loki-mode 11.88.0 → 11.90.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Runs an autonomous software factory that knows what it is supposed to deliver and proves it did, with a signed receipt. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v11.88.0
+# Loki Mode v11.90.0
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the previous bash loop. PRD-file starts (`loki start ./prd.md`) and the opencode provider still run on it until FC38-SWEEP ports them; the legacy-engine command and the LOKI_ENGINE switch remain removed. Prefer `loki owner/repo#N` for issues.
 
@@ -475,4 +475,4 @@ Implemented, planned and deprecated items, with the version each landed in: `ski
 
 ---
 
-**v11.88.0 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v11.90.0 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-11.88.0
+11.90.0

package/autonomy/lib/backlog.py

@@ -378,6 +378,15 @@ def main(argv):
                 tmp = dst + ".tmp%d" % os.getpid()
                 shutil.copyfile(src, tmp)
                 os.replace(tmp, dst)
+            # The sealed Wall copies travel with the receipt: integrate reruns them on the merged tree after the worktree is gone.
+            wsrc, wdst = os.path.join(src_dir, "wall"), os.path.join(dst_dir, "wall")
+            if os.path.isdir(wsrc) and not os.path.islink(wsrc) and not os.path.islink(wdst):
+                shutil.rmtree(wdst, ignore_errors=True)
+                os.makedirs(wdst, mode=0o700, exist_ok=True)
+                for name in os.listdir(wsrc):
+                    f = os.path.join(wsrc, name)
+                    if os.path.isfile(f) and not os.path.islink(f):
+                        shutil.copyfile(f, os.path.join(wdst, name))
         except OSError:
             pass
 

package/autonomy/lib/claude-flags.sh

@@ -1174,3 +1174,16 @@ _loki_claude_permission_argv() {
     _LOKI_PERM_ARGV=()
     while IFS= read -r _a; do _LOKI_PERM_ARGV+=("$_a"); done <<< "$_out"
 }
+
+# SHELL value for a claude child. Claude Code's Bash tool replays the aliases of
+# the shell named in SHELL, so a user's `alias ls=eza` hangs agent Bash commands.
+# Pin /bin/bash when executable (same rule as the engine10 route,
+# loki-ts/src/runner/worker_proc.ts pinBashShellEnv); LOKI_E10_KEEP_USER_SHELL=1
+# keeps the user's shell. Only SHELL changes; claude spawn sites only.
+_loki_claude_shell_value() {
+    if [ "${LOKI_E10_KEEP_USER_SHELL:-}" != "1" ] && [ -x /bin/bash ]; then
+        printf '%s' "/bin/bash"
+    else
+        printf '%s' "${SHELL-}"
+    fi
+}

