green: passes, every existing preflight verdict and message unchanged | released v11.17.48 | Gap: preflight.ts `let wt0 = await git(...)` then `Promise.all([Promise.resolve(wt0), git(name), git(email)])`; chain after TEN-STABILITY-36 (same file) |
-| TEN-SPEED-13 | enhancement: buildTestMap walks the whole tree with readdirSync minus a skip list, which is slow on a large monorepo; take the file list from `git ls-files` (safe_git) with the walk as the fallback outside a repo, same sorted output | loki-ts/src/engine10/testmap.ts, loki-ts/tests/engine10/testmap.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/engine10/testmap.test.ts -t "tracked files only"` fails (an ignored node_modules-like dir is walked); green: passes, existing fixtures give the same map | released v11.17.48 | Gap: testmap.ts:66 carries the author note "full recursive walk ... use git ls-files if a huge monorepo makes this slow"; untracked-but-ignored dirs not in SKIP_DIRS are walked today |
-| TEN-STABILITY-37 | fix: engine10 supervisor main() pushes every unrecognised token into the task words, so `loki "fix the bug" --no-prr` or `--dry-run` becomes part of the paid task text; reject unknown dash-leading tokens with a usage line and exit 2, and honour `--` as the end of options | loki-ts/src/engine10/supervisor.ts, loki-ts/tests/engine10/spec_first_intent.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/engine10/spec_first_intent.test.ts -t "unknown flag"` fails (task contains the flag); green: passes, tasks without flags and `-- -weird task` unchanged | released v11.17.48 | Gap: supervisor.ts:255-262 final `else words.push(a)`; the start route (engineArgv) only emits known flags, so the direct `loki "<task>"` entry is the exposed one |
-| TEN-UX-33 | fix: supervisor `--provider` with no value or a flag-shaped value keeps the env provider or takes the next flag as the provider name; print "--provider needs a value" and exit 2; chain after TEN-STABILITY-37 | loki-ts/src/engine10/supervisor.ts, loki-ts/tests/engine10/spec_first_intent.test.ts | LOW | red: `cd loki-ts && bun test tests/engine10/spec_first_intent.test.ts -t "provider needs a value"` fails; green: passes, `--provider codex` unchanged | released v11.17.48 | Gap: supervisor.ts:254 `provider = args[++i] ?? provider`; chain after TEN-STABILITY-37 (same file) |
-| TEN-STABILITY-38 | fix: supervisor treats any token starting with `--max-cost` as the cap flag, so `--max-costly` or `--max-cost5` slices garbage (`a.slice(11)`) or swallows the next token; match `--max-cost` exactly or `--max-cost=`; chain after TEN-UX-33 | loki-ts/src/engine10/supervisor.ts, loki-ts/tests/engine10/spec_first_intent.test.ts | LOW | red: `cd loki-ts && bun test tests/engine10/spec_first_intent.test.ts -t "max-cost prefix"` fails; green: passes, `--max-cost 5` and `--max-cost=5` unchanged | released v11.17.48 | Gap: supervisor.ts:253 `a.startsWith("--max-cost")`; chain after TEN-UX-33 (same file) |
-| TEN-UX-30 | fix: `loki stats --bogus` is ignored and prints stats with exit 0 on the TS route and in bash; reject unknown flags with one line and exit 2 on both routes (--json, --efficiency, --help stay) | loki-ts/src/commands/stats.ts, loki-ts/tests/commands/stats.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/stats.test.ts -t "unknown flag"` fails (exit 0); green: passes and `bun test tests/commands/stats.test.ts` stays green; if a bash-parity test pins the old exit 0, update it in the same change | released v11.17.48 | Gap: stats.ts:473 comment "unknown flags ignored to match bash behavior"; observed `loki stats --bogus` prints the session table and exits 0; a mistyped --json silently gives text |
-| TEN-UX-31 | fix: `loki version --bogus` prints the version and exits 0; reject an unknown flag with a usage line and exit 2 (--json, --help, -h, help stay) | loki-ts/src/commands/version.ts, loki-ts/tests/commands/version.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/version.test.ts -t "unknown flag"` fails (exit 0); green: passes, plain output byte identical | released v11.17.48 | Gap: version.ts:17-27 reads only --json and the help words; observed `loki version --bogus` prints `Loki Mode v11.17.46` exit 0; seed from the sibling sweep of TEN-UX-20 |
-| TEN-UX-36 | fix: `loki status run-a run-b` reports "unknown flag run-b" for a second run id and the usage line omits [run-id]; print "too many arguments: expected one run id" with the full usage and exit 1 | loki-ts/src/commands/run_status.ts, loki-ts/tests/commands/run_status.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/run_status.test.ts -t "second run id"` fails (message says unknown flag); green: passes, one run id and --json unchanged | released v11.17.48 | Gap: run_status.ts:143 shares one else branch for extra positionals and flags and prints `Usage: loki status [--json]` |
-| TEN-UX-34 | fix: `loki answer --text` with no value silently falls through to the saved Control Plane answer (or "no answer"), so a forgotten value answers with stale text; print "--text needs a value" and exit 2 | loki-ts/src/features/blocked_answer.ts, loki-ts/tests/features/blocked_answer.test.ts | LOW | red: `cd loki-ts && bun test tests/features/blocked_answer.test.ts -t "text needs a value"` fails; green: passes, `--text "x"`, `--text=x` and the file path unchanged | released v11.17.48 | Gap: blocked_answer.ts:63 `text = args[++i]` stores undefined, then `text ?? readAnswerFile(...)` at :70 |
-| TEN-SECURITY-12 | fix: loadSigningKey returns null with no word when LOKI_RECEIPT_SIGNING_KEY_FILE points at an unreadable file, a malformed PEM or a non-ed25519 key, so the run seals an UNSIGNED receipt and the user never learns why; return a reason (file unreadable, not a PEM, not ed25519) that the seal step prints on one stderr line, never the key bytes, and keep the receipt UNSIGNED, never invent a signature | loki-ts/src/util/receipt_signer.ts, loki-ts/tests/engine10/seal_verify_roundtrip.test.ts | HIGH | red: `cd loki-ts && bun test tests/engine10/seal_verify_roundtrip.test.ts -t "unusable signing key names the reason"` fails (no reason, no stderr line); green: passes, the default generated key and a valid explicit key sign exactly as before | released v11.17.48 | Gap: receipt_signer.ts:57-59 outer `catch { return null; }` and :50 `k.asymmetricKeyType === "ed25519" ? k : null` collapse every failure into the same UNSIGNED result; HIGH because it is the Seal; reviewers must confirm no key material reaches the message |
-| TEN-SPEED-15 | enhancement: collectToolchain spawns `node`, `python3` and `git --version` serially with spawnSync on every seal; memoize the result per process (tools do not change inside one run) and run the probes together, receipt body unchanged; chain after TEN-SECURITY-12 | loki-ts/src/util/receipt_signer.ts, loki-ts/tests/engine10/seal_verify_roundtrip.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/engine10/seal_verify_roundtrip.test.ts -t "toolchain probed once"` fails (probe called per seal); green: passes, toolchain fields identical in the receipt | released v11.17.48 | Gap: receipt_signer.ts:75-80 toolVersion uses spawnSync with a 5s timeout per tool and collectToolchain has no cache; chain after TEN-SECURITY-12 (same file) |
-| TEN-GATES-25 | fix: `loki verify --bogus` and `loki verify run-a run-b` treat the first token as the run id, so a typo yields a misleading "no such receipt" style verdict and extra ids are ignored; reject unknown dash-leading flags and more than one positional with a usage line and exit 2, never change any verdict exit code | loki-ts/src/engine10/verify_cmd.ts, loki-ts/tests/engine10/verify_cmd.test.ts | HIGH | red: `cd loki-ts && bun test tests/engine10/verify_cmd.test.ts -t "unknown flag and extra id"` fails; green: passes and the whole verify_cmd suite stays green (exit 0/1/2/3/4/66 mapping unchanged) | released v11.17.48 | Gap: verify_cmd.ts verifyMain strips known flags then uses `args[0] ?? latestRunId(...)` with no leftover check; HIGH because it is the verifier front door and a wrong exit here is a false-green risk |
-| TEN-GATES-26 | feature: `loki verify [run-id] --json` printing {run, verdict, receipt_sha256, reasons, agent_independent:{k,of}} on stdout so CI can gate without scraping text; exit codes unchanged and the text output stays byte identical without the flag; chain after TEN-GATES-25 | loki-ts/src/engine10/verify_cmd.ts, loki-ts/tests/engine10/verify_cmd.test.ts | HIGH | red: `cd loki-ts && bun test tests/engine10/verify_cmd.test.ts -t "verify json"` fails (unknown flag); green: passes, golden text output unchanged | released v11.17.48 | Gap: verify_cmd.ts has no --json (verify-pr has one, TEN-GATES-21); independentLine() already computes k and the pass count; chain after TEN-GATES-25 (same file) |
-| TEN-ADOPTION-24 | feature: `loki wiki show --json` printing {section, content} (or all sections) so tooling can read the generated wiki without parsing text; text output unchanged | loki-ts/src/commands/wiki.ts, loki-ts/tests/commands/wiki.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/wiki.test.ts -t "show json"` fails (unknown option); green: passes, text golden unchanged | released v11.17.48 | Gap: wiki.ts:55 rejects every dash token except --help and there is no json path; wiki.ts has 0 --json occurrences |
-| TEN-ADOPTION-26 | feature: `loki issues run --dry-run --json` printing the triage decision per issue (number, decision, reason, covered_by_pr) so CI can review the plan before any paid run | loki-ts/src/commands/issues_run.ts, loki-ts/tests/commands/issues_run.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/issues_run.test.ts -t "dry run json"` fails (unexpected argument: --json); green: passes, the text table unchanged | released v11.17.48 | Gap: issues_run.ts:82-99 arg loop has no --json; triage results (`t.decision`, `t.reason`) and coveredIssues() already exist at :262-290 and :104 |
-| TEN-COST-35 | fix: `loki start --budget-limit=5` (and --provider=, --session-model=, --prd=, --brief=) is accepted by the flag validator then silently ignored, so the default $100 cap and default provider apply; read the `=` form everywhere argVal reads a flag | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | MEDIUM | red: bun test tests/commands/start.test.ts -t "equals form" fails (cap stays default); green: same test passes and `cd loki-ts && bunx tsc --noEmit` exits 0 | released v11.17.44 | Gap: start.ts:23 argVal matches only exact args via indexOf; start.ts:212 validator splits on "=" so the form is accepted; only --cost and --attempts parse "=" |
-| TEN-COST-36 | fix: `loki start --budget-limit abc`, `--max-iterations -1`, `--budget-limit 0x` and a trailing value flag with no value are silently dropped so the default cap applies; print one error line naming the flag and exit 2 | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | MEDIUM | red: bun test tests/commands/start.test.ts -t "invalid numeric" fails (exit 0, no message); green: passes, valid values unchanged | released v11.17.44 | Gap: start.ts:123 posNum returns undefined for non-numeric, zero or negative with no diagnostic; chain after TEN-COST-35 |
-| TEN-STABILITY-21 | fix: control `--port` with no value or a non-numeric value silently falls back to the default port; reject with a usage line and exit 2 | loki-ts/src/commands/control.ts, loki-ts/tests/commands/control.test.ts | LOW | red: bun test tests/commands/control.test.ts -t "port without value" fails; green: passes and existing control tests stay green | released v11.17.44 | Gap: control.ts:33 flag() returns args[i+1] unchecked (undefined or the next flag) and callers fall through to the default |
-| TEN-SECURITY-08 | fix: `loki status <run-id>` and `loki intent show <id>` join the user id into a path with no id check, so `../..` reads an events.jsonl outside .loki/runs; validate against the same RUN_ID_RE as undo and exit 2 | loki-ts/src/commands/run_status.ts, loki-ts/tests/commands/run_status.test.ts | HIGH | red: bun test tests/commands/run_status.test.ts -t "traversal" fails (reads the planted file); green: passes, exit 2 with "invalid run id" | released v11.17.44 | Gap: run_status.ts:50 eventsPath and :148 readEvents(eventsPath(root, wanted)) take wanted unchecked; undo.ts defines RUN_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]*$/ (reuse it, do not copy) |
