loki-mode 11.76.0 → 11.78.0

package/docs/PRIVACY.md

@@ -68,15 +68,48 @@ paths, keys, or repo names -- only anonymous diagnostics.
 
 - Endpoint: `https://us.i.posthog.com/capture/` (override with
   `LOKI_TELEMETRY_ENDPOINT`). The PostHog project key is a public ingest key.
-- Events: `install` (on `npm install`), `session_start`, `session_end`,
-  `cli_command`, and `dashboard_start`.
-- Exact payload (every event): `os` (uname system), `arch` (CPU arch),
-  `version` (Loki Mode version), `channel` (npm / docker / homebrew / skill /
-  source), and a random per-machine `distinct_id` (a uuid4 stored in
-  `~/.loki-telemetry-id`, never an email or name). The `install` event also adds
-  `node_version` and `providers_installed` (which provider CLIs were detected,
-  e.g. "claude,codex"). Some events add a small free-of-PII property such as the
-  command name. No code, prompts, paths, keys, repo names, emails, or IPs.
+- One allowlisted schema, enforced in the send path of every sender (the bash
+  sender in `autonomy/telemetry.sh`, the dashboard sender in
+  `dashboard/telemetry.py`, and the build-outcome reader
+  `autonomy/lib/proof-analytics-props.py`). The schema is
+  `autonomy/lib/telemetry-schema.json`. An event that is not listed there is not
+  sent. A property that is not listed is dropped. A value outside its enum, type
+  or range is dropped, never truncated or forwarded. The opt-out check runs
+  before any of this, so `LOKI_TELEMETRY=off` and `DO_NOT_TRACK=1` make zero
+  network calls.
+- Exactly what is sent. Every event carries a random per-machine `distinct_id`
+  (a uuid4 stored in `~/.loki-telemetry-id`, never an email or name) and these
+  common properties:
+
+  | Property | Values |
+  |---|---|
+  | `os_family` | linux, darwin, windows, other (a raw uname such as `MINGW64_NT-10.0-19045` is folded to `windows`) |
+  | `arch` | x64, arm64, other |
+  | `version` | the Loki Mode semver |
+  | `channel` | npm, docker, homebrew, skill, source, unknown |
+  | `traffic` | user, ci, internal (derived from CI environment variables, a non-interactive session, or an internal marker, so analytics can filter automation and our own use) |
+  | `introspective` | true or false, present on every event (false unless the event carries a command; true for version, help, completion, memory and internal commands, so they are flagged rather than counted as usage) |
+
+  Per-event properties, and nothing else:
+
+  | Event | Fires | Extra properties |
+  |---|---|---|
+  | `installed` | first command ever run | `first_command` (a known loki subcommand, else `other`) |
+  | `cli_command` | each command | `command` (a known loki subcommand, else `other`) |
+  | `session_start` | a run starts (legacy engine) | `provider` (claude, codex, cline, aider, opencode), `complexity` (simple, standard, complex), `parallel` (true or false) |
+  | `session_end` | a run ends (legacy engine) | `provider`, `duration` (seconds), `iterations` (count), `result` (exit code 0 to 255) |
+  | `dashboard_start` | the dashboard starts | none |
+  | `first_start_attempted` | first `loki start`, strict opt-in (section 4) | `entry` (a known loki subcommand, else `other`) |
+  | `first_run_blocked` | first run stopped, strict opt-in (section 5) | `blocker` (fixed enum, section 5) |
+  | `build_verified` | a build finishes, strict opt-in (section 4) | see section 4 |
+
+  The `install` event of older versions is now `installed`. The npm postinstall
+  script sends nothing. There are no `node_version` or `providers_installed`
+  properties.
+- Never sent, by construction (nothing in the schema can carry them): prompts,
+  PRD or issue text, code or diffs, file paths or names, repo names or URLs,
+  branch names, raw error text or stack traces, environment variable values,
+  secrets, emails, usernames, hostnames, or IP addresses.
 
 ### 3. Welcome page form (anonymous, explicit submit, opt-in)
 
@@ -105,9 +138,12 @@ field not named there is never read, so a schema change cannot silently start
 sending something new. Fields sent:
 
 - headline (a bounded enum: VERIFIED / VERIFIED WITH GAPS / NOT VERIFIED)
-- evidence_gate_verdict, final_verdict (bounded verdict strings)
+- evidence_gate_verdict (PASS, BLOCK) and final_verdict (APPROVED, REJECTED,
+  APPROVE, REJECT, COMPLETE, CONTINUE); any other string is dropped. A test
+  pins both lists to the values the producers write.
 - iterations, files_changed_count (a COUNT -- never the file paths)
 - wall_clock_sec, gates_passed, gates_total, gate_pass_rate
+- route (engine10 only: the default engine sends just headline=VERIFIED and route)
 
 It NEVER sends your spec/PRD text, file paths or names, code, or diffs. Because
 it sits below the base telemetry gate, every telemetry opt-out (`loki telemetry
@@ -129,7 +165,7 @@ provider, no key and no spend). Nobody could see that happening.
 