package/autonomy/loki

@@ -28170,13 +28170,75 @@ _pr_record_merge() {
     return 0
 }
 
+# Owner opt-in earned merge (LOKI_EARNED_MERGE=1, off by default). Every path
+# the PR changes (the new name and, for a rename, the previous name, listed by
+# paginated REST and required to match the PR's changedFiles count) must have a
+# Seal record from `loki trust --json` (path_seals) with at least
+# LOKI_EARNED_MERGE_MIN_VERIFIED (default 20, floor 1) VERIFIED receipts and
+# exactly 0 reverts in git history. A revert count of null (history
+# unreadable), a missing record, an unreadable trust output or an unreadable or
+# truncated file list or an unreadable diff all refuse, as does any PR whose
+# diff touches a symlink (120000) or submodule (160000) mode. Protected paths (.github/, .loki/, .env*,
+# .envrc, CODEOWNERS, plus the space-separated globs in
+# LOKI_EARNED_MERGE_PROTECTED), matched case-insensitively, always stay
+# PR-only. The reason for a refusal goes to stdout; the return code is 1.
+_pr_earned_merge_check() {
+    local pr="$1" min="${LOKI_EARNED_MERGE_MIN_VERIFIED:-20}" meta="" num="" want="" lines="" seals=""
+    local kind p lp g row v r got=0 globs=() diff="" bad_mode=""
+    case "$min" in ''|*[!0-9]*) min=20 ;; esac
+    [ "$min" -ge 1 ] || min=1
+    command -v jq >/dev/null 2>&1 || { echo "jq is required to read the Seal record"; return 1; }
+    meta="$(gh pr view "$pr" --json number,changedFiles -q '"\(.number) \(.changedFiles)"' 2>/dev/null)" || meta=""
+    num="${meta%% *}"; want="${meta#* }"
+    case "$num$want" in ''|*[!0-9]*) echo "the PR's changed files are unreadable"; return 1 ;; esac
+    lines="$(gh api --paginate "repos/{owner}/{repo}/pulls/${num}/files" -q '.[] | ("F\t" + .filename), (select(.previous_filename != null) | "P\t" + .previous_filename)' 2>/dev/null)" || lines=""
+    [ -n "$lines" ] || { echo "the PR's changed files are unreadable"; return 1; }
+    seals="$("$_LOKI_SCRIPT_DIR/../bin/loki" trust --json 2>/dev/null)" || seals=""
+    printf '%s' "$seals" | jq -e '.path_seals | type == "array"' >/dev/null 2>&1 || { echo "the Seal record is unreadable"; return 1; }
+    # read -a splits on whitespace without expanding globs against the cwd.
+    read -r -a globs <<EOF_GLOBS
+$(printf '%s' "${LOKI_EARNED_MERGE_PROTECTED:-}" | tr '[:upper:]' '[:lower:]')
+EOF_GLOBS
+    while IFS="$(printf '\t')" read -r kind p; do
+        [ -n "$p" ] || continue
+        [ "$kind" = "F" ] && got=$((got + 1))
+        lp="$(printf '%s' "$p" | tr '[:upper:]' '[:lower:]')"
+        case "$lp" in .github/*|.loki/*|.env|.env.*|*/.env|*/.env.*|.envrc|*/.envrc|codeowners|docs/codeowners)
+            echo "$p is a protected path"; return 1 ;;
+        esac
+        for g in ${globs[@]+"${globs[@]}"}; do
+            # shellcheck disable=SC2254
+            case "$lp" in $g) echo "$p is a protected path"; return 1 ;; esac
+        done
+        row="$(printf '%s' "$seals" | jq -r --arg p "$p" '[.path_seals[] | select(.path == $p)] | if length == 0 then "none" else "\(.[0].verified) \(.[0].reverts)" end')" || row="none"
+        [ "$row" != "none" ] || { echo "$p has no Seal record"; return 1; }
+        v="${row%% *}"; r="${row#* }"
+        case "$r" in
+            0) ;;
+            null) echo "$p revert status is unknown"; return 1 ;;
+            *) echo "$p has $r recorded revert(s)"; return 1 ;;
+        esac
+        [ "$v" -ge "$min" ] 2>/dev/null || { echo "$p has $v VERIFIED receipts, need $min"; return 1; }
+    done <<EOF_FILES
+$lines
+EOF_FILES
+    [ "$got" = "$want" ] || { echo "the PR lists $want changed files but $got were readable"; return 1; }
+    # A symlink (120000) or submodule (160000) can point an earned path anywhere:
+    # refuse any PR whose diff adds, removes, changes or re-modes one.
+    diff="$(gh pr diff "$pr" 2>/dev/null)" || diff=""
+    [ -n "$diff" ] || { echo "the PR's file modes are unreadable"; return 1; }
+    bad_mode="$(printf '%s\n' "$diff" | awk '/^diff --git /{h=$0} /^(new file mode|deleted file mode|old mode|new mode) (120000|160000)$/{print h; exit} /^index [0-9a-f.]+ (120000|160000)$/{print h; exit}')"
+    [ -z "$bad_mode" ] || { echo "${bad_mode#diff --git } involves a symlink or submodule"; return 1; }
+    return 0
+}
+
 # Shared merge gate. One PR (number or branch) merges only when it is not a
 # draft, `gh pr checks` exits 0 after polling pending (rc=8), and, with
 # --require-verified, every clean proof recorded for the PR's head commit
 # (facts.git.head_sha == headRefOid, dirty-tree proofs ignored) says VERIFIED; a stale or missing proof
 # refuses ("gate: head"). The merge passes --match-head-commit so a push after
 # the gate cannot land unjudged. On refusal it prints the exact blocking gate
-# ("gate: draft|head|verdict|checks") and leaves the PR open.
+# ("gate: draft|head|verdict|trust|checks") and leaves the PR open.
 # Usage: _merge_pr_gated <pr> [--require-verified] [--delete-branch]
 _merge_pr_gated() {
     local pr="$1" need_verified=false margs=(--squash) rc d
@@ -28252,6 +28314,14 @@ _merge_pr_gated() {
             return 1
         fi
     fi
+    if [ "${LOKI_EARNED_MERGE:-0}" = "1" ]; then
+        local trust_why=""
+        trust_why="$(_pr_earned_merge_check "$pr")" || {
+            echo "$pr: not merged, gate: trust ($trust_why); PR left open" >&2
+            _pr_record_merge "$pr" "blocked:trust" "trust"
+            return 1
+        }
+    fi
     rc=0; _pr_checks_wait "$pr" || rc=$?
     if [ "$rc" != "0" ]; then
         echo "$pr: not merged, gate: checks (gh pr checks rc=$rc); PR left open" >&2