-| TEN-STABILITY-22 | fix: `loki pause|cancel` prints "requested" for a run whose supervisor pid is dead and targets latestRunId instead of the live run; refuse with "no live run" and exit 1 when run_pid says the owner is gone | loki-ts/src/commands/run_status.ts, loki-ts/tests/commands/run_status.test.ts | MEDIUM | released v11.17.44 | ready@2026-10-17T10:00Z | Gap: run_status.ts:189 runControlVerb never calls runOwnerAlive from util/run_pid.ts; chain after TEN-SECURITY-08 |
-| TEN-UX-20 | fix: `loki provider frobnicate` prints the help text and exits 0, so scripts and typos look like success; unknown subcommand prints one error line plus help and exits 2 (help, -h, --help stay exit 0) | loki-ts/src/commands/provider.ts, loki-ts/tests/commands/provider.test.ts | LOW | red: bun test tests/commands/provider.test.ts -t "unknown subcommand" fails (exit 0); green: passes, and `bash autonomy/loki provider frobnicate` behavior is checked and the Bun route matches or the bash arm is noted in the PR | released v11.17.44 | Gap: provider.ts:161 default case returns printProviderHelp() which returns 0 |
-| TEN-DEPLOY-16 | fix: `loki rollback list --bogus` and `rollback to <id> --bogus` ignore unknown flags, so a mistyped safety flag (for example --dry-run spelled wrong) runs the real rollback; reject unknown flags with exit 2 | loki-ts/src/commands/rollback.ts, loki-ts/tests/commands/rollback.test.ts | MEDIUM | red: bun test tests/commands/rollback.test.ts -t "unknown flag" fails; green: passes, valid invocations unchanged | released v11.17.44 | Gap: rollback.ts:120 rejects only unknown subcommands; no flag check on to, latest or list |
-| TEN-COST-37 | fix: a set but unparseable LOKI_BUDGET_LIMIT (for example "5usd") or loki.yaml budgets.per_run is skipped without a warning and the $100 default silently applies; return the existing {error} form so the run refuses to start (0 stays a valid no-cap value) | loki-ts/src/e10ext/budget_cap.ts, loki-ts/tests/engine10/budget_cap.test.ts | MEDIUM | red: bun test tests/engine10/budget_cap.test.ts -t "unparseable" fails; green: passes, all existing cases green, net line change in engine10 core is zero (e10ext is outside it) | released v11.17.44 | Gap: budget_cap.ts:20 resolveCap falls through on NaN for env and yaml sources with no error or note |
-| TEN-UX-21 | fix: run summary color ignores the NO_COLOR convention inconsistently: useColor treats NO_COLOR="" as set (disables color) while util/colors.ts treats empty as unset, and neither honors TERM=dumb; make both read one rule (non-empty NO_COLOR or TERM=dumb disables) | loki-ts/src/util/run_summary.ts, loki-ts/src/util/colors.ts, loki-ts/tests/util/run_summary.test.ts | LOW | red: bun test tests/util/run_summary.test.ts -t "NO_COLOR empty" fails; green: passes and `bun test tests/util` stays green | released v11.17.44 | Gap: run_summary.ts:75 `env.NO_COLOR === undefined` vs colors.ts:9 `.length > 0`; grep TERM in both files returns 0 hits |
-| TEN-STABILITY-23 | fix: LOKI_E10_DASHBOARD_PORT="abc", "" or 70000 reaches Bun.serve as NaN, 0 (random port) or out of range; validate 1-65535, else print the bad value and fall back to the default port with a one-line note | loki-ts/src/runner/engine10_dashboard.ts, loki-ts/tests/engine10/dashboard_entry.test.ts | LOW | red: bun test tests/engine10/dashboard_entry.test.ts -t "bad port env" fails; green: passes, default behavior unchanged | released v11.17.44 | Gap: engine10_dashboard.ts:330 `Number(process.env["LOKI_E10_DASHBOARD_PORT"] ?? DEFAULT_PORT)` has no range or NaN check |
-| TEN-QUALITY-19 | fix: two different long tasks that share their first 40 slug characters map to one .loki/specs/<slug>.md and one spec-<slug> run dir, so the second task fails with "spec exists" or reuses the first task's edited spec; append a short task hash when the slug was truncated | loki-ts/src/util/spec_file.ts, loki-ts/tests/engine10/spec_first_intent.test.ts | MEDIUM | red: bun test tests/engine10/spec_first_intent.test.ts -t "long task collision" fails; green: passes, short-task slugs unchanged byte for byte | released v11.17.44 | Gap: spec_file.ts:29 slugify slices to 40 chars with no disambiguator; generateSpec uses it for both the path and the run dir |
-| TEN-UX-22 | fix: `loki memory brief --task` with no value silently briefs for an empty task; print usage and exit 2 | loki-ts/src/commands/memory.ts, loki-ts/tests/commands/memory.test.ts | LOW | red: bun test tests/commands/memory.test.ts -t "brief without task" fails; green: passes, `brief --task "x"` output unchanged | released v11.17.44 | Gap: memory.ts:123 `argv[i + 1] ?? ""` accepts a missing value |
-| TEN-QUALITY-20 | fix: `loki wiki show architecture modules` silently shows only the last section named; reject a second positional with a usage error and exit 1 | loki-ts/src/commands/wiki.ts, loki-ts/tests/commands/wiki.test.ts | LOW | red: bun test tests/commands/wiki.test.ts -t "two sections" fails; green: passes, single section output unchanged | released v11.17.44 | Gap: wiki.ts:59 `section = a` overwrites on each positional |
-| TEN-ADOPTION-16 | feature: `--json` for the control status verb so scripts can read running, pid, port and url without parsing text | loki-ts/src/commands/control.ts, loki-ts/tests/commands/control.test.ts | LOW | red: bun test tests/commands/control.test.ts -t "status json" fails; green: passes, text output byte identical | released v11.17.44 | Gap: grep -c '"--json"' loki-ts/src/commands/control.ts returns 0; chain after TEN-STABILITY-21 |
-| TEN-ADOPTION-17 | feature: `loki provider list --json` printing name, tier, installed and version per provider for CI and editor integrations | loki-ts/src/commands/provider.ts, loki-ts/tests/commands/provider.test.ts | LOW | red: bun test tests/commands/provider.test.ts -t "list json" fails; green: passes, plain `provider list` unchanged | released v11.17.44 | Gap: provider.ts has a single "--json" mention and none on the list arm; chain after TEN-UX-20 |
-| TEN-DEPLOY-17 | feature: `loki rollback list --json` so deploy automation can pick a rollback target without scraping text | loki-ts/src/commands/rollback.ts, loki-ts/tests/commands/rollback.test.ts | LOW | red: bun test tests/commands/rollback.test.ts -t "list json" fails; green: passes, text output byte identical | released v11.17.44 | Gap: grep -c '"--json"' loki-ts/src/commands/rollback.ts returns 0; chain after TEN-DEPLOY-16 |
-| TEN-ADOPTION-18 | feature: `loki version --json` printing {version, runtime, install_path}; plain `loki version` output stays byte identical to bash | loki-ts/src/commands/version.ts, loki-ts/tests/commands/version.test.ts | LOW | red: bun test tests/commands/version.test.ts -t "version json" fails; green: passes including the existing byte parity test | released v11.17.44 | Gap: version.ts:12 lines, runVersion() takes no args and the file has no "--json" |
-| TEN-ADOPTION-19 | feature: `loki crash list --json` (and `crash --json`) emitting id, captured_at, error_class, fingerprint for tooling | loki-ts/src/commands/crash.ts, loki-ts/tests/commands/crash.test.ts | LOW | red: bun test tests/commands/crash.test.ts -t "list json" fails; green: passes, text list unchanged | released v11.17.44 | Gap: crash.ts listCrashes prints a padded table only; grep -c '"--json"' returns 0 |
-| TEN-GATES-21 | feature: `loki verify-pr <ref> --json` printing the verify-pr-result.json verdict object on stdout (the file is already written) so CI can gate on it without reading disk | loki-ts/src/commands/verify_pr.ts, loki-ts/tests/commands/verify_pr.test.ts | MEDIUM | red: bun test tests/commands/verify_pr.test.ts -t "json stdout" fails; green: passes, exit codes 0/2/4 unchanged | released v11.17.44 | Gap: verify_pr.ts runVerifyPr handles only --out and --help and treats --json as an extra positional (usage error, exit 2) |
-| TEN-ADOPTION-20 | feature: `loki memory list --json` returning the pattern, mistake and success counts and learnings path | loki-ts/src/commands/memory.ts, loki-ts/tests/commands/memory.test.ts | LOW | red: bun test tests/commands/memory.test.ts -t "list json" fails; green: passes, text output unchanged | released v11.17.44 | Gap: memory.ts runMemoryList() takes no args; only `lessons` has --json; chain after TEN-UX-22 |
-| TEN-SECURITY-09 | enhancement: SARIF secret scan misses hyphenated and common vendor keys (sk-ant-api03-..., sk-proj-..., npm_..., sk_live_..., JWT); extend SECRET_PATTERNS with one fixture each and a no-false-positive fixture | loki-ts/src/commands/export_sarif.ts, loki-ts/tests/commands/export_sarif.test.ts | HIGH | red: bun test tests/commands/export_sarif.test.ts -t "vendor keys" fails (0 findings); green: passes and clean fixtures still report 0 | released v11.17.44 | Gap: export_sarif.ts:11 `openai-style-key: /sk-[A-Za-z0-9]{20,}/` stops at the first hyphen so sk-ant-api03-XXXX is not matched; no npm_, Stripe or JWT pattern |
-| TEN-SECURITY-10 | enhancement: redact() leaves SendGrid (SG.), Twilio (SK + 32 hex), Docker (dckr_pat_), DigitalOcean (dop_v1_) and Google OAuth (ya29.) tokens in logs and receipts; add anchored patterns with a positive and a near-miss fixture each | loki-ts/src/util/redact.ts, loki-ts/tests/util/redact.test.ts | HIGH | red: bun test tests/util/redact.test.ts -t "vendor tokens" fails; green: passes, existing redact tests and `bun test tests/util` green | released v11.17.44 | Gap: grep -n 'SG\\.' loki-ts/src/util/redact.ts returns 0 hits; same for dckr_pat_, dop_v1_, ya29 |
-| TEN-ADOPTION-21 | enhancement: update nudge ignores LOKI_NO_UPDATE_CHECK=true and always suggests `bun install -g loki-mode` even for npm or brew installs; accept 1/true/yes and pick the hint from the install path | loki-ts/src/util/update_check.ts, loki-ts/tests/util/update_check.test.ts | LOW | red: bun test tests/util/update_check.test.ts -t "opt out true" fails; green: passes, default hint unchanged for bun installs | released v11.17.44 | Gap: update_check.ts:62 `=== "1"` only; :286 hint string is fixed |
-| TEN-STABILITY-24 | enhancement: provider failover does not recognize HTTP 529, insufficient_quota, "quota exceeded", RESOURCE_EXHAUSTED or ETIMEDOUT, so those provider failures stall instead of failing over; extend RATE_LIMIT and OUTAGE with a fixture per marker and a non-match for plain app text | loki-ts/src/runner/provider_failover.ts, loki-ts/tests/engine10/failover.test.ts | MEDIUM | red: bun test tests/engine10/failover.test.ts -t "529 and quota" fails; green: passes, existing failover and failover_receipt tests green | released v11.17.44 | Gap: provider_failover.ts:18-19 RATE_LIMIT/OUTAGE list 429 and 502-504 only |
-| TEN-QUALITY-21 | enhancement: runner error classifier does not recognize the unittest load failure `ImportError: Failed to import test module`, so a broken test module reads as a code failure instead of a load error; add the pattern with a fixture | loki-ts/src/runner/runner_errors.ts, loki-ts/tests/engine10/runner_errors.test.ts | LOW | red: bun test tests/engine10/runner_errors.test.ts -t "unittest import" fails; green: passes, existing patterns unchanged | released v11.17.44 | Gap: runner_errors.ts:24 LOAD_PATTERNS has no unittest "Failed to import test module" entry |
-| TEN-DEPLOY-18 | enhancement: `loki rollback deploy` knows only vercel, fly, netlify and wrangler; add heroku (`heroku releases:rollback`), railway and render manual notes, and a gcloud run revisions hint, each read only (never run) | loki-ts/src/commands/rollback.ts, loki-ts/tests/commands/rollback.test.ts | LOW | red: bun test tests/commands/rollback.test.ts -t "more providers" fails (prints "No rollback command known"); green: passes, existing four unchanged | released v11.17.44 | Gap: rollback.ts:173 DEPLOY_ROLLBACKS has four prefixes; chain after TEN-DEPLOY-17 |
-| TEN-COST-38 | enhancement: retry classifier treats OpenAI's "You exceeded your current quota" and Gemini RESOURCE_EXHAUSTED billing text as retryable, burning retries (and cost) on an account that is out of funds; add to quota_exhausted with a fixture and keep rate limit wording transient | loki-ts/src/runner/retry_class.ts, loki-ts/tests/runner/retry_class.test.ts | MEDIUM | red: bun test tests/runner/retry_class.test.ts -t "exceeded current quota" fails; green: passes, TRANSIENT_OVERRIDE cases unchanged | released v11.17.44 | Gap: retry_class.ts:53 quota_exhausted matches insufficient quota/credit/funds and billing only |