 The ONLY field is `blocker`, clamped to this fixed enum:
 
-    no_provider | node | python3 | jq | git | curl | disk | skill_symlink | other
+    no_provider | not_logged_in | not_a_repo | git_identity | node | python3 | jq | git | curl | disk | skill_symlink | other
 
 Anything not on that list becomes `other`. It is deliberately coarse: `node` is
 enough to act on, and a version string or an install path would be a leak. It

package/docs/V10-RESEARCH.md

@@ -50,7 +50,7 @@ Vendor figures are vendor claims. Re-check a source before quoting it publicly.
 - **Scale verification depth by risk.** Meta's Diff Risk Score does this. Source: [VEN].
 
 ### 6. Adoption: sell verified outcomes and reclaimed review time
-- **Perceived speed is not real speed.** METR RCT: experienced developers were 19% slower with AI while believing they were 20% faster. The 2026 follow-up is inconclusive. Source: [research org].
+- **Perceived speed is not real speed.** METR RCT: experienced developers were 19% slower with AI while believing they were 20% faster. The 2026 follow-up is inconclusive. Source: METR RCT, arXiv 2507.09089 [PRE]. <!-- claim-ok -->
 - **Review is where the gains are lost.** AI raised PRs 98%, review time 91% and PR size 154%. Source: Faros 2025 [VEN].
 - **Developers do not check what they distrust.** 96% do not fully trust AI code; only 48% always verify it. Source: Sonar 2026 [VEN].
 - **Acceptance depends on task type.** Agent PR acceptance runs from 82.1% for docs to 66.1% for new features. Source: MSR 2026 [PR].

package/docs/architecture/ADR-001-runtime-migration.md

@@ -111,7 +111,7 @@ All three viable options (Bun runtime, Bun compiled, Go binary) keep the `npm in
 **Pro:**
 - **Anthropic owns Bun.** Strategic alignment with the company that owns the model we depend on.
 - Native shell built in (`Bun.$\`echo hello\``) - minimal friction porting bash idioms.
-- Bun's `npm install` is 20-40x faster than npm - every CI run faster.
+- Bun's package install is faster than npm's (a vendor claim, not measured in this ADR).
 - TypeScript: types catch bugs bash can't.
 - Anthropic-funded development means Bun improvements specifically target AI agent workloads.
 - 98% Node.js compatibility - npm packages work directly.
@@ -150,7 +150,7 @@ Reasons:
 4. **Hybrid is now harder to justify.** When bash loses by 8.6x on the actual workload, keeping it for 3 ms theoretical wins on hello-world is bad engineering.
 5. **Go would still be 2-4x faster than Bun** in absolute cold-start, but: zero existing Go in the codebase, no Anthropic alignment, larger rewrite cost, no JS ecosystem reuse. Unless Loki specifically targets the sub-millisecond CLI category (which it doesn't - every command runs in a multi-second/minute autonomous loop), the absolute speed delta doesn't justify the strategic cost.
 
-**If user explicitly wants the absolute fastest:** Go (Option A) is 2.5x faster than Bun. But for orchestrator-heavy work where most time is spent waiting on Claude API calls, the difference is invisible.
+**If user explicitly wants the absolute fastest:** Go (Option A) starts in 1.8 ms against Bun's 6.9-7.6 ms (Layer 1 table). But for orchestrator-heavy work where most time is spent waiting on Claude API calls, the difference is invisible.
 