package/autonomy/route.sh

@@ -60,9 +60,60 @@ _route_json_str() {
     printf '%s' "$1" | tr '\n\t\r' '   ' | sed -e 's/\\/\\\\/g' -e 's/"/\\"/g'
 }
 
+# Echoes the canonical https://github.com/owner/repo/pull/N for a github.com pull request URL
+# (host case-insensitive, optional www., http or https, optional /files style suffix); echoes nothing otherwise.
+# The owner/repo shape mirrors parsePrRef in loki-ts/src/commands/verify_pr.ts.
+_route_pr_url() {
+    local re='^[Hh][Tt][Tt][Pp][Ss]?://([Ww][Ww][Ww]\.)?[Gg][Ii][Tt][Hh][Uu][Bb]\.[Cc][Oo][Mm]/([A-Za-z0-9][A-Za-z0-9_.-]*/[A-Za-z0-9][A-Za-z0-9_.-]*)/pull/([0-9]+)([/?#].*)?$'
+    if [[ "$1" =~ $re ]]; then printf 'https://github.com/%s/pull/%s' "${BASH_REMATCH[2]}" "${BASH_REMATCH[3]}"; fi
+}
+
+# `loki start <PR URL> [--json] [--out DIR] [--no-pr]` is the verify-pr command, whatever the flag order.
+# Returns 1 when no argument is a PR URL (the caller carries on). Otherwise sets R_* (R_PR_ARGS = the verify-pr argv)
+# and returns 0; an unsupported flag or a second input sets R_ERR.
+# shellcheck disable=SC2034
+_route_pr_mode() {
+    local a pr="" bad="" badref="" extra="" i=0 n=$# u
+    local -a argv=("$@") eargs=()
+    for u in "$@"; do
+        case "$u" in --help|-h) return 1 ;; esac
+    done
+    while [ "$i" -lt "$n" ]; do
+        a="${argv[$i]}"; i=$((i + 1))
+        case "$a" in
+            --explain-route) R_EXPLAIN=1 ;;
+            --json) eargs+=(--json); R_JSON=1 ;;
+            --no-pr) ;;
+            --out) eargs+=(--out "${argv[$i]:-}"); i=$((i + 1)) ;;
+            --out=*) eargs+=(--out "${a#--out=}") ;;
+            -*) [ -n "$bad" ] || bad="${a%%=*}" ;;
+            *)
+                u="$(_route_pr_url "$a")"
+                # PR-shaped but invalid (a ".." in owner/repo): refused, like parsePrRef in verify_pr.ts.
+                if [ -n "$u" ]; then case "${u#https://github.com/}" in *..*) [ -n "$badref" ] || badref="$a" ;; esac; fi
+                if [ -n "$u" ] && [ -z "$pr" ]; then pr="$u"; else extra="${extra:+$extra }$a"; fi ;;
+        esac
+    done
+    [ -n "$pr" ] || return 1
+    R_DECIDED=1; R_INPUT_TYPE="pr"; R_INPUT="$pr"; R_ENGINE="verify-pr"; R_ADAPTER="verify-pr"
+    R_PROVIDER="n/a"; R_MODEL="n/a (no model call)"
+    R_REASON="pull request URL: verify-pr seals it; no plan or implement stage, nothing is pushed"
+    if [ -n "$badref" ]; then
+        R_ERR="loki: start <PR url>: not a valid pull request URL: $badref"
+    elif [ -n "$bad" ]; then
+        R_ERR="loki: start <PR url>: flag $bad is not supported (verify-pr takes --out DIR, --json and --no-pr)"
+    elif [ -n "$extra" ]; then
+        R_ERR="loki: start <PR url> takes one input; also got: $extra"
+    else
+        R_PR_ARGS=("$pr" ${eargs[@]+"${eargs[@]}"})
+    fi
+    return 0
+}
+
 _route_classify() {
-    # $1 = single positional. Echoes: issue | prd | task | brief | missing-prd
+    # $1 = single positional. Echoes: pr | issue | prd | task | brief | missing-prd
     local p="$1"
+    if [ -n "$(_route_pr_url "$p")" ]; then echo pr; return 0; fi
     case "$p" in
         */*\#[0-9]*|http*://*/issues/*|http*://*/browse/*|jira:*|linear:*|https://linear.app/*/issue/*) echo issue; return 0 ;;
     esac
@@ -83,7 +134,8 @@ loki_route_resolve() {
     local verb="$1"; shift
     R_DECIDED=0; R_E10=0; R_HARD=0; R_ENGINE=""; R_REASON=""; R_INPUT_TYPE=""; R_INPUT=""
     R_PROVIDER=""; R_MODEL=""; R_NOTICE=""; R_ERR=""; R_EXPLAIN=0; R_JSON=0; R_SESSION_MODEL=""; R_VERB=""
-    R_E10_ARGS=(); R_CLEAN=(); R_ADAPTER=""; R_CAPDIFF=(); R_E10_CAP_S=""; R_DRY=0; R_MAXCOST=""
+    R_E10_ARGS=(); R_CLEAN=(); R_ADAPTER=""; R_CAPDIFF=(); R_E10_CAP_S=""; R_DRY=0; R_MAXCOST=""; R_PR_ARGS=()
+    if [ "$verb" = "start" ] && _route_pr_mode "$@"; then return 0; fi
 