-| TEN-STABILITY-25 | enhancement: retry classifier lacks HTTP 529 (Anthropic overloaded status) and "bad gateway"/"gateway timeout" words in TRANSIENT_OVERRIDE, so a 529 body that also carries permanent-looking text can be classed non-retryable | loki-ts/src/runner/retry_class.ts, loki-ts/tests/runner/retry_class.test.ts | MEDIUM | red: bun test tests/runner/retry_class.test.ts -t "529" fails; green: passes | released v11.17.44 | Gap: retry_class.ts:61 lists 502, 503, 504 but not 529; chain after TEN-COST-38 |
-| TEN-SPEED-09 | enhancement: unit mode silently drops its cost cap when LOKI_UNIT_USD_PER_MTOK is invalid (NaN, 0, negative); emit a NOT PROVEN style note so the user sees the cap was not applied, never loosen the existing cap | loki-ts/src/features/speed/unit_mode.ts, loki-ts/tests/e10ext/unit_mode.test.ts | MEDIUM | red: bun test tests/e10ext/unit_mode.test.ts -t "invalid rate note" fails; green: passes, valid rate output byte identical | released v11.17.44 | Gap: unit_mode.ts:83 returns the existing cap or {} for a non-finite rate with no note; unit_mode.ts:107 parses Number(env) unchecked |
-| TEN-UX-23 | fix: `loki crash show <id> extra` and `crash submit <id> extra` silently ignore extra args, and `crash list --foo` lists anyway; reject extra args with a usage line and exit 2 | loki-ts/src/commands/crash.ts, loki-ts/tests/commands/crash.test.ts | LOW | red: bun test tests/commands/crash.test.ts -t "extra args" fails; green: passes, single-arg forms unchanged | released v11.17.44 | Gap: crash.ts runCrash passes argv[1] only and ignores the rest; chain after TEN-ADOPTION-19 |
-| TEN-SECURITY-04 | fix: redactSecrets also strips GitLab (glpat-), npm (npm_), Hugging Face (hf_), Stripe (sk_live_, rk_live_) tokens and PEM private key blocks | loki-ts/src/util/redact.ts, loki-ts/tests/util/redact.test.ts | HIGH | red: each of the five token shapes and a -----BEGIN PRIVATE KEY----- block survive redactSecrets; green: all replaced with [REDACTED:...] markers, existing rules and ordering unchanged; cd loki-ts && bunx tsc --noEmit && bun test tests/util/redact.test.ts | released v11.17.40 | Gap: redact.ts RULES (lines 3-14) cover Anthropic, GitHub, Slack, AWS, JWT, Google, OpenAI, Bearer, URL userinfo; grep -rnE 'glpat or npm_ or hf_ or BEGIN [A-Z ]*PRIVATE or sk_live' loki-ts/src/util/redact.ts returned 0 hits (export_sarif.ts:18 and contrib/ai_bom.ts:83 know the shapes but are not the redactor). Specific rules before generic, keep ReDoS-safe quantifiers. |
-| TEN-SECURITY-05 | enhancement: redactSecrets strips secret query parameters (token, access_token, api_key, apikey, password, secret, sig) from URLs in logged and receipted output | loki-ts/src/util/redact.ts, loki-ts/tests/util/redact.test.ts | HIGH | red: https://h/x?access_token=abc123 survives; green: value replaced, parameter name and other params kept, non-secret params untouched; cd loki-ts && bunx tsc --noEmit && bun test tests/util/redact.test.ts | released v11.17.41 | Gap: TEN-SECURITY-02 covers URL userinfo and Authorization only (redact.ts:12-13); grep -nE 'access_token or api_key or \?' loki-ts/src/util/redact.ts returned 0 query-string rules. Serialize after TEN-SECURITY-04 (same two files). |
-| TEN-SECURITY-06 | feature: secure-scan rule 6 flags disabled TLS verification in committed code (verify=False, rejectUnauthorized: false, InsecureSkipVerify: true, NODE_TLS_REJECT_UNAUTHORIZED=0) | autonomy/lib/secure-scan.py, tests/test-secure-scan.sh | HIGH | red: a fixture with requests.get(url, verify=False) scans clean; green: finding rule tls-verify-disabled with file and line, test and fixture paths and comments excluded like rule 4; bash tests/test-secure-scan.sh | released v11.17.41 | Gap: secure-scan.py has rules 1-5 only (rule comments at lines 93, 105, 193, 238, 345); grep -nE 'verify=False or rejectUnauthorized or InsecureSkipVerify or NODE_TLS' autonomy/lib/secure-scan.py returned 0 hits. Bump RULES_VERSION (line 49). Serialize after TEN-GATES-20 and before TEN-SECURITY-07. |
-| TEN-SECURITY-07 | feature: secure-scan rule 7 flags shell injection shapes (subprocess with shell=True and an f-string or format argument, os.system with concatenation, child_process.exec with a template literal) | autonomy/lib/secure-scan.py, tests/test-secure-scan.sh | HIGH | red: subprocess.run(f"rm {x}", shell=True) scans clean; green: finding rule shell-injection with file and line, constant-string commands and test paths not flagged; bash tests/test-secure-scan.sh | released v11.17.44 | Gap: grep -nE 'shell=True or os\.system or child_process' autonomy/lib/secure-scan.py returned 0 hits. Precision first (the file's stated design: literal forms only), measure false positives on this repo's own tests before shipping. Serialize after TEN-SECURITY-06. |
-| TEN-SECURITY-13 | enhancement: redactSecrets also strips PyPI (pypi-AgEI...), Shopify (shpat_), Postman (PMAK-), Databricks (dapi + 32 hex) and Mailgun (key- + 32 hex) tokens | loki-ts/src/util/redact.ts, loki-ts/tests/util/redact.test.ts | HIGH | red: each of the five shapes survives redactSecrets; green: replaced with [REDACTED:...] markers, existing rules, ordering and the fixpoint loop unchanged; cd loki-ts && bun test tests/util/redact.test.ts -t "vendor tokens" | released v11.17.50 | Gap: grep -cE 'pypi-/shpat_/PMAK/dapi/key-' loki-ts/src/util/redact.ts returned 0 (RULES lines 3-22 stop at Stripe and PEM). Anchor each shape with a length and boundary so ordinary words never match. |
-| TEN-SECURITY-14 | enhancement: secure-scan.py _SECRET_PATTERNS (rule 2 and the pre-PR added-line scan) lacks GitLab glpat-, npm_, Hugging Face hf_, Stripe sk_live_/rk_live_ and SendGrid SG. shapes that export_sarif.ts and secret-scan.sh already know, so a key added in a PR passes the Seal scan | autonomy/lib/secure-scan.py, tests/test-secure-scan.sh | HIGH | red: a fixture with a glpat- token in a browser-served file scans clean; green: finding secret-in-client-file naming the kind for each shape, placeholders still excluded; bash tests/test-secure-scan.sh | released v11.17.50 | Gap: secure-scan.py:104-122 _SECRET_PATTERNS lists AWS, openai, github, anthropic, google, slack only; grep -nE 'glpat/npm_/hf_/sk_live/SG\.' autonomy/lib/secure-scan.py returned 0. Bump RULES_VERSION (line 49). Chain: same two files as TEN-SECURITY-15, do this first. |
-| TEN-SECURITY-15 | feature: secure-scan rule 8 flags a committed real env file (.env, .env.local, .env.production) that assigns a non-empty, non-placeholder value to a *_KEY, *_SECRET, *_TOKEN or *_PASSWORD name | autonomy/lib/secure-scan.py, tests/test-secure-scan.sh | HIGH | red: a fixture .env containing STRIPE_SECRET=abc123def456 scans clean; green: finding committed-env-secret with file and line, value never echoed, .env.example and .env.sample and empty values not flagged; bash tests/test-secure-scan.sh | released v11.17.50 | Gap: grep -n 'env' autonomy/lib/secure-scan.py shows only the .env.example exclusion (line 129) and rule 4's .env.production debug check (line 257); no rule inspects secret assignments in env files. Serialize after TEN-SECURITY-14. |
-| TEN-GATES-27 | fix: the Seal stage writes receipt.json and receipt.md with plain writeFileSync, so a kill mid-write leaves a truncated receipt that `loki verify` reads as unreadable; write both through util/atomic.ts | loki-ts/src/engine10/stages/seal.ts, loki-ts/tests/engine10/seal.test.ts | HIGH | red: cd loki-ts && bun test tests/engine10/seal.test.ts -t "atomic receipt" fails (a simulated write failure leaves a partial receipt.json); green: passes, receipt bytes and sha identical on the success path | released v11.17.50 | Gap: seal.ts:315-316 writeFileSync(path, ...) and writeFileSync(receipt.md); util/atomic.ts atomicWriteText exists and is unused here (grep -n atomic loki-ts/src/engine10/stages/seal.ts returned 0). |
-| TEN-GATES-28 | fix: `loki keys export extra --bogus` ignores everything after the verb; reject extra args and unknown flags with the usage line and exit 2 (export alone, --help and -h unchanged) | loki-ts/src/engine10/keys_cmd.ts, loki-ts/tests/engine10/verify_cmd.test.ts | LOW | red: cd loki-ts && bun test tests/engine10/verify_cmd.test.ts -t "keys export extra" fails (prints the key, exit 0); green: passes | released v11.17.50 | Gap: keys_cmd.ts main() reads args[0] only (line 16-19); takePubkey already rejects extras for verify but keys export never calls it. |
-| TEN-GATES-29 | fix: `loki verify-pr <ref> --out --json` takes `--json` as the output directory and creates a directory literally named --json; reject an --out value that starts with a dash or is missing, exit 2 with the usage line | loki-ts/src/commands/verify_pr.ts, loki-ts/tests/commands/verify_pr.test.ts | LOW | red: cd loki-ts && bun test tests/commands/verify_pr.test.ts -t "out needs a value" fails; green: passes, `--out DIR` unchanged | released v11.17.50 | Gap: verify_pr.ts:221-223 outDir = rest[oi + 1] ?? "" with no dash check (only empty string is refused at :227). |
-| TEN-COST-46 | fix: cost_claim.py accepts `--target nan`, 0 or a negative number; with nan the `hi > target` test is False so the verdict can read PROVEN_AT(nan); require a finite target greater than 0 and exit 2 otherwise | benchmarks/bench/cost_claim.py, benchmarks/bench/tests/test_cost_claim.py | MEDIUM | red: pytest benchmarks/bench/tests/test_cost_claim.py -q -k target_must_be_finite fails; green: passes, valid targets unchanged | released v11.17.50 | Gap: cost_claim.py:218 add_argument("--target", type=float) with no range check; :164 `if hi > target` is the only use. Chain: all COST-46..50 rows share cost_claim.py, run in order. |
-| TEN-COST-47 | fix: cost_claim.py with --loki-arm equal to --floor-arm compares an arm with itself (ratio 1.0) and can claim PROVEN at a target of 1.0 or more; refuse identical arm names with exit 2 | benchmarks/bench/cost_claim.py, benchmarks/bench/tests/test_cost_claim.py | MEDIUM | red: pytest benchmarks/bench/tests/test_cost_claim.py -q -k same_arm fails; green: passes | released v11.17.50 | Gap: cost_claim.py:233-234 filters both arms by arg equality with no distinctness check. Serialize after TEN-COST-46. |
-| TEN-COST-48 | enhancement: cost_claim.py checks engine and loki_version are single-valued but not the model, so a floor arm on one model and a loki arm on a cheaper one reads as a cost win; add a model reason (missing, or differing between arms or within an arm) to the NOT PROVEN reasons | benchmarks/bench/cost_claim.py, benchmarks/bench/tests/test_cost_claim.py | MEDIUM | red: pytest benchmarks/bench/tests/test_cost_claim.py -q -k model_mismatch fails; green: passes, equal-model fixtures keep their verdict | released v11.17.50 | Gap: grep -n model benchmarks/bench/cost_claim.py returned 0 although attribution.py:267 writes model on every row (the C-F1 pin). Serialize after TEN-COST-47. |
-| TEN-COST-49 | feature: cost_claim.py verdict names the loki arm's cost_profile (lean, default, off) and refuses a loki arm that mixes profiles, so a lean-profile cost claim versus Claude Code is explicit evidence rather than an inference | benchmarks/bench/cost_claim.py, benchmarks/bench/tests/test_cost_claim.py | MEDIUM | red: pytest benchmarks/bench/tests/test_cost_claim.py -q -k cost_profile fails (no cost_profile key in the verdict); green: passes, verdict gains cost_profile and a mixed arm adds a NOT PROVEN reason | released v11.17.52 | Gap: attribution.py:263 and :737 stamp cost_profile on loki rows but grep -n cost_profile benchmarks/bench/cost_claim.py returned 0. Serialize after TEN-COST-48. |
-| TEN-COST-50 | fix: `cost_claim.py --exclude-task typo` silently excludes nothing and still prints excluded_tasks, so a mistyped exclusion looks applied; warn on stderr for any excluded name that matches no row and list it as unmatched_exclusions in the verdict | benchmarks/bench/cost_claim.py, benchmarks/bench/tests/test_cost_claim.py | LOW | red: pytest benchmarks/bench/tests/test_cost_claim.py -q -k unmatched_exclusion fails; green: passes | released v11.17.52 | Gap: cost_claim.py:231 builds excl from the flag and :232 filters rows with no membership check. Serialize after TEN-COST-49. |
-| TEN-STABILITY-39 | enhancement: a non-numeric LOKI_PROVIDER_CALL_TIMEOUT (for example `2h`) silently disables the provider call timeout; print one stderr note naming the bad value and the 7200 default in effect, keep 0 as the deliberate no-timeout opt-out | loki-ts/src/runner/providers.ts, loki-ts/tests/runner/providers.test.ts | MEDIUM | red: cd loki-ts && bun test tests/runner/providers.test.ts -t "bad call timeout" fails (no note, timeout undefined); green: passes, unset and 0 behave as before | released v11.17.50 | Gap: providers.ts:543-547 treats NaN like 0 (comment: non-numeric means no timeout) with no message; a typo removes the safety cap on a paid call. |