 ## Migration plan (Option C)
 
@@ -168,7 +168,7 @@ Reasons:
 
 ### Phase 3: Build/release tooling
 - Replace npm publish with `bun publish` in CI
-- Replace legacy-ui esbuild with `bun build` (already 4-5x faster)
+- Replace legacy-ui esbuild with `bun build`
 - Replace pytest where possible with `bun test` for non-Python tests
 - Measure: full CI wall time, npm install time
 
@@ -193,10 +193,10 @@ Reasons:
 
 | Today | Tomorrow | Win |
 |---|---|---|
-| `npm publish` (45-60 sec) | `bun publish` | ~5x faster CI publish |
-| `npm install -g loki-mode` for users | Same UX, `bun install` under the hood when available | 20-40x faster install (verified) |
-| Tests via `npm test` (Node 20-25 sec) | `bun test` for non-Python | ~10x faster test runs |
-| Dashboard build with esbuild (122 ms) | `bun build` | 2-4x faster |
+| `npm publish` (45-60 sec) | `bun publish` | Faster CI publish (projected, not measured) |
+| `npm install -g loki-mode` for users | Same UX, `bun install` under the hood when available | Faster install (vendor claim, not measured here) |
+| Tests via `npm test` (Node 20-25 sec) | `bun test` for non-Python | Faster test runs (projected, not measured) |
+| Dashboard build with esbuild (122 ms) | `bun build` | Faster build (projected, not measured) |
 | Per-iteration cold start in run.sh: bash 4.5ms × N | Compiled Bun start once, run 100s | Net negative if iteration count low; net positive for sessions >5 iterations |
 | Python `mcp/server.py` | Stays Python (already good) | No change |
 