     local a engine_req="" dry=0 help=0 legacy_flag="" session_model="" provider_flag="" max_duration="" cap_err="" input_flag=""
     local -a positionals=() passthru=()
@@ -171,6 +223,8 @@ loki_route_resolve() {
         R_INPUT="(from --spec)"
     elif [ "$npos" -eq 1 ]; then
         R_INPUT_TYPE=$(_route_classify "${positionals[0]}")
+        # Only `loki start` sends a PR URL to verify-pr (_route_pr_mode); on any other verb engine10 runs it as a brief.
+        if [ "$R_INPUT_TYPE" = "pr" ]; then R_INPUT_TYPE=brief; fi
         R_INPUT="${positionals[0]}"
     else
         R_INPUT_TYPE=task

package/autonomy/run.sh

@@ -6874,12 +6874,12 @@ spawn_worktree_session() {
                 _LOKI_PERM_ARGV=(--dangerously-skip-permissions)
                 ! type _loki_claude_permission_argv >/dev/null 2>&1 || _loki_claude_permission_argv
                 if [ -n "$_loki_wt_cm" ]; then
-                    CAVEMAN_DEFAULT_MODE="$_loki_wt_cm" claude "${_LOKI_PERM_ARGV[@]}" \
+                    SHELL="$(_loki_claude_shell_value)" CAVEMAN_DEFAULT_MODE="$_loki_wt_cm" claude "${_LOKI_PERM_ARGV[@]}" \
                         "${_LOKI_WT_AUTO_FLAGS[@]+"${_LOKI_WT_AUTO_FLAGS[@]}"}" \
                         -p "Loki Mode: $task_prompt. Read .loki/CONTINUITY.md for context." \
                         >> "$log_file" 2>&1 || _wt_exit=$?
                 else
-                    claude "${_LOKI_PERM_ARGV[@]}" \
+                    SHELL="$(_loki_claude_shell_value)" claude "${_LOKI_PERM_ARGV[@]}" \
                         "${_LOKI_WT_AUTO_FLAGS[@]+"${_LOKI_WT_AUTO_FLAGS[@]}"}" \
                         -p "Loki Mode: $task_prompt. Read .loki/CONTINUITY.md for context." \
                         >> "$log_file" 2>&1 || _wt_exit=$?
@@ -7124,7 +7124,7 @@ Output ONLY the resolved file content with no conflict markers. No explanations.
                 # the EXACT resolved file content (the shell writes it verbatim).
                 # Compressing prose into the merged source would corrupt the file,
                 # so disable caveman unconditionally here. No-op when absent.
-                resolution=$(CAVEMAN_DEFAULT_MODE=off claude "${_cr_argv[@]}" -p "$conflict_prompt" --output-format text < /dev/null 2>/dev/null)
+                resolution=$(SHELL="$(_loki_claude_shell_value)" CAVEMAN_DEFAULT_MODE=off claude "${_cr_argv[@]}" -p "$conflict_prompt" --output-format text < /dev/null 2>/dev/null)
                 ;;
             codex)
                 resolution=$(codex exec --sandbox workspace-write --skip-git-repo-check "$conflict_prompt" 2>/dev/null)
@@ -16821,7 +16821,7 @@ _dispatch_reviewer() {
                         }
                 fi
                 _loki_with_deadline_stdin_text "$_cr_req_cap" "$prompt_text" \
-                    "${_cr_provider_env[@]}" CAVEMAN_DEFAULT_MODE=off \
+                    "${_cr_provider_env[@]}" "SHELL=$(_loki_claude_shell_value)" CAVEMAN_DEFAULT_MODE=off \
                         claude "${_rv_argv[@]}" -p \
                         --output-format text > "$_cr_req_raw" \
                     || _cr_req_rc=$?
@@ -16872,7 +16872,7 @@ _dispatch_reviewer() {
                         _cr_cap=$(_loki_review_deadline_remaining "$_review_deadline_ms") || return 124