-| TEN-STABILITY-40 | fix: a negative or garbage LOKI_QUEUE_ITEM_TIMEOUT_MIN kills every queued item at once (`Number(x) // 120` keeps a negative); accept only positive finite values and fall back to 120 with one stderr note | loki-ts/src/commands/queue.ts, loki-ts/tests/commands/queue.test.ts | LOW | red: cd loki-ts && bun test tests/commands/queue.test.ts -t "negative item timeout" fails; green: passes, valid values unchanged | released v11.17.50 | Gap: queue.ts:467 const mins = Number(process.env["LOKI_QUEUE_ITEM_TIMEOUT_MIN"]) // 120; setTimeout(proc.kill, mins * 60000) with mins -5 fires immediately. |
-| TEN-STABILITY-41 | fix: a negative LOKI_COUNCIL_REVIEW_TIMEOUT aborts the council review call immediately and the vote reads as a failure; accept only positive finite seconds, else 600 | loki-ts/src/council/voter_agents.ts, loki-ts/tests/council/voter_agents.test.ts | LOW | red: cd loki-ts && bun test tests/council/voter_agents.test.ts -t "negative review timeout" fails; green: passes | released v11.17.50 | Gap: voter_agents.ts:348 (Number(process.env["LOKI_COUNCIL_REVIEW_TIMEOUT"]) // 600) * 1000 keeps a negative number. |
-| TEN-STABILITY-42 | fix: a negative LOKI_SDK_REVIEW_TIMEOUT makes the SDK code review time out at once and skip the gate; accept only positive finite seconds, else 180 | loki-ts/src/runner/quality_gates.ts, loki-ts/tests/runner/quality_gates.test.ts | LOW | red: cd loki-ts && bun test tests/runner/quality_gates.test.ts -t "negative sdk review timeout" fails; green: passes | released v11.17.50 | Gap: quality_gates.ts:1679 (Number(process.env["LOKI_SDK_REVIEW_TIMEOUT"]) // 180) * 1000, same shape as TEN-STABILITY-41 but a different owner file. |
-| TEN-STABILITY-43 | fix: `loki memory lessons --jsno`, `memory list --bogus` and `memory brief --bogus` ignore unknown flags and print the default output; reject with a usage line and exit 2 (--json, --task, help unchanged) | loki-ts/src/commands/memory.ts, loki-ts/tests/commands/memory.test.ts | LOW | red: cd loki-ts && bun test tests/commands/memory.test.ts -t "unknown flag" fails; green: passes | released v11.17.50 | Gap: memory.ts:119, :128 and :144 test only includes("--json") or indexOf("--task"); no arm validates the rest. Other subcommands defer to bash and are out of scope. |
-| TEN-STABILITY-44 | fix: `loki control stop extra`, `control status --jsno` and `control status extra` ignore the surplus token; a mistyped --json prints the human form. Reject unknown flags and extra args with the usage line and exit 2 | loki-ts/src/commands/control.ts, loki-ts/tests/commands/control.test.ts | LOW | red: cd loki-ts && bun test tests/commands/control.test.ts -t "status extra args" fails; green: passes, --json and bare forms unchanged | released v11.17.50 | Gap: control.ts:154 args.includes("--json") only; the switch at :228-232 passes rest to status and calls stopControlPlane(env) with no arg check. |
-| TEN-STABILITY-45 | enhancement: the per-repo engine cache under ~/.loki/cache/v10 writes a repomap2-<tree>.json and testmap-<tree>.json for every tree hash and never removes old ones, so it grows without bound; after a write keep the newest 5 files of each kind and delete the rest | loki-ts/src/engine10/cache.ts, loki-ts/tests/engine10/cache.test.ts | MEDIUM | red: cd loki-ts && bun test tests/engine10/cache.test.ts -t "prunes old trees" fails (8 files remain after 8 writes); green: passes, hit and miss behavior unchanged, prune failure never throws | released v11.17.50 | Gap: grep -nE 'readdirSync/unlinkSync/rmSync' loki-ts/src/engine10/cache.ts returned 0; writeJson at :41 only mkdir and write. |
-| TEN-STABILITY-46 | fix: fetchIssue shells out to bash and gh with execFileSync and no timeout, so a hung gh or network stall blocks Intake forever; add a 60 second timeout and surface it as the existing fetch failure | loki-ts/src/engine10/fetch_issue.ts, loki-ts/tests/engine10/fetch_issue.test.ts (new: no test file owns fetch_issue.ts, grep -rl fetch_issue loki-ts/tests shows only allowlists) | MEDIUM | red: cd loki-ts && bun test tests/engine10/fetch_issue.test.ts -t "timeout" fails (defaultExec passes no timeout); green: passes, injected Execer path unchanged | released v11.17.50 | Gap: fetch_issue.ts:26-28 defaultExec = execFileSync(cmd, args, { encoding, env }) with no timeout option. |
-| TEN-STABILITY-47 | fix: loki doctor runs several spawnSync helpers (effective-provider, providers-json, providers, detect-sdk, python3 cryptography import, provider model and key probes) with no timeout, so one hung script freezes the whole doctor; add a 15 second timeout to each and report the check as skipped | loki-ts/src/commands/doctor.ts, loki-ts/tests/commands/doctor.test.ts | MEDIUM | red: cd loki-ts && bun test tests/commands/doctor.test.ts -t "hung helper" fails; green: passes, fast helpers byte identical | released v11.17.50 | Gap: doctor.ts:646, :799, :821, :1324, :1595, :1918, :1924 spawnSync without timeout (only :1046 and :1979 set one). |
-| TEN-STABILITY-48 | fix: invalid or negative LOKI_E10_WALL_SNAPSHOT_TIMEOUT_S and LOKI_E10_WALL_SNAPSHOT_MAX_MB keep the negative value (`Number(x) // default`), so the Wall base snapshot is skipped or capped at once; accept positive finite values only | loki-ts/src/contrib/wall_snapshot.ts, loki-ts/tests/engine10/wall_concurrent_fidelity.test.ts | LOW | red: cd loki-ts && bun test tests/engine10/wall_concurrent_fidelity.test.ts -t "negative snapshot env" fails; green: passes | released v11.17.50 | Gap: wall_snapshot.ts:13 timeoutMs and maxMb use Number(...) // default. |
-| TEN-SPEED-16 | enhancement: the verify stage runs vitest, jest, tsc and eslint through bare `npx`, which downloads a missing tool and can stall a Wall for minutes; use `npx --no-install` so a missing tool fails fast as a tool-missing check | loki-ts/src/engine10/stages/verify.ts, loki-ts/tests/engine10/verify.test.ts | MEDIUM | red: cd loki-ts && bun test tests/engine10/verify.test.ts -t "npx no install" fails (argv lacks --no-install); green: passes, existing runnerCmd shapes otherwise unchanged | released v11.17.50 | Gap: verify.ts:58-59 ["npx", ["vitest", ...]] and :243-244 npx tsc and npx eslint. |
-| TEN-UX-37 | enhancement: a mistyped provider subcommand (`loki provider lst`) says only "unknown subcommand"; add an exported suggestWord(typo, names) next to levenshtein in cli/registry.ts and print a "Did you mean 'list'?" line, exit 2 unchanged | loki-ts/src/cli/registry.ts, loki-ts/src/commands/provider.ts, loki-ts/tests/commands/provider.test.ts | LOW | red: cd loki-ts && bun test tests/commands/provider.test.ts -t "did you mean" fails; green: passes, no suggestion when nothing is within distance 2 | released v11.17.50 | Gap: registry.ts:346 suggestCommand covers top-level commands only; provider.ts:208 prints no suggestion. Chain: UX-37 first, then UX-38, UX-39 and TEN-DEPLOY-23 reuse suggestWord. |
-| TEN-UX-38 | fix: `loki wiki bogus` prints the help on stdout and exits 1 while the sibling commands print errors on stderr and exit 2; exit 2, send the help to stderr and add the Did you mean line from suggestWord | loki-ts/src/commands/wiki.ts, loki-ts/tests/commands/wiki.test.ts | LOW | red: cd loki-ts && bun test tests/commands/wiki.test.ts -t "unknown command exits 2" fails (exit 1); green: passes, known verbs unchanged | released v11.17.50 | Gap: wiki.ts:168-170 writes help to stdout and returns 1; crash.ts:292 and rollback.ts:135 return 2. Serialize after TEN-UX-37. |
-| TEN-UX-39 | enhancement: `loki crash lst` prints the unknown subcommand and the whole help; add the Did you mean line from suggestWord before the help, exit 2 unchanged | loki-ts/src/commands/crash.ts, loki-ts/tests/commands/crash.test.ts | LOW | red: cd loki-ts && bun test tests/commands/crash.test.ts -t "did you mean" fails; green: passes | released v11.17.50 | Gap: crash.ts:292-294 no suggestion. Serialize after TEN-UX-38. |
-| TEN-DEPLOY-23 | enhancement: `loki rollback lst` prints Unknown subcommand and the help with no hint toward `list`; add the Did you mean line from suggestWord, exit 2 unchanged (a rollback typo near a destructive verb should be caught before the user retypes) | loki-ts/src/commands/rollback.ts, loki-ts/tests/commands/rollback.test.ts | LOW | red: cd loki-ts && bun test tests/commands/rollback.test.ts -t "did you mean" fails; green: passes, existing unknown-subcommand test (exit 2) unchanged | released v11.17.50 | Gap: rollback.ts:135-137 no suggestion. Serialize after TEN-UX-39. |
-| TEN-QUALITY-29 | fix: LOKI_E10_WALL_LIMIT_S above 300 is silently clamped to 300 and an invalid LOKI_E10_SMALL_MAX_CHARS silently becomes 600; print one stderr note naming the value used so the user sees the setting was not honored | loki-ts/src/engine10/sizing.ts, loki-ts/tests/engine10/sizing.test.ts | LOW | red: cd loki-ts && bun test tests/engine10/sizing.test.ts -t "clamp note" fails; green: passes, returned numbers byte identical | released v11.17.50 | Gap: sizing.ts:58 Math.min(300, n) and :18 smallMaxChars fall back with no message, unlike envCapS/warnBadCap in engine10/types.ts. |
-| TEN-QUALITY-30 | fix: an invalid LOKI_E10_REPOMAP_MAX_FILES (abc, 0, -5, 1.5) silently falls back to 2000; print one stderr note naming the bad value and the default | loki-ts/src/engine10/repomap.ts, loki-ts/tests/engine10/repomap.test.ts | LOW | red: cd loki-ts && bun test tests/engine10/repomap.test.ts -t "bad max files note" fails; green: passes, cap value unchanged | released v11.17.50 | Gap: repomap.ts:19 maxFilesCap returns 2000 for any non-positive-integer with no warning. |
-| TEN-QUALITY-31 | fix: a non-numeric LOKI_E10_SNAPSHOT_MAX makes `st.size > NaN` false, so the intake snapshot hashes every untracked file however large; fall back to the 50 MB default when the value is not a positive finite number | loki-ts/src/e10ext/preexisting_dirty.ts, loki-ts/tests/e10ext/preexisting_dirty.test.ts (new: no test owns snapshotUntracked, only incidental use in seal.test.ts and machine.test.ts) | LOW | red: cd loki-ts && bun test tests/e10ext/preexisting_dirty.test.ts -t "bad snapshot max" fails; green: passes | released v11.17.50 | Gap: preexisting_dirty.ts:38 st.size > Number(process.env.LOKI_E10_SNAPSHOT_MAX ?? 50e6) with no finite check. |
-| TEN-ADOPTION-27 | enhancement: LOKI_AI_MARKING only turns on for the exact string 1; accept 1, true and yes (any case) like the other opt-in flags, so the compliance marking users set as true is not silently off | loki-ts/src/engine10/pr_body.ts, loki-ts/tests/engine10/ai_marking.test.ts | LOW | red: cd loki-ts && bun test tests/engine10/ai_marking.test.ts -t "true enables" fails; green: passes, unset and 0 stay off | released v11.17.50 | Gap: pr_body.ts:5 env["LOKI_AI_MARKING"] === "1". |
-| TEN-COST-51 | enhancement: cost_claim.py point ratio uses every row of each arm while the CI uses only paired tasks, so arms covering different task sets give a ratio the CI does not describe; add a NOT PROVEN reason "tasks: arms cover different task sets" | benchmarks/bench/cost_claim.py, benchmarks/bench/tests/test_cost_claim.py | MEDIUM | red: pytest benchmarks/bench/tests/test_cost_claim.py -q -k task_set_mismatch fails; green: passes and the rest of the file stays green | released v11.17.53 | Gap: cost_claim.py:78-80 point ratio from _cpa(loki_rows)/_cpa(floor_rows) over all rows vs CI over paired tasks, no reason emitted. Chain COST-51, COST-52, COST-53 (same files). Serialize after TEN-COST-50 (board row is stale, code already built) |
-| TEN-COST-52 | feature: cost_claim.py refuses a proven verdict when rows lack cost_source or an arm mixes sources (claude_json.total_cost_usd vs loki.efficiency_cost), because mixed accounting makes the 2x claim unprovable | benchmarks/bench/cost_claim.py, benchmarks/bench/tests/test_cost_claim.py | MEDIUM | red: pytest benchmarks/bench/tests/test_cost_claim.py -q -k cost_source fails; green: passes | released v11.17.53 | Gap: attribution.py:589 and :636 stamp cost_source but no grep hit for cost_source in cost_claim.py. Serialize after TEN-COST-51 |