package/docs/cursor-comparison.md

@@ -125,7 +125,7 @@ BOOTSTRAP -> DISCOVERY -> ARCHITECTURE -> INFRASTRUCTURE
      -> DEVELOPMENT -> QA -> DEPLOYMENT -> GROWTH (continuous)
 ```
 
-**41 Specialized Agent Roles across 8 domains** (prompt-defined specifications the orchestrator adopts per phase; parallel review council and optional worktree streams on Claude Code, sequential on other providers):
+**Role inventory: 41 prompt-defined roles across 8 domains** (`agents/types.json`; specifications the orchestrator adopts per phase; parallel review council and optional worktree streams on Claude Code, sequential on other providers):
 - Engineering (8 types)
 - Operations (8 types)
 - Business (8 types)

package/docs/dev/architecture-reference.md

@@ -82,7 +82,7 @@ time-to-first-preview write-once (bash route only).
 
 ## Anthropic SDK upgrade capability matrix (RQ-104, 2026-10-23)
 
-Pins (exact, all sites): `@anthropic-ai/sdk` 0.124.0 -> 1.2.0 (loki-ts/package.json, loki-ts/bun.lock, docker/Dockerfile peer pin); `@anthropic-ai/claude-agent-sdk` 0.3.293 -> 0.3.309 (loki-ts/package.json, package.json, package-lock.json, bun.lock, docker/Dockerfile). `tests/test-sdk-version-sync.sh` asserts both. Sources: sdk CHANGELOG 0.125.0..1.2.0, agent-sdk CHANGELOG 0.3.294..0.3.309.
+Pins (exact, all sites): `@anthropic-ai/sdk` 0.124.0 -> 1.3.0 (loki-ts/package.json, loki-ts/bun.lock, docker/Dockerfile peer pin); `@anthropic-ai/claude-agent-sdk` 0.3.293 -> 0.3.312 (loki-ts/package.json, package.json, package-lock.json, bun.lock, docker/Dockerfile). `tests/test-sdk-version-sync.sh` asserts both. Sources: sdk CHANGELOG 0.125.0..1.3.0, agent-sdk CHANGELOG 0.3.294..0.3.312.
 
 | Change | Status |
 |---|---|
@@ -120,6 +120,11 @@ Default-on in the Bun runner (see `CHANGELOG.md` v7.x entries; documented in `sk
 
 These knobs together implement the RARV-C (closure) loop: findings -> override council -> learnings -> handoff. Reference: `skills/quality-gates.md`, `CHANGELOG.md` entries from v7.x for default-on flip and override-council semantics.
 
+## engine10 sizing knobs (`loki-ts/src/engine10/sizing.ts`)
+
+- `LOKI_E10_SMALL_NO_RUNNER` -- default on: a missing test runner no longer disqualifies a task from "small". A small task skips the plan session (the implementer plans) and the skipped plan writes `plan-scope.json` from the files the task names. Set to `0` to make a missing runner force "normal".
+- `LOKI_E10_SMALL_MAX_CHARS` -- task text length above which a task is not small (positive number, default 600; an invalid value falls back to 600 with a stderr note).
+
 ## Worktree substrate (autonomy/lib/worktree_prep.py)
 
 `prepare_worktree(source_repo, dest, branch, setup=None, base=None)` creates an isolated git worktree and returns `{path, base_sha, deps, left_out_changes}`. The start point is `origin/HEAD` after a fetch (when a remote exists), else HEAD. Uncommitted edits in the source checkout are never carried or stashed; their count is reported as `left_out_changes`. An fcntl lock at `~/.loki/repos/<slug>.lock` covers fetch and worktree add. Dependencies: a `setup` command run in the worktree, else a copy-on-write copy of ignored top-level `node_modules`, `.venv`, `venv`, `vendor` (refused as "copy unsafe, declare setup" if it holds absolute symlinks or editable finders), else `none`. CLI: `python3 autonomy/lib/worktree_prep.py SRC DEST BRANCH [--setup CMD] [--base REF]` prints the result as JSON. Not yet wired into backlog or the UI.
@@ -137,7 +142,7 @@ extract_learnings_from_session (autonomy/run.sh) mirrors learnings and decisions
 
 - Wall publish (FC-VERIFIED-PR-WITHOUT-ITS-TEST): on a VERIFIED seal only, `publishWall` (`util/check_result.ts`, called from `stages/seal.ts`) makes ONE child commit (trailer `Loki-Wall-Publish: <runId>`) of the SEALED Wall bytes (`runDir/wall`, hash-checked against `wall.files[].sha256`) that verify ran and passed (`publishableWall`). Before writing, the realpath of each Wall file's parent directory must be inside the repo, and an existing file or symlink is removed first. The child commit runs with hooks and signing OFF (the default `git()` call, no `userHooks`), so a pre-commit hook cannot add files or rewrite the Wall bytes. Afterwards the commit must touch exactly the published paths and each committed blob must equal the blob hash of the sealed bytes (computed in process, never read from the worktree); on any mismatch the child is rolled back (`update-ref` HEAD to the product head plus `read-tree`), nothing is published and a NOT PROVEN note is added. The receipt binds the PRODUCT head (head_sha, tree, diff_sha256 are computed before the child commit). A re-seal binds `HEAD^` only when HEAD's message has the exact trailer line for this run, HEAD touches only paths of this run's `wall.files`, and every blob sha256 matches (`wallChild`); a forged trailer is not enough. `util/seal_drift.ts` accepts a moved HEAD after head_sha as benign only when every commit after it is such a Wall publish commit (linear, trailer line for the receipt's run_id, only `wall.files` paths, blob sha256 equal to the sealed one); any commit after head_sha that carries this run's trailer but fails that check is head drift (UNCHECKED). Later commits without the trailer stay under the TEN-GATES-16 sealed-path overlap rule. The PR body gains an "Acceptance tests" section. Commit stage and `backstopCommit` still drop Wall files. `LOKI_COMMIT_WALL=0` restores the old behavior (nothing published).
 
-### Python anthropic SDK (RQ-105: pinned `anthropic==2.2.0`)
+### Python anthropic SDK (RQ-105: pinned `anthropic==2.3.0`)
 