                     fi
                     _cr_json="$(_loki_with_deadline_stdin_text "$_cr_cap" "$prompt_text" \
-                        "${_cr_provider_env[@]}" CAVEMAN_DEFAULT_MODE=off \
+                        "${_cr_provider_env[@]}" "SHELL=$(_loki_claude_shell_value)" CAVEMAN_DEFAULT_MODE=off \
                             claude "${_rv_argv[@]}" -p \
                             --json-schema "$_cr_schema_content" \
                             --output-format json)" || _cr_rc=$?
@@ -16902,7 +16902,7 @@ _dispatch_reviewer() {
                 _cr_text_cap=$(_loki_review_deadline_remaining "$_review_deadline_ms") || return 124
             fi
             _loki_with_deadline_stdin_text "$_cr_text_cap" "$prompt_text" \
-                "${_cr_provider_env[@]}" CAVEMAN_DEFAULT_MODE=off claude "${_rv_argv[@]}" -p \
+                "${_cr_provider_env[@]}" "SHELL=$(_loki_claude_shell_value)" CAVEMAN_DEFAULT_MODE=off claude "${_rv_argv[@]}" -p \
                 --output-format text > "$review_output"
             ;;
         codex)
@@ -21774,9 +21774,20 @@ ${_commits}"
     # would fail that check or produce caveman-style USAGE text, so disable
     # caveman unconditionally. Inlined on `claude` only (does not cross the pipe
     # to head). No-op when caveman is absent.
+    # A non-claude provider with LOKI_ALLOW_CLAUDE_SIDECALLS=1 never loads
+    # claude.sh, so compute the pinned shell in a subshell: the helper's
+    # top-level exports (caveman vars) must not leak into this process.
+    local _ic_shell
+    _ic_shell="$(
+        # shellcheck source=/dev/null
+        type _loki_claude_shell_value >/dev/null 2>&1 \
+            || . "$PROJECT_DIR/autonomy/lib/claude-flags.sh" >/dev/null 2>&1 || exit 1
+        _loki_claude_shell_value
+    )" || _ic_shell=""
+    [ -n "$_ic_shell" ] || _ic_shell="${SHELL-}"
     local _ic_out
     _ic_out=$(printf '%s' "$_ic_prompt" \
-        | timeout 60 env CAVEMAN_DEFAULT_MODE=off claude "${_ic_argv[@]}" -p - 2>/dev/null \
+        | timeout 60 env "SHELL=$_ic_shell" CAVEMAN_DEFAULT_MODE=off claude "${_ic_argv[@]}" -p - 2>/dev/null \
         | head -200)
     # Sanity check: response must look like Markdown (starts with # or ##).
     if [ -z "$_ic_out" ] || ! printf '%s' "$_ic_out" | head -1 | grep -qE '^#'; then
@@ -26174,11 +26185,13 @@ except Exception as exc:
                 CAVEMAN_DEFAULT_MODE="$_loki_cm_level" \
                 LOKI_DEADLINE_IDLE_TIMEOUT="${LOKI_PROVIDER_IDLE_TIMEOUT:-0}" \
                 _loki_with_deadline "${LOKI_PROVIDER_CALL_TIMEOUT:-0}" \
+                env "SHELL=$(_loki_claude_shell_value)" \
                 claude "${_loki_claude_argv[@]}" -p "$prompt" \
             --output-format stream-json --verbose < /dev/null 2>&1
                 else
                 LOKI_DEADLINE_IDLE_TIMEOUT="${LOKI_PROVIDER_IDLE_TIMEOUT:-0}" \
                 _loki_with_deadline "${LOKI_PROVIDER_CALL_TIMEOUT:-0}" \
+                env "SHELL=$(_loki_claude_shell_value)" \
                 claude "${_loki_claude_argv[@]}" -p "$prompt" \
             --output-format stream-json --verbose < /dev/null 2>&1
                 fi | \