-| TEN-COST-53 | fix: cost_claim.py _cpa treats a missing, None, NaN or negative cost_usd as 0.0 so a broken row makes Loki look cheaper; require finite cost >= 0 or add a NOT PROVEN reason | benchmarks/bench/cost_claim.py, benchmarks/bench/tests/test_cost_claim.py | MEDIUM | red: pytest benchmarks/bench/tests/test_cost_claim.py -q -k bad_cost_row fails; green: passes | released v11.17.53 | Gap: cost_claim.py:28-34 float(r.get("cost_usd") or 0.0). Serialize after TEN-COST-52 |
-| TEN-SECURITY-16 | enhancement: redactSecrets also strips AWS temporary ASIA keys and Azure AccountKey= connection strings, both already recognised by export_sarif | loki-ts/src/util/redact.ts, loki-ts/tests/util/redact.test.ts | HIGH | red: cd loki-ts && bun test tests/util/redact.test.ts -t "asia and azure" fails; green: passes | released v11.17.53 | Gap: redact.ts:3-27 RULES has no ASIA or AccountKey rule; export_sarif.ts SECRET_PATTERNS lines 11-27 knows both |
-| TEN-SECURITY-17 | enhancement: export_sarif SECRET_PATTERNS also flags PyPI pypi-AgEI, Docker dckr_pat_, DigitalOcean dop_v1_, Google OAuth ya29., Shopify shpat_ and Postman PMAK- tokens | loki-ts/src/commands/export_sarif.ts, loki-ts/tests/commands/export_sarif.test.ts | HIGH | red: cd loki-ts && bun test tests/commands/export_sarif.test.ts -t "more token shapes" fails; green: passes | released v11.17.53 | Gap: export_sarif.ts:11-27 has none of the six shapes |
-| TEN-SECURITY-18 | enhancement: secure-scan.py _SECRET_PATTERNS also matches AWS ASIA keys, Azure AccountKey= and Twilio SK keys, and RULES_VERSION bumps | autonomy/lib/secure-scan.py, tests/test-secure-scan.sh | HIGH | red: bash tests/test-secure-scan.sh fails on the new fixtures; green: bash tests/test-secure-scan.sh passes | released v11.17.53 | Gap: secure-scan.py:111-136 lacks all three. Chain SECURITY-18, -19, -20 (same files) |
-| TEN-SECURITY-19 | feature: secure-scan.py rule 9 flags unsafe deserialization (pickle.loads, yaml.load without a safe loader, marshal.loads) in added lines | autonomy/lib/secure-scan.py, tests/test-secure-scan.sh | HIGH | red: bash tests/test-secure-scan.sh fails on the rule 9 fixtures; green: passes | released v11.17.53 | Gap: grep for pickle, yaml.load, eval in secure-scan.py returns 0 hits; rules stop at 8. Serialize after TEN-SECURITY-18 |
-| TEN-SECURITY-20 | feature: secure-scan.py rule 10 flags SQL built by f-string, % formatting or concatenation passed to execute() | autonomy/lib/secure-scan.py, tests/test-secure-scan.sh | HIGH | red: bash tests/test-secure-scan.sh fails on the rule 10 fixtures; green: passes | released v11.17.53 | Gap: no execute(f"...") or concatenation shape anywhere in secure-scan.py. Serialize after TEN-SECURITY-19 |
-| TEN-SECURITY-21 | fix: safe_git driverKeys and netCommandOverrides run git config with no timeout, so a hung git blocks the safe-git guard; add a timeout that still fails closed | loki-ts/src/util/safe_git.ts, loki-ts/tests/util/fc25_safe_git.test.ts | HIGH | red: cd loki-ts && bun test tests/util/fc25_safe_git.test.ts -t "hung git config" fails; green: passes | released v11.17.53 | Gap: safe_git.ts:63 and :95 spawnSync("git", ... config ...) without timeout; both already throw on r.error so a timeout error fails closed |
-| TEN-GATES-30 | fix: a negative LOKI_MUTATION_PROOF_TIMEOUT_S passes the || 30 fallback and makes the mutation proof deadline already past, so the verifier gate fails every run; accept only positive finite seconds | loki-ts/src/util/mutation_proof.ts, loki-ts/tests/engine10/mutation_proof.test.ts | released v11.17.53 | red: cd loki-ts && bun test tests/engine10/mutation_proof.test.ts -t "negative timeout" fails; green: passes | ready@2026-10-17T12:00Z | Gap: mutation_proof.ts:36 Number(... ?? 30) || 30 keeps negatives |
-| TEN-STABILITY-49 | fix: a negative LOKI_E10_NOTIFY_TIMEOUT_MS makes the Slack notify race resolve at once and drops the event; accept only positive values | loki-ts/src/util/slack_events.ts, loki-ts/tests/engine10/slack_events.test.ts | LOW | red: cd loki-ts && bun test tests/engine10/slack_events.test.ts -t "negative notify timeout" fails; green: passes | released v11.17.53 | Gap: slack_events.ts:27 Number(env.LOKI_E10_NOTIFY_TIMEOUT_MS) || 5000 |
-| TEN-STABILITY-50 | fix: the PR stage runs the push and pr-ready scripts with spawnSync and no timeout, so one hung push blocks the run; add a bounded timeout surfaced as the stage failure | loki-ts/src/engine10/stages/pr.ts, loki-ts/tests/engine10/pr.test.ts | MEDIUM | red: cd loki-ts && bun test tests/engine10/pr.test.ts -t "hung push script" fails; green: passes | released v11.17.53 | Gap: pr.ts:68, :76, :80, :129 spawnSync("bash", [...]) without timeout; script path injectable via scriptPath |
-| TEN-STABILITY-51 | fix: the runner push-pr spawn has no timeout while the check-origin spawn has 30s; a hung gh push stalls the attempt | loki-ts/src/runner/attempts.ts, loki-ts/tests/runner/attempts-push-pr.test.ts | MEDIUM | red: cd loki-ts && bun test tests/runner/attempts-push-pr.test.ts -t "hung push" fails; green: passes | released v11.17.53 | Gap: attempts.ts:376 spawnSync without timeout vs attempts.ts:292 timeout 30_000 |
-| TEN-STABILITY-52 | fix: recordFailures reads the failures file then rewrites existing + lines, so two concurrent runs lose lines; append atomically instead | loki-ts/src/util/failure_memory.ts, loki-ts/tests/e10ext/repomemory.test.ts | MEDIUM | red: cd loki-ts && bun test tests/e10ext/repomemory.test.ts -t "concurrent recordFailures" fails; green: passes | released v11.17.53 | Gap: failure_memory.ts:47 writeFileSync(failuresPath(dir), existing + lines); line 115 already uses temp file plus rename for another file |
-| TEN-STABILITY-53 | fix: pr_lessons push spawnSync has no timeout, so a hung push blocks pr respond forever; add a bounded timeout | loki-ts/src/util/pr_lessons.ts, loki-ts/tests/util/pr_lessons.test.ts | LOW | red: cd loki-ts && bun test tests/util/pr_lessons.test.ts -t "hung push" fails; green: passes | released v11.17.53 | Gap: pr_lessons.ts:348 spawnSync without timeout (LOKI_PR_RESPOND_MAX at :370 is already guarded at :386, not a gap) |
-| TEN-STABILITY-54 | fix: issues run shells out to gh with spawnSync and no timeout, so one hung gh call stalls the whole issue batch; add a bounded timeout returned as a nonzero rc | loki-ts/src/commands/issues_run.ts, loki-ts/tests/commands/issues_run.test.ts | MEDIUM | red: cd loki-ts && bun test tests/commands/issues_run.test.ts -t "hung gh" fails; green: passes | released v11.17.53 | Gap: issues_run.ts:533 spawnSync("gh", ...) without timeout |
-| TEN-STABILITY-55 | enhancement: verify pr gh helper uses execFileSync with no timeout; add a bounded timeout so a stalled gh yields the existing fetch error | loki-ts/src/commands/verify_pr.ts, loki-ts/tests/commands/verify_pr.test.ts | LOW | red: cd loki-ts && bun test tests/commands/verify_pr.test.ts -t "gh timeout" fails; green: passes | released v11.17.53 | Gap: verify_pr.ts:57 execFileSync("gh", args, {...}) without timeout |
-| TEN-UX-40 | enhancement: loki control with a mistyped subcommand prints "Did you mean" using suggestWord, like crash and wiki do | loki-ts/src/commands/control.ts, loki-ts/tests/commands/control.test.ts | LOW | red: cd loki-ts && bun test tests/commands/control.test.ts -t "did you mean" fails; green: passes | released v11.17.53 | Gap: control.ts:248-250 default case prints unknown command plus HELP only |
-| TEN-UX-41 | enhancement: loki queue with an unknown subcommand names the bad word and suggests the closest one before the usage | loki-ts/src/commands/queue.ts, loki-ts/tests/commands/queue.test.ts | LOW | red: cd loki-ts && bun test tests/commands/queue.test.ts -t "unknown subcommand hint" fails; green: passes | released v11.17.53 | Gap: queue.ts:529-531 default case prints QUEUE_USAGE without the offending word. Chain UX-41, UX-44 |
-| TEN-UX-42 | enhancement: loki undo unknown flag suggests the closest known flag | loki-ts/src/commands/undo.ts, loki-ts/tests/commands/undo.test.ts | LOW | red: cd loki-ts && bun test tests/commands/undo.test.ts -t "flag hint" fails; green: passes | released v11.17.53 | Gap: undo.ts:221 err("unknown flag X (see loki undo --help)") with no suggestion although known set is at :219 |
-| TEN-UX-43 | enhancement: loki memory unknown flag suggests the closest allowed flag | loki-ts/src/commands/memory.ts, loki-ts/tests/commands/memory.test.ts | LOW | red: cd loki-ts && bun test tests/commands/memory.test.ts -t "flag hint" fails; green: passes | released v11.17.53 | Gap: memory.ts:112 unknownFlag writes the error without using the allowed list for a suggestion |
-| TEN-UX-44 | enhancement: loki queue run unknown argument suggests the closest valid argument | loki-ts/src/commands/queue.ts, loki-ts/tests/commands/queue.test.ts | LOW | red: cd loki-ts && bun test tests/commands/queue.test.ts -t "run arg hint" fails; green: passes | released v11.17.53 | Gap: queue.ts:284 d.err(unknown argument) with no suggestion. Serialize after TEN-UX-41 |
-| TEN-ADOPTION-28 | feature: registry lists crash subcommands list, show, submit, help so shell completion offers them | loki-ts/src/cli/registry.ts, docs/v10/CLI-MODERN.md, loki-ts/tests/cli/registry_guard.test.ts | LOW | red: cd loki-ts && bun test tests/cli/registry_guard.test.ts -t "crash subcommands" fails; green: passes after bun loki-ts/scripts/gen-cli-modern-doc.ts | released v11.17.53 | Gap: registry.ts:170 crash has no subcommands; crash.ts:258 CRASH_SUBCOMMANDS. Chain ADOPTION-28 to -33 (same files) |
-| TEN-ADOPTION-29 | feature: registry rollback lists the deploy subcommand and the list --json flag | loki-ts/src/cli/registry.ts, docs/v10/CLI-MODERN.md, loki-ts/tests/cli/registry_guard.test.ts | LOW | red: cd loki-ts && bun test tests/cli/registry_guard.test.ts -t "rollback deploy" fails; green: passes | released v11.17.53 | Gap: registry.ts:118-125 rollback has list, show, to, latest only; rollback.ts:33 documents list [--json]. Serialize after TEN-ADOPTION-28 |
-| TEN-ADOPTION-30 | feature: registry control status lists the --json flag | loki-ts/src/cli/registry.ts, docs/v10/CLI-MODERN.md, loki-ts/tests/cli/registry_guard.test.ts | LOW | red: cd loki-ts && bun test tests/cli/registry_guard.test.ts -t "control status json" fails; green: passes | released v11.17.53 | Gap: registry.ts:147-153 status has no flags; control.ts:25 and :226 accept status --json. Serialize after TEN-ADOPTION-29 |
-| TEN-ADOPTION-31 | feature: registry trust lists the --json flag | loki-ts/src/cli/registry.ts, docs/v10/CLI-MODERN.md, loki-ts/tests/cli/registry_guard.test.ts | LOW | red: cd loki-ts && bun test tests/cli/registry_guard.test.ts -t "trust json" fails; green: passes | released v11.17.53 | Gap: registry.ts:169 trust has only detail; trust.ts:106 handles --json. Serialize after TEN-ADOPTION-30 |
-| TEN-ADOPTION-32 | feature: registry undo lists the --list and --dry-run flags | loki-ts/src/cli/registry.ts, docs/v10/CLI-MODERN.md, loki-ts/tests/cli/registry_guard.test.ts | LOW | red: cd loki-ts && bun test tests/cli/registry_guard.test.ts -t "undo flags" fails; green: passes | released v11.17.53 | Gap: registry.ts:182 undo flags omit --list and --dry-run; undo.ts:219 known set includes both. Serialize after TEN-ADOPTION-31 |
-| TEN-ADOPTION-33 | feature: registry memory list and memory lessons list the --json flag | loki-ts/src/cli/registry.ts, docs/v10/CLI-MODERN.md, loki-ts/tests/cli/registry_guard.test.ts | LOW | red: cd loki-ts && bun test tests/cli/registry_guard.test.ts -t "memory json" fails; green: passes | released v11.17.53 | Gap: registry.ts:104-117 list and lessons have no flags; memory.ts:126 and :155 accept --json. Serialize after TEN-ADOPTION-32 |
-| TEN-DEPLOY-24 | fix: rollback deploy hint matches only the first token, so flyctl deploy, npx vercel --prod and bunx wrangler get no rollback command; skip npx, bunx, pnpm dlx, yarn dlx wrappers and alias flyctl to fly | loki-ts/src/commands/rollback.ts, loki-ts/tests/commands/rollback.test.ts | LOW | red: cd loki-ts && bun test tests/commands/rollback.test.ts -t "wrapped deploy" fails; green: passes | released v11.17.53 | Gap: rollback.ts printDeployRollback const first = command.split(/\s+/)[0] then DEPLOY_ROLLBACKS.find(r => r.prefix === first). Chain DEPLOY-24, DEPLOY-25 |
-| TEN-DEPLOY-25 | feature: loki rollback deploy accepts --json and prints the matched rollback command as a JSON object | loki-ts/src/commands/rollback.ts, loki-ts/tests/commands/rollback.test.ts | LOW | red: cd loki-ts && bun test tests/commands/rollback.test.ts -t "deploy json" fails; green: passes | released v11.17.53 | Gap: rollback.ts:65 allowed flags are [] for deploy. Serialize after TEN-DEPLOY-24 |