 `mcp/requirements.txt` pins the Python SDK exactly (was `>=0.40,<1.0.0`; the resolver landed on 0.125.0). Requires Python >=3.10 (Ubuntu 24.04 image ships 3.12). The SDK runs on `httpx2`; no repo code passes `httpx` objects to it. v2.0.0 changes (API version 2026-10-21): `temperature`/`top_p`/`top_k` removed from Messages (no call site uses them), Admin API field renames (unused). Python-side call sites: `memory/managed_memory/client.py` (the only importer) and `providers/managed.py` (lazy import, `tests/managed/test_registry_lazy.py` contract unchanged).
 

package/docs/dev/project-structure.md

@@ -61,7 +61,8 @@ events/                     # Unified Event Bus (v5.17.0)
   emit.sh                   # Bash helper for emitting events
 docs/                       # Architecture documentation
   SYNERGY-ROADMAP.md        # 5-pillar tool integration architecture
-  v10/                      # User guides: GUIDE.md, GUIDE-MODERNIZE.md, CLI-MODERN.md, DEPS.md
+  CLI-INVENTORY.md          # Generated command inventory (from loki-ts/src/cli/registry.ts)
+  v10/                      # User guides: GUIDE.md, GUIDE-MODERNIZE.md, DEPS.md
   dev/                      # Developer reference docs (this file and its siblings)
 autonomy/                   # Runtime and autonomous execution
   context-tracker.py        # Context window usage tracking

package/docs/image-provenance.md

@@ -16,10 +16,16 @@ delivers is worse than none, because it is exactly what an auditor will test.
 | Container image (`asklokesh/loki-mode`) | first release after v8.5.2 | first release after v8.5.2 through v11.17.98 |
 | npm tarball (`loki-mode`) | v7.4.10 and later | v7.4.10 through v11.17.98 |
 
-**Releases after v11.17.98 ship no SBOM.** The release workflow was cut to the
-minimum that publishes (so every channel is live within minutes of a version
-bump), and SBOM generation and attestation were removed with it. The image is
-still signed. Generate an SBOM yourself with `syft` (see below) if you need one.
+**Releases after v11.17.98 carry no CycloneDX image attestation.** The release
+workflow was cut to the minimum that publishes, and that attestation was removed
+with it. Releases from the first one that includes the `attach-sbom` job carry
+two replacements, both produced by steps marked `continue-on-error` so a failure
+never blocks a distribution channel: SPDX JSON SBOMs
+(`loki-mode-npm.spdx.json`, `loki-mode-image.spdx.json`) attached to the GitHub
+Release by the `attach-sbom` job, and GitHub build provenance attestations
+(`actions/attest-build-provenance`) for the npm tarball and the image digest.
+Because those steps are best effort, a given release can lack them: check the
+release assets before relying on one. The image is still signed.
 
 **Images published up to and including v8.5.2 are not signed and have no SBOM.** A signing
 workflow existed from v7.4.10 but was triggered on `release: published`, and
@@ -66,9 +72,10 @@ name `release.yml` in this repository.
 
 ## Verify and read the SBOM
 
-Applies to images through v11.17.98 only; later images carry no SBOM
-attestation, so this command fails for them by design. For those, run `syft`
-against the digest (shown at the end of this section).
+The CycloneDX attestation below applies to images through v11.17.98 only;
+later images carry no such attestation, so that command fails for them by
+design. For later releases, download the SPDX JSON SBOM from the GitHub Release
+assets, or run `syft` against the digest (shown at the end of this section).
 
 The SBOM is attached to the image as a CycloneDX attestation. Note this is a
 *separate* artifact from the npm SBOM published on the GitHub Release: the
@@ -105,6 +112,24 @@ syft "asklokesh/loki-mode:${VERSION}" --platform linux/arm64 -o cyclonedx-json
 Feed `image-sbom.cdx.json` to Grype, Trivy, Dependency-Track or any other
 CycloneDX consumer for CVE scanning.
 
+## Verify build provenance
+
+Releases that carry the attestations (see the coverage section) can be checked
+with the GitHub CLI against the public attestation store:
+
+```sh
+# npm tarball, downloaded with: npm pack loki-mode@<version>
+gh attestation verify loki-mode-<version>.tgz --repo asklokesh/loki-mode
+
+# container image, by digest
+gh attestation verify "oci://index.docker.io/asklokesh/loki-mode@${DIGEST}" \
+  --repo asklokesh/loki-mode
+```
+
+A pass confirms the artifact was built by this repository's release workflow.
+A failure on a release that predates the attestation step, or on one where the
+best effort step did not run, is expected.
+
 ## Air-gapped environments
 
 Both commands above reach the public sigstore infrastructure (Rekor and

package/docs/slack.md

@@ -33,3 +33,5 @@ Bot token scopes: `app_mentions:read`, `chat:write`, `channels:history` (and `gr
 Subscribe to bot events: `app_mention`, `message.channels` (plus `message.groups` for private channels).
 
 Outbound notifications (PR opened, BLOCKED, finished) are separate and use `LOKI_SLACK_WEBHOOK_URL`.
+
+Stuck-run alert: if a live run writes no event for `LOKI_STUCK_MIN` minutes (default 15), one alert names the last stage, its event time and a suggested action. It always prints to stderr and also goes to Slack when a webhook is set. A new event clears the alert, and a later silence can alert again. Checked on the 15-second supervisor beat. A value of 0, a negative number or a non-number falls back to 15.

package/docs/v11/COST-HALF.md

@@ -28,7 +28,8 @@ see, read earlier, or edit the Wall checks. No slice skips wall, verify, commit,
 | Haiku 5.5, prompt <= 100K | 0.10 | 0.125 | 0.01 | 0.50 |
 | Haiku 5.5, prompt > 100K | 0.50 | 0.625 | 0.05 | 2.50 |
 
-- Sonnet is 2x cheaper than Opus. Haiku is 20x cheaper than Sonnet, but only under 100K.
+- From the table: Sonnet costs half of Opus on every column. Under 100K, Haiku input, cache write and
+  output cost 1/20 of Sonnet's, and Haiku cache reads cost 1/10.
 - Cache reads cost 0.05x input on Opus and Sonnet.
 - The advisor tool definition alone is about 1,000 prompt tokens per request.
 - Drift found: loki-ts/data/model-pricing.json says Opus is 5/25/0.5/6.25 and Sonnet's cache read is