package/bin/loki

@@ -643,7 +643,9 @@ if [ -f "$REPO_ROOT/autonomy/route.sh" ] && { [ "$_LOKI_START_ATTEMPTS" != "1" ]
             export LOKI_SESSION_MODEL="$R_SESSION_MODEL"
         fi
         if [ "$R_E10" = "1" ] && [ -n "${R_E10_CAP_S:-}" ]; then export LOKI_E10_CAP_S="$R_E10_CAP_S"; fi
-        if [ "$R_E10" != "1" ]; then
+        if [ "$R_ENGINE" = "verify-pr" ]; then
+            set -- verify-pr "${R_PR_ARGS[@]}"
+        elif [ "$R_E10" != "1" ]; then
             set -- "$([ "$R_VERB" = "bare" ] && echo start || echo "$R_VERB")" ${R_CLEAN[@]+"${R_CLEAN[@]}"}
         fi
     fi

package/dashboard/__init__.py

@@ -7,6 +7,6 @@ Modules:
     control: Session control helpers (status, atomic writes, origin check)
 """
 
-__version__ = "11.88.0"
+__version__ = "11.90.0"
 
 __all__ = ["__version__"]

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.88.0. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.90.0. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/CLI-INVENTORY.md` for the full inventory.
 
 | Command | Description |

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 Loki Mode, by [Autonomi](https://www.autonomi.dev/), turns a spec or an issue into a verified pull request with a receipt you can check. This page covers installing it, a first run, and the options around it.
 
-**Version:** v11.88.0
+**Version:** v11.90.0
 
 **Engine note:** `loki start` is the primary command. `loki start`, `loki "<task>"`, `loki owner/repo#N` and `loki quick` all run the Loki 10 engine, whatever the flag order or input form (PRD file, issue ref, task or one-word brief). The previous loop runs only on `--engine legacy`, `LOKI_ENGINE=legacy`, or for one call when a flag Loki 10 cannot honor is present. See the [user guide](v10/GUIDE.md) and the [5-minute quickstart](QUICKSTART.md).
 

package/docs/dev/release-checklist.md

@@ -12,6 +12,19 @@ refs/heads/main` matches `git rev-parse HEAD`. `scripts/local-ci.sh` remains
 available for diagnosis on a quiet cycle -- it is no longer a push
 precondition, fast tier or full.
 