-| TEN-SPEED-17 | feature: engine10 intake reuses the tree-keyed repomap and testmap cache (cachedRepoMap and cachedTestMap) instead of rebuilding both on every run, so a second run on an unchanged tree skips the repo walk and test detection | loki-ts/src/engine10/stages/intake.ts, loki-ts/tests/engine10/intake.test.ts | MEDIUM | red: cd loki-ts && bun test tests/engine10/intake.test.ts -t "tree cache" fails; green: passes | released v11.17.54 | Gap: cache.ts:66-67 defines cachedRepoMap and cachedTestMap but no src caller exists outside cache.ts; intake.ts:93-95 calls buildRepoMap and ctx.tests.detect every run; sizing.ts:40 and context.ts:46 read repomap2-<tree>.json that nothing writes |
-| TEN-SPEED-18 | feature: verify runs the selected test files with bounded concurrency (LOKI_E10_VERIFY_JOBS, default 1 so behavior is unchanged) and records checks in the original failed-first order; protect, cwd and interpreter handling stay per test | loki-ts/src/engine10/stages/verify.ts, loki-ts/tests/engine10/verify.test.ts | HIGH | red: cd loki-ts && bun test tests/engine10/verify.test.ts -t "verify jobs" fails; green: passes | released v11.17.54 | Gap: verify.ts:284 `for (const t of tests) { await runCheck(...) }` runs one test process at a time; no jobs knob exists. Serialize after any open verify.ts row |
-| TEN-SPEED-19 | feature: the Wall base-tree test run executes wall test files with bounded concurrency (LOKI_E10_BASE_JOBS, default 1) with the same pass/fail/not_run counts and lastNotRunFiles order | loki-ts/src/engine10/stages/wall.ts, loki-ts/tests/engine10/wall_runner.test.ts | HIGH | red: cd loki-ts && bun test tests/engine10/wall_runner.test.ts -t "base jobs" fails; green: passes | released v11.17.54 | Gap: wall.ts:39 `for (const f of files)` with a synchronous spawnSync per file in RealBaseTestRunner.run, one process at a time |
-| TEN-SPEED-20 | feature: a group suite-fix unit reuses the failing-suite output integrate already captured instead of re-running the whole suite (up to 600s) just to build the fix brief | loki-ts/src/features/speed/fix_units.ts, loki-ts/src/engine10/integrate.ts, loki-ts/tests/features/speed/fix_units.test.ts | MEDIUM | red: cd loki-ts && bun test tests/features/speed/fix_units.test.ts -t "suite fix reuses output" fails; green: passes | released v11.17.54 | Gap: fix_units.ts:41 suiteTail does spawnSync of the full test command (timeout 600000) after integrate already ran it; integrate.ts:22 IntegrateResult has no output field. Chain TEN-QUALITY-36, TEN-SPEED-20 (same test file); serialize after TEN-QUALITY-36 |
-| TEN-UX-45 | feature: loki start --dry-run parses and validates every flag, runs the preflight and prints the provider, model and cost cap it would use, then exits 0 without spending a token | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | MEDIUM | red: cd loki-ts && bun test tests/commands/start.test.ts -t "dry-run" fails; green: passes | released v11.17.54 | Gap: grep -n "dry-run" loki-ts/src/commands/start.ts returns nothing, so --dry-run is an unknown flag today (start.ts:229 error); a first-run user cannot check setup without a paid run. Chain TEN-UX-48, TEN-UX-50, TEN-DEPLOY-26, TEN-UX-47, TEN-UX-46, TEN-UX-45 (same files); serialize after TEN-UX-46 |
-| TEN-UX-46 | feature: loki start unknown-flag error suggests the closest valid flag (suggestWord) and stops naming LOKI_SDK_LOOP internals to first-run users | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | LOW | red: cd loki-ts && bun test tests/commands/start.test.ts -t "unknown flag suggestion" fails; green: passes | released v11.17.54 | Gap: start.ts:229 prints "flag --bogus is not supported by the Bun (LOKI_SDK_LOOP) runner ... run without LOKI_SDK_LOOP" (reproduced with parseStartArgs(["x","--bogus"])); cli/registry.ts:346 exports suggestWord and start does not use it. Serialize after TEN-UX-47 |
-| TEN-COST-54 | feature: LOKI_PRICE_TABLE=<json file> overrides or extends PRICE_TABLE entries so a stale vendor price is fixable without a release; invalid file falls back to the built-in table | loki-ts/src/providers/price_table.ts, loki-ts/tests/providers/price_table.test.ts (new: no test file owns price_table.ts, grep of tests for priceFor and usdFor finds none) | LOW | red: cd loki-ts && bun test tests/providers/price_table.test.ts -t "price table override" fails; green: passes | released v11.17.54 | Gap: price_table.ts:7 comment says "Update as vendors publish new prices" and the table is a frozen constant (line 8) with no env override. Chain TEN-COST-56, TEN-COST-58, TEN-COST-54 (same files); serialize after TEN-COST-58 |
-| TEN-COST-55 | feature: opencode runs get a size-estimate cost record (estimated=true, cost_basis size-estimate) when the model id is priced, instead of an unmeasured cost, so the cost cap and loki cost cover all 5 providers | loki-ts/src/providers/provider_cost.ts, loki-ts/tests/engine10/budget_cap.test.ts | MEDIUM | red: cd loki-ts && bun test tests/engine10/budget_cap.test.ts -t "opencode estimate" fails; green: passes | released v11.17.54 | Gap: provider_cost.ts:71 ESTIMATED_PROVIDERS is codex, cline, aider only, so buildProviderCost returns null for opencode (line 86); provider_opencode.ts:5-7 states cost is not measured |
-| TEN-QUALITY-32 | feature: impactedRefs maps a changed Python package __init__.py and Rust mod.rs to the package directory name so tests that import the package are selected | loki-ts/src/engine10/testmap.ts, loki-ts/tests/engine10/testmap.test.ts | HIGH | red: cd loki-ts && bun test tests/engine10/testmap.test.ts -t "package init maps to directory" fails; green: passes | released v11.17.54 | Gap: reproduced on a repo with pkg/search/__init__.py and tests/test_search.py (from pkg.search import a): buildTestMap yields sourceRefs {search:[tests/test_search.py]} and impactedRefs(map,["pkg/search/__init__.py"]) returns []; testmap.ts:178 keys on basename of the file. Chain TEN-QUALITY-39, TEN-QUALITY-32, TEN-SPEED-22 (same files); serialize after TEN-QUALITY-39 |
-| TEN-STABILITY-56 | feature: the supervisor forwards SIGHUP (terminal closed) to the detached worker process group, the same way it forwards SIGINT and SIGTERM, so closing the terminal does not orphan a paid worker | loki-ts/src/runner/worker_proc.ts, loki-ts/tests/engine10/supervisor_signal.test.ts | MEDIUM | red: cd loki-ts && bun test tests/engine10/supervisor_signal.test.ts -t "sighup" fails; green: passes | released v11.17.54 | Gap: grep -rn SIGHUP loki-ts/src returns nothing; worker_proc.ts:35-36 registers only SIGINT and SIGTERM and spawns the worker detached (line 17) so a SIGHUP kills the supervisor and leaves the worker group running |
-| TEN-SPEED-21 | enhancement: the 30-second session heartbeat lists untracked files once and shares the list between the shortstat and the signature | loki-ts/src/engine10/session.ts, loki-ts/tests/engine10/session.test.ts | LOW | red: cd loki-ts && bun test tests/engine10/session.test.ts -t "heartbeat single ls-files" fails; green: passes | released v11.17.54 | Gap: session.ts:88 (diffShortstat) and session.ts:104 (diffSignature) each run safeGit ls-files -z --others --exclude-standard on the same tick |
-| TEN-SPEED-22 | enhancement: buildTestMap reads each JS test file once (the node:test probe and the reference scan share one read) and stops probing for node:test once node is marked | loki-ts/src/engine10/testmap.ts, loki-ts/tests/engine10/testmap.test.ts | LOW | red: cd loki-ts && bun test tests/engine10/testmap.test.ts -t "single read per test file" fails; green: passes | released v11.17.54 | Gap: testmap.ts:115 readText(full) for every JS test file in the first loop and testmap.ts:143 readText(join(root, t.path)) again in the tests loop. Serialize after TEN-QUALITY-32 |
-| TEN-SPEED-23 | enhancement: repomap topLevelSymbols reads only the first MAX_SCAN_BYTES bytes of each file instead of the whole file | loki-ts/src/engine10/repomap.ts, loki-ts/tests/engine10/repomap.test.ts | LOW | red: cd loki-ts && bun test tests/engine10/repomap.test.ts -t "bounded read" fails; green: passes | released v11.17.54 | Gap: repomap.ts:44 `readFileSync(absPath, "utf8").slice(0, MAX_SCAN_BYTES)` loads the full file (and decodes it) before slicing |
-| TEN-QUALITY-33 | enhancement: enable noImplicitReturns in loki-ts/tsconfig.json and fix the one violation | loki-ts/tsconfig.json, loki-ts/src/contrib/slack_inbound.ts | LOW | red: cd loki-ts && bun run --bun tsc --noEmit --noImplicitReturns fails (exit non-zero); green: cd loki-ts && bun run typecheck && bun test tests/features/slack_inbound.test.ts passes | released v11.17.54 | Gap: tsc --noImplicitReturns reports exactly 1 error, slack_inbound.ts(217,10) TS7030 in the slackPoster async lambda; tsconfig.json has strict and noUncheckedIndexedAccess (line 9) but not noImplicitReturns. Chain TEN-QUALITY-33, TEN-QUALITY-34 (same file) |
-| TEN-QUALITY-34 | enhancement: handleSlackEvent takes payload as unknown and narrows it, removing the any | loki-ts/src/contrib/slack_inbound.ts, loki-ts/tests/features/slack_inbound.test.ts | LOW | red: cd loki-ts && bun test tests/features/slack_inbound.test.ts -t "malformed payload" fails; green: passes | released v11.17.54 | Gap: slack_inbound.ts:100 `payload: any`. Serialize after TEN-QUALITY-33 |
-| TEN-QUALITY-35 | enhancement: add optional stderrTail to SessionResult and drop the double-cast at both call sites | loki-ts/src/engine10/types.ts, loki-ts/src/engine10/stages/implement.ts, loki-ts/src/engine10/stages/plan.ts | LOW | red: cd loki-ts && grep -c "as unknown as { stderrTail" src/engine10/stages/implement.ts src/engine10/stages/plan.ts prints non-zero counts; green: both counts are 0 and cd loki-ts && bun run typecheck && bun test tests/engine10/implement.test.ts tests/engine10/plan.test.ts passes | released v11.17.54 | Gap: implement.ts:180 and plan.ts:101 cast `session as unknown as { stderrTail?: string }`; types.ts:98 SessionResult lacks the field that session.ts:176 returns |
-| TEN-UX-47 | enhancement: loki start unknown --provider error lists the valid providers, as loki estimate already does | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | LOW | red: cd loki-ts && bun test tests/commands/start.test.ts -t "unknown provider lists valid" fails; green: passes | released v11.17.54 | Gap: start.ts:292 prints only "unknown --provider 'gemini'"; cost_preview.ts:144 exports VALID_PROVIDERS and cost_preview.ts:161 lists them. Serialize after TEN-DEPLOY-26 |
-| TEN-QUALITY-36 | enhancement: characterization tests for fix_units effectiveDag, integrateWithFixes and fixEnabled (conflict fix, suite fix, MAX_FIX_UNITS cap, LOKI_GROUP_FIX_UNITS=0) | loki-ts/tests/features/speed/fix_units.test.ts (new: no test file imports fix_units.ts) | MEDIUM | red: cd loki-ts && test -f tests/features/speed/fix_units.test.ts fails; green: bun test tests/features/speed/fix_units.test.ts passes | released v11.17.54 | Gap: fix_units.ts has no direct test; only the LOKI_GROUP_FIX_UNITS name appears in seal_group.test.ts. Chain TEN-QUALITY-36, TEN-SPEED-20 |
-| TEN-QUALITY-37 | enhancement: unit tests for compound_match linkedHits (compound keyword, suffix word rejected, vendored path skipped, import line required) | loki-ts/tests/e10ext/compound_match.test.ts (new: no test file imports compound_match.ts) | LOW | red: cd loki-ts && test -f tests/e10ext/compound_match.test.ts fails; green: bun test tests/e10ext/compound_match.test.ts passes | released v11.17.54 | Gap: compound_match.ts:45 linkedHits is covered only indirectly through already_done tests |
-| TEN-QUALITY-38 | enhancement: unit tests for buildOpencodeArgv (default cli, LOKI_OPENCODE_CLI, LOKI_OPENCODE_MODEL, LOKI_OPENCODE_FLAGS whitespace split, commit hygiene prefix) | loki-ts/tests/runner/provider_opencode.test.ts (new: no test file imports provider_opencode.ts) | LOW | red: cd loki-ts && test -f tests/runner/provider_opencode.test.ts fails; green: bun test tests/runner/provider_opencode.test.ts passes | released v11.17.54 | Gap: provider_opencode.ts:25 buildOpencodeArgv is documented "unit-testable without spawning" yet grep of loki-ts/tests and tests/ finds no reference |
-| TEN-QUALITY-39 | fix: impactedRefs returns no tests for a changed index.ts/index.js because the source is keyed as "index" while tests import the directory name | loki-ts/src/engine10/testmap.ts, loki-ts/tests/engine10/testmap.test.ts | HIGH | red: cd loki-ts && bun test tests/engine10/testmap.test.ts -t "index source maps to directory" fails; green: passes | released v11.17.54 | Gap: reproduced on a repo with src/search/index.ts and tests/search.test.ts (import from "../src/search"): buildTestMap finds the bun runner and the test, impactedRefs(map,["src/search/index.ts"]) returns []; testmap.ts:178 uses basename(rel, extname(rel)) = "index", so the verifier under-selects tests. Chain TEN-QUALITY-39, TEN-QUALITY-32, TEN-SPEED-22 (same files) |
-| TEN-COST-56 | fix: usdFor returns NaN for non-finite or negative tokens and bills cached tokens in full when cached exceeds input; clamp to finite non-negative and cap cached at input | loki-ts/src/providers/price_table.ts, loki-ts/tests/providers/price_table.test.ts (new: see TEN-COST-54) | MEDIUM | red: cd loki-ts && bun test tests/providers/price_table.test.ts -t "usdFor clamps" fails; green: passes | released v11.17.54 | Gap: reproduced usdFor("gpt-5",NaN,10) = NaN and usdFor("gpt-5",100,0,500) = 0.000063 (500 cached tokens billed against 100 input); price_table.ts:40-45; provider_cost.ts:94 feeds it. Chain TEN-COST-56, TEN-COST-58, TEN-COST-54 (same files) |
-| TEN-COST-57 | fix: loki estimate --model followed by another flag swallows that flag as the model id, and --model= (empty) is accepted; require a non-empty value that does not start with a dash | loki-ts/src/runner/router/cost_preview.ts, loki-ts/tests/runner/cost_preview.test.ts | LOW | red: cd loki-ts && bun test tests/runner/cost_preview.test.ts -t "model needs a value" fails; green: passes | released v11.17.54 | Gap: reproduced runEstimate(["--provider","codex","--model","--json"]) returns 0 and prints text (--json consumed as the model); runEstimate(["--provider","codex","--model="]) returns 0; cost_preview.ts:155 `args[++i]` only rejects an absent value, line 157 has no empty check |
-| TEN-COST-58 | fix: PRICE_TABLE prices gpt-4o-mini, gpt-4.1-mini, gpt-4.1-nano, gpt-5-mini and gpt-5-nano at the full gpt-4o, gpt-4.1 and gpt-5 rates, overstating cost and tripping the cost cap early; add their own entries from the vendor price page (cite the page in a comment) | loki-ts/src/providers/price_table.ts, loki-ts/tests/providers/price_table.test.ts (new: see TEN-COST-54) | LOW | red: cd loki-ts && bun test tests/providers/price_table.test.ts -t "mini and nano priced separately" fails; green: passes | released v11.17.54 | Gap: priceFor uses longest-substring match (price_table.ts:28-32) and the table (lines 11-13) has no mini or nano keys, so "gpt-5-mini" resolves to the "gpt-5" entry. Chain TEN-COST-56, TEN-COST-58, TEN-COST-54; serialize after TEN-COST-56 |
-| TEN-UX-48 | fix: loki start --provider, --session-model, --cost and --spec with a missing or empty value are silently ignored and the run starts with defaults; fail with "needs a value" like the text flags | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | LOW | red: cd loki-ts && bun test tests/commands/start.test.ts -t "value flags need a value" fails; green: passes | released v11.17.54 | Gap: reproduced parseStartArgs(["x","--provider"]), ["x","--session-model"], ["x","--cost"], ["x","--spec"] all return {prdPath:"x"} with no error and ["x","--provider=","--simple"] yields provider ""; start.ts:57 TEXT_VALUE_FLAGS lists only 6 free-text flags. First in the start.ts chain |
-| TEN-UX-50 | fix: a PRD path containing a space (for example "My Docs/prd.md") that does not exist is treated as a brief and starts a paid run; treat a slash-containing token ending in a doc extension as a path even with spaces | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | MEDIUM | red: cd loki-ts && bun test tests/commands/start.test.ts -t "spaced prd path" fails; green: passes | released v11.17.54 | Gap: reproduced missingPrdMessage(["My Docs/prd.md"],"My Docs/prd.md",()=>false) = null while "docs/spec.pdf" and "prd.md" give "PRD file not found"; start.ts:384 pathShaped rejects any \s. Serialize after TEN-UX-48 |
-| TEN-DEPLOY-26 | fix: loki start --health-url, --domain, --destination and --env-file given with no value pass deployFlagError silently, so the deploy step is skipped or runs without the setting; report a missing value before the paid build | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | MEDIUM | red: cd loki-ts && bun test tests/commands/start.test.ts -t "deploy flag missing value" fails; green: passes | released v11.17.54 | Gap: reproduced deployFlagError(["x","--health-url"]), ["x","--destination"], ["x","--env-file"] and ["x","--domain","--simple"] all return null; start.ts:437-447 val() returns undefined for an absent or dash-leading value and the checks only run when val is defined. Serialize after TEN-UX-50 |
-| TEN-UX-51 | fix: a first-run folder that holds only .DS_Store (macOS Finder) is refused as non-empty; ignore .DS_Store and other OS metadata files when deciding the folder is empty | loki-ts/src/util/first_run_repo.ts, loki-ts/tests/engine10/preflight.test.ts | LOW | red: cd loki-ts && bun test tests/engine10/preflight.test.ts -t "ds_store only folder" fails; green: passes | released v11.17.54 | Gap: reproduced initEmptyRepo(dirWithOnly.DS_Store) returns {fatal:"not a git repository ... "}; first_run_repo.ts:12 `readdirSync(dir).length === 0` counts dotfiles |
-| TEN-STABILITY-57 | fix: appendRunOutcome is a read-modify-write, so two concurrent runs on one repo lose an outcome; serialize with a lock file or append-only records | loki-ts/src/runner/router/history_store.ts, loki-ts/tests/runner/router_history.test.ts | MEDIUM | red: cd loki-ts && bun test tests/runner/router_history.test.ts -t "concurrent append keeps all" fails; green: passes | released v11.17.54 | Gap: history_store.ts:70 reads the history, appends in memory, then renames a pid-named temp file over the target (lines 73-77); the atomic rename prevents truncation but not a lost update between two processes |
-| TEN-SECURITY-22 | fix: secure-scan silently skips untracked files larger than 1 MB, so a secret in a large new file passes the gate unreported; scan them line by line up to a hard cap and list anything above the cap as an explicit skipped file | loki-ts/src/util/secure_scan.ts, loki-ts/tests/util/secure_scan.test.ts | HIGH | red: cd loki-ts && bun test tests/util/secure_scan.test.ts -t "oversized untracked file" fails; green: passes | released v11.17.54 | Gap: secure_scan.ts:49 MAX_ADDED_FILE_BYTES = 1_000_000 and secure_scan.ts:237 `if (!st.isFile() \|\| st.size > MAX_ADDED_FILE_BYTES) continue;` drops the file with no finding, no error and no skipped count; grep for skipped or unscanned in the file finds nothing |
-| TEN-COST-59 | fix: parseCapUsd accepts ".5" and "5." as dollar caps instead of returning null (which silently drops the cap to the default) | loki-ts/src/e10ext/budget_cap.ts, loki-ts/tests/engine10/budget_cap.test.ts | MEDIUM | red: cd loki-ts && bun test tests/engine10/budget_cap.test.ts -t "bare decimal cap" fails; green: passes | released v11.17.55 | Gap: budget_cap.ts parseCapUsd regex ^\$?\d+(\.\d+)?$ rejects .5 and 5.; probed: both return null. Chain COST-59, COST-60 (same file); serialize after none |
-| TEN-COST-60 | fix: hasApiKey also counts OPENROUTER_API_KEY and LOKI_MODEL_API_KEY so a run billed through a model route gets a cap instead of source subscription with usd 0 (no cap) | loki-ts/src/e10ext/budget_cap.ts, loki-ts/tests/engine10/budget_cap.test.ts | MEDIUM | red: cd loki-ts && bun test tests/engine10/budget_cap.test.ts -t "route key cap" fails; green: passes | released v11.17.55 | Gap: budget_cap.ts hasApiKey checks only ANTHROPIC_API_KEY and OPENAI_API_KEY; model_routes.ts:17 and :49 read the other two token vars; probed: only OPENROUTER_API_KEY set resolves {usd:0, source:subscription}. Chain COST-59, COST-60 (same file); serialize after COST-59 |
-| TEN-COST-61 | fix: resolveRunCapS reads the first loki.yaml/loki.yml like resolveCap and cost.profile do, not the last | loki-ts/src/util/run_cap.ts, loki-ts/tests/engine10/fc21_cap.test.ts | MEDIUM | red: cd loki-ts && bun test tests/engine10/fc21_cap.test.ts -t "yaml precedence" fails; green: passes | released v11.17.55 | Gap: run_cap.ts resolveRunCapS uses texts[texts.length-1] while resolveCap and start.ts cost.profile use the first, so one repo with both files gets two different caps |
-| TEN-COST-62 | feature: priorFor returns a cost prior for opus models so the pre-run estimate is shown for opus-routed runs instead of nothing | loki-ts/src/runner/router/cost_preview.ts, loki-ts/tests/runner/cost_preview.test.ts | MEDIUM | red: cd loki-ts && bun test tests/runner/cost_preview.test.ts -t "opus prior" fails; green: passes | released v11.17.55 | Gap: cost_preview.ts:38 tier is only haiku or sonnet, else null, so a start with an opus model prints no estimate |
-| TEN-SECURITY-23 | fix: redact GOOGLE_KEY rule requires the AIza prefix shape so ordinary identifiers starting with AI are not rewritten in logs and receipts | loki-ts/src/util/redact.ts, loki-ts/tests/util/redact.test.ts | HIGH | red: cd loki-ts && bun test tests/util/redact.test.ts -t "google key shape" fails; green: passes | released v11.17.55 | Gap: redact.ts GOOGLE_KEY /AI[a-zA-Z0-9_-]{30,}/g matches any 32+ char identifier starting AI (over-redaction corrupts evidence). Chain SECURITY-23, 24, 25 (same file); serialize after none |
-| TEN-SECURITY-24 | feature: redact adds Slack webhook URLs, sk_test_ and rk_ Stripe keys, and whsec_ webhook secrets | loki-ts/src/util/redact.ts, loki-ts/tests/util/redact.test.ts | HIGH | red: cd loki-ts && bun test tests/util/redact.test.ts -t "slack stripe redact" fails; green: passes | released v11.17.55 | Gap: redact.ts RULES has no pattern for hooks.slack.com/services, sk_test_, or whsec_; a pasted token reaches events and receipts unredacted. Chain SECURITY-23, 24, 25; serialize after SECURITY-23 |
-| TEN-SECURITY-25 | feature: redact masks the value of key=value and key: value assignments for password, secret, token and api_key names | loki-ts/src/util/redact.ts, loki-ts/tests/util/redact.test.ts | HIGH | red: cd loki-ts && bun test tests/util/redact.test.ts -t "assignment redact" fails; green: passes | released v11.17.56 | Gap: redact.ts RULES match only token-shaped literals; password=hunter2 passes through unchanged. Chain SECURITY-23, 24, 25; serialize after SECURITY-24 |
-| TEN-STABILITY-58 | fix: yamlKey reads flow-style maps such as budgets: { per_run: 5 } instead of ignoring them (the default 100 dollar cap then applies silently) | loki-ts/src/util/yaml_key.ts, loki-ts/tests/util/yaml_key.test.ts | MEDIUM | red: cd loki-ts && bun test tests/util/yaml_key.test.ts -t "flow style" fails; green: passes | released v11.17.55 | Gap: yaml_key.ts yamlKey handles block style only; probed: flow style returns undefined so resolve falls to the default cap |
-| TEN-STABILITY-59 | fix: loki undo validates the run id before the LOKI_UNDO gate so a bad id reports usage, not the gate message | loki-ts/src/commands/undo.ts, loki-ts/tests/commands/undo.test.ts | MEDIUM | red: cd loki-ts && bun test tests/commands/undo.test.ts -t "undo id before gate" fails; green: passes | released v11.17.55 | Gap: undo.ts runUndo checks the LOKI_UNDO gate (line 239) before loadPlan validates the run id (isRunId, line 44) |
-| TEN-STABILITY-60 | enhancement: pauseTimeoutMs warns once on stderr when the pause timeout env is set but not a positive number, then uses the default | loki-ts/src/util/run_control.ts, loki-ts/tests/util/run_control.test.ts | MEDIUM | red: cd loki-ts && bun test tests/util/run_control.test.ts -t "pause timeout warn" fails; green: passes | released v11.17.55 | Gap: run_control.ts pauseTimeoutMs falls back silently on garbage. Chain STABILITY-60, 61 (same file); serialize after none |
-| TEN-STABILITY-61 | enhancement: runControlBoundary records reason timeout_abandon on the cancel event when a pause expires, distinct from a user cancel | loki-ts/src/util/run_control.ts, loki-ts/tests/util/run_control.test.ts | MEDIUM | red: cd loki-ts && bun test tests/util/run_control.test.ts -t "timeout abandon event" fails; green: passes | released v11.17.55 | Gap: run_control.ts runControlBoundary emits identical cancel events for a user cancel and a timeout abandon. Chain STABILITY-60, 61; serialize after STABILITY-60 |
-| TEN-STABILITY-62 | fix: queue add rejects issue number 0 for owner/repo#0 and bare 0 | loki-ts/src/commands/queue.ts, loki-ts/tests/commands/queue.test.ts | LOW | red: cd loki-ts && bun test tests/commands/queue.test.ts -t "queue zero issue" fails; green: passes | released v11.17.55 | Gap: queue.ts accepts queue add 0 and a/b#0; probed: both exit 0 and enqueue an unrunnable item |