+Slice gate (run before reporting a slice built; a reviewer reruns the same command):
+`bash scripts/select-tests.sh --gate [--suite tests/test-foo.sh]... [--no-loki-ts]`.
+It checks that HEAD contains the current origin/main (and names how far behind
+it is, never rebasing for you), runs exactly the `--guards-only` row set (the
+`scripts/global-guards.tsv` rows plus the marker-only walkers, from one shared emitter) one
+at a time and names any red row, runs each `--suite`, then runs full engine10
+(`bun run test:engine10` in loki-ts, through the slot queue when the tree has that script) unless `--no-loki-ts` says the slice
+touched no loki-ts source. Every row, suite and the engine10 run is bounded by
+`timeout -k 15` (`LOKI_GATE_ROW_TIMEOUT`, `LOKI_GATE_SUITE_TIMEOUT`, `LOKI_GATE_ENGINE10_TIMEOUT`);
+a timeout, an empty guard list, a failed fetch (unless `--no-fetch`) or a missing
+`bun` fails the gate. It prints a pass/fail summary per step and exits
+non-zero on any failure.
+
 After a release ships, run post-release distribution validation:
 - npm: `npm pack loki-mode@<VERSION>`, untar, run `bash package/bin/loki version`
 - Docker: `docker pull asklokesh/loki-mode:<VERSION>`, `docker run --rm <img> version`,

package/docs/v11/VERIFY-PR-SANDBOX.md

@@ -25,6 +25,7 @@ verify-pr-sandbox.sh --repo DIR --out DIR --cmd 'SHELL CMD' --image IMG [--timeo
 | Env scrub | `docker run` inherits no host env; only PATH, HOME=/work, CI=1 are passed. GH_TOKEN, GITHUB_TOKEN, SSH_AUTH_SOCK never reach argv |
 | Mounts | exactly one: the repo, read-only. No HOME, no docker socket, no output mount |
 | Output | stdout is captured by the host, capped in-container (`--max-output`); the host writes result.json and output.txt |
+| Report | `--report /work/NAME` returns the file the check's runner wrote there (up to 1 MiB, outside the output cap) between nonce-bearing markers; the host writes it as report.txt. verify-pr runs bun test, pytest, jest and vitest with a report flag and a random path, and reads pass/fail only from that file |
 
 Deviation from the card: there is no mounted output dir. A writable host mount would let the checked code fill the host disk, so the result travels on stdout and only the host writes `OUT`. Numeric flags are forced to base 10 (a leading zero is not octal) and every value flag requires a value. `--image` is restricted to `[A-Za-z0-9._/:@-]`.
 
@@ -35,6 +36,7 @@ Deviation from the card: there is no mounted output dir. A writable host mount w
 - Oversized output: capped by `--max-output`; `output_truncated` is set.
 - Fork bomb: `--pids-limit 256`. Memory bomb: `--memory`. Disk fill: tmpfs size caps.
 - Forged result: the checked code can print a fake `LOKI_VPR_END` line. A per-run 128-bit nonce is sent to the wrapper on stdin and the checked command runs with stdin from /dev/null; the host accepts only the last line carrying that nonce. Docker's default seccomp profile does NOT block ptrace or process_vm_readv on kernels >= 4.8, and the checked command runs as the same uid as the wrapper inside the container, so a hostile process can read the wrapper's memory and recover the nonce. The nonce therefore only stops accidental or naive forgery; it is not a security boundary. One cross-check is added: the wrapper exits with the check's code and the host rejects (status ERROR) a sentinel that disagrees with docker's own exit code. The PR code can still make its own check report success, which is why `result.json` is a signal about the check and not the final verdict (VPR-2 owns that, and it must not treat a bare COMPLETED exit 0 as proof). A custom seccomp profile denying ptrace is a possible hardening and is not shipped here.
+- Forged report: the report path is a per-run random name given only on the runner's command line, so printed totals cannot forge it. A hostile test that reads its parent's command line (or the nonce, see above) and rewrites the file after the runner exits can still forge a pass; the same ptrace-class residual applies.
 - Docker pool exhaustion: reported as BLOCKED, never as a failing check.
 
 ## Not covered (residual, tracked for VPR-2 review)