-| TEN-STABILITY-63 | fix: engine10 supervisor main exits 2 with a usage line when --spec or --max-cost has no value, instead of treating it as an empty string | loki-ts/src/engine10/supervisor.ts, loki-ts/tests/engine10/supervisor_signal.test.ts | MEDIUM | red: cd loki-ts && bun test tests/engine10/supervisor_signal.test.ts -t "missing flag value" fails; green: passes | released v11.17.55 | Gap: supervisor.ts main arg parser turns --spec and --max-cost with a missing value into ""; the git-repo check then runs before resolveCap so the user sees an unrelated error |
-| TEN-STABILITY-65 | fix: internal handoff requires an explicit positive consecutive-failure count instead of defaulting a missing count to 0 | loki-ts/src/commands/internal_phase1.ts, loki-ts/tests/commands/internal_phase1.test.ts | LOW | red: cd loki-ts && bun test tests/commands/internal_phase1.test.ts -t "handoff count" fails; green: passes | released v11.17.55 | Gap: internal_phase1.ts runHandoff: parseInt(argv[1] ?? "0") makes a missing count 0 and Number.isFinite accepts it and negatives |
-| TEN-UX-52 | fix: loki provider show with an unknown provider exits 2 and lists valid providers | loki-ts/src/commands/provider.ts, loki-ts/tests/commands/provider.test.ts | LOW | red: cd loki-ts && bun test tests/commands/provider.test.ts -t "unknown provider" fails; green: passes | released v11.17.55 | Gap: provider.ts runProviderShow accepts an unknown provider with exit 0 |
-| TEN-UX-53 | enhancement: loki --version and loki version reject extra positional arguments with exit 2 | loki-ts/src/commands/version.ts, loki-ts/tests/commands/version.test.ts | LOW | red: cd loki-ts && bun test tests/commands/version.test.ts -t "version extra args" fails; green: passes | released v11.17.55 | Gap: version.ts ignores extra positionals; probed: loki version bogus prints the version and exits 0 |
-| TEN-UX-54 | fix: loki stats writes the Unknown option message to stderr, not stdout, so --json consumers get clean output | loki-ts/src/commands/stats.ts, loki-ts/tests/commands/stats.test.ts | LOW | red: cd loki-ts && bun test tests/commands/stats.test.ts -t "stats unknown to stderr" fails; green: passes | released v11.17.55 | Gap: stats.ts computeStats returns the Unknown option text as stdout with exitCode 2 (lines 491-497) |
-| TEN-UX-55 | feature: preflight fails early with a one-line fix when the repo directory is not writable | loki-ts/src/engine10/preflight.ts, loki-ts/tests/engine10/preflight.test.ts | MEDIUM | red: cd loki-ts && bun test tests/engine10/preflight.test.ts -t "repo writable" fails; green: passes | released v11.17.55 | Gap: preflight.ts checkPreflight has no writability probe, so a read-only checkout fails mid-run on the first write. Chain ADOPTION-34, UX-55 (same file); serialize after ADOPTION-34 |
-| TEN-ADOPTION-34 | feature: preflight probes login state for codex, cline, aider and opencode like it does for claude, so loki start names the missing login before spending | loki-ts/src/engine10/preflight.ts, loki-ts/tests/engine10/preflight.test.ts | MEDIUM | red: cd loki-ts && bun test tests/engine10/preflight.test.ts -t "provider login probe" fails; green: passes | released v11.17.55 | Gap: preflight.ts checkPreflight has login probes only for claude. Chain ADOPTION-34, UX-55; serialize after none |
-| TEN-UX-56 | fix: loki start rejects a repeated single-value flag (--cap, --provider) with exit 2 instead of silently using the first | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | MEDIUM | red: cd loki-ts && bun test tests/commands/start.test.ts -t "duplicate flag" fails; green: passes | released v11.17.55 | Gap: start.ts argVal is first-occurrence-wins, so loki start p.md --cap 1 --cap 50 runs with 1 and says nothing. Serialize after the AQ start.ts chain (TEN-UX-48, 50, DEPLOY-26, UX-47, 46, 45) |
-| TEN-SPEED-24 | enhancement: run_status pickRun orders runs by events.jsonl mtime and reads only the newest, instead of reading every run's events file | loki-ts/src/commands/run_status.ts, loki-ts/tests/commands/run_status.test.ts | MEDIUM | red: cd loki-ts && bun test tests/commands/run_status.test.ts -t "pickRun mtime" fails; green: passes | released v11.17.55 | Gap: run_status.ts pickRun reads every run's events.jsonl, so loki status gets slower with each run |
-| TEN-UX-57 | fix: loki status rejects unknown flags that follow a valid one (--json --bogus) with exit 1 like a leading unknown flag | loki-ts/src/commands/status.ts, loki-ts/tests/commands/status.test.ts | LOW | red: cd loki-ts && bun test tests/commands/status.test.ts -t "status trailing flag" fails; green: passes | released v11.17.55 | Gap: status.ts runStatus returns on the first recognised flag (lines 1038-1047), so later flags are never checked |
-| TEN-ADOPTION-35 | enhancement: doctor --fix seeds the default provider from the first installed provider CLI instead of hardcoding claude | loki-ts/src/commands/doctor_fix.ts, loki-ts/tests/commands/doctor.test.ts | MEDIUM | red: cd loki-ts && bun test tests/commands/doctor.test.ts -t "seed provider" fails; green: passes | released v11.17.55 | Gap: doctor_fix.ts step 2 writes {provider: claude} even when only codex is installed. Chain ADOPTION-35, UX-58 (same file); serialize after none |
-| TEN-UX-58 | enhancement: doctor --fix backs up an invalid .loki/config/settings.json and rewrites defaults when consent is given, instead of only printing a manual line | loki-ts/src/commands/doctor_fix.ts, loki-ts/tests/commands/doctor.test.ts | MEDIUM | red: cd loki-ts && bun test tests/commands/doctor.test.ts -t "repair settings" fails; green: passes | released v11.17.55 | Gap: doctor_fix.ts lines 120-124 push a manual line for invalid JSON and never repair it. Chain ADOPTION-35, UX-58; serialize after ADOPTION-35 |
-| TEN-QUALITY-40 | enhancement: doctor.ts uses one shared version comparator instead of three copies | loki-ts/src/commands/doctor.ts, loki-ts/tests/commands/doctor.test.ts | LOW | red: cd loki-ts && bun test tests/commands/doctor.test.ts -t "one semver compare" fails; green: passes | released v11.17.55 | Gap: doctor.ts has three hand-rolled comparators (lines 98, 318, 567); extend-never-duplicate. Serialize after ADOPTION-35, UX-58 (shared doctor.test.ts) |
-| TEN-SPEED-25 | fix: resolveLatest caches a failed registry fetch for a short period so an offline machine does not wait on the network every command | loki-ts/src/util/update_check.ts, loki-ts/tests/util/update_check.test.ts | LOW | red: cd loki-ts && bun test tests/util/update_check.test.ts -t "negative cache" fails; green: passes | released v11.17.55 | Gap: update_check.ts resolveLatest returns null at the failed fetch without writeCache (line 129-130), so offline runs retry each time. Chain SPEED-25, DEPLOY-27 (same file); serialize after none |
-| TEN-DEPLOY-27 | feature: updateCommandFor returns pnpm and yarn global upgrade hints for pnpm and yarn installs | loki-ts/src/util/update_check.ts, loki-ts/tests/util/update_check.test.ts | LOW | red: cd loki-ts && bun test tests/util/update_check.test.ts -t "pnpm yarn hint" fails; green: passes | released v11.17.55 | Gap: update_check.ts updateCommandFor knows brew, bun and npm paths only; pnpm and yarn installs get the bun hint. Chain SPEED-25, DEPLOY-27; serialize after SPEED-25 |
-| TEN-GATES-31 | fix: policyGate with LOKI_POLICY_REQUIRE_NODE=0 and no node says policy was NOT evaluated in the allow reason so prGate output shows it | loki-ts/src/util/run_outputs.ts, loki-ts/tests/engine10/policy_gate.test.ts | HIGH | red: cd loki-ts && bun test tests/engine10/policy_gate.test.ts -t "policy not evaluated" fails; green: passes | released v11.17.55 | Gap: run_outputs.ts:449 returns allow when the env opt-out is set and node is missing; the reason is easy to miss. Chain GATES-31, 32 (same file); serialize after none |
-| TEN-GATES-32 | fix: policyGate reports a check.js timeout as a timeout, not as node being unavailable | loki-ts/src/util/run_outputs.ts, loki-ts/tests/engine10/policy_gate.test.ts | HIGH | red: cd loki-ts && bun test tests/engine10/policy_gate.test.ts -t "policy timeout reason" fails; green: passes | released v11.17.55 | Gap: run_outputs.ts:452-453 spawnSync timeout 30000 sets r.error and the deny reason says node is unavailable. Chain GATES-31, 32; serialize after GATES-31 |
-| TEN-ADOPTION-36 | fix: loki issues run --limit and --parallel accept only plain decimal digits (reject 1e1 and 0x10) | loki-ts/src/commands/issues_run.ts, loki-ts/tests/commands/issues_run.test.ts | LOW | red: cd loki-ts && bun test tests/commands/issues_run.test.ts -t "strict int flags" fails; green: passes | released v11.17.55 | Gap: issues_run.ts:96 Number(val()) accepts 1e1 and 0x10 as integers. Serialize after TEN-STABILITY-54 (same file) |
-| TEN-QUALITY-41 | fix: outOfRepoTarget flags a string literal such as "/home/user/project/.git" that holds no home-derived value; a literal absolute path with no homedir, HOME or expanduser value must not flag | loki-ts/src/project_model/conventions.ts, loki-ts/tests/engine10/fc23_wall_conventions.test.ts | LOW | red: cd loki-ts && bun test tests/engine10/fc23_wall_conventions.test.ts -t "literal path not flagged" fails; green: passes | ready@2026-10-19T07:00Z | Budget LOW 15m. Gap: conventions.ts:84 the home regex matches any quoted /(Users\|home\|root)/ literal, so a fixture path with no runtime home value is rejected and re-asked. Keep real homedir()/$HOME/~/ joins flagging. Generic, engine10 TypeScript. Chain QUALITY-41, 42 (same file); serialize after none |
-| TEN-QUALITY-42 | fix: outOfRepoTarget treats a file that assigns HOME anywhere as sandboxed and never flags it; narrow the exemption to lines after the assignment, or to a sandboxed (tmpdir-derived) HOME only | loki-ts/src/project_model/conventions.ts, loki-ts/tests/engine10/fc23_wall_conventions.test.ts | LOW | red: cd loki-ts && bun test tests/engine10/fc23_wall_conventions.test.ts -t "home exemption scoped" fails; green: passes | ready@2026-10-19T07:00Z | Budget LOW 15m. Gap: conventions.ts:78 returns null for the whole file on any HOME assignment, so homedir() joined into an import before the assignment passes. Chain QUALITY-41, 42; serialize after QUALITY-41 |
-| TEN-COST-63 | fix: the Wall rewrite (re-ask) session for out-of-repo files runs without checking the remaining run budget, so a run at its cap still spends a model session; skip the re-ask when the budget is spent and discard the rejected files | loki-ts/src/engine10/stages/wall.ts, loki-ts/tests/engine10/fc23_wall_conventions.test.ts | MEDIUM | red: cd loki-ts && bun test tests/engine10/fc23_wall_conventions.test.ts -t "re-ask respects budget" fails; green: passes | released v11.17.90 | Budget MEDIUM 30m. Gap: wall.ts:162 ctx.sessions.run for the -oor rewrite is gated only on bad1.length and signal.aborted; reuse the existing budget check other stages use rather than a new helper. Chain COST-63, QUALITY-43 (same file); serialize after none |
-| TEN-QUALITY-43 | enhancement: inside wallAuthor a local model variable shadows the outer one; rename it, no behaviour change | loki-ts/src/engine10/stages/wall.ts, loki-ts/tests/engine10/wall.test.ts | LOW | red: none (pure rename); green: cd loki-ts && bun test tests/engine10/wall.test.ts tests/engine10/fc23_wall_conventions.test.ts passes and bunx tsc --noEmit is clean | released v11.17.90 | Budget LOW 15m. Gap: wall.ts:146 const model shadows the outer model; the rename must leave emitted data.model and the WallAuthored.model field unchanged. Chain COST-63, QUALITY-43; serialize after COST-63 |
-| TEN-QUALITY-44 | fix: the implement-stage bug-repro test is not covered by the outOfRepoTarget check, so a repro test that imports the code under test from the user home goes unflagged; apply the same check and re-ask path (sibling of FC-WALL-OUT-OF-REPO-TARGET) | loki-ts/src/engine10/stages/implement.ts, loki-ts/tests/engine10/implement.test.ts | MEDIUM | red: cd loki-ts && bun test tests/engine10/implement.test.ts -t "repro test out of repo" fails; green: passes | ready@2026-10-19T07:00Z | Budget MEDIUM 30m. Gap: implement.ts:38 REPRO_LINE asks for a new reproducing test but nothing checks its target; reuse outOfRepoTarget from project_model/conventions.ts, add the row to docs/v10/FAILURE-CLASSES.md sibling sweep. Serialize after QUALITY-41 and 42 |