loki-mode 9.12.6 → 9.16.0

package/autonomy/telemetry.sh

@@ -194,7 +194,14 @@ _loki_known_command() {
 # a first run, never the user's paths, versions, or hostnames.
 _loki_known_blocker() {
     case "${1:-}" in
-        no_provider|node|python3|jq|git|curl|disk|skill_symlink)
+        # not_logged_in is distinct from no_provider on purpose. They are the two
+        # halves of the same wall and they need opposite fixes: no_provider means
+        # "install something", not_logged_in means "authenticate the thing you
+        # already installed". Collapsing the second into `other` would make the
+        # single most common post-install failure unactionable in the data --
+        # and it is the worst-placed one, since without this the user only learns
+        # of it after confirming the spend.
+        no_provider|not_logged_in|node|python3|jq|git|curl|disk|skill_symlink)
             printf '%s' "$1" ;;
         *)
             printf 'other' ;;

package/completions/_loki

@@ -171,6 +171,9 @@ function _loki_commands {
         'metrics:Session productivity report'
         'share:Share session report as GitHub Gist'
         'proof:Inspect/share proof-of-run artifacts'
+        'outcomes:What happened to the work AFTER the receipt (reverted/reworked/survived)'
+        'verdict:The five measured trust signals in one readable block'
+        'readiness:Can an agent verify its own work in this repo? (measured, not LLM-scored)'
         'preview:Preview the locally-running app'
         'deploy:Deploy the built product (CI/CD-aware)'
         'context:Context window management'
@@ -190,6 +193,7 @@ function _loki_commands {
         'magic:Spec-driven component generation'
         'assets:Export/import shareable team assets'
         'spec:Living spec drift detection'
+        'intent:Does the spec still say what was actually wanted'
         'verify:Deterministic PR verification'
         'grill:Interrogate a spec before building'
         'trust:Visible trust trajectory'

package/completions/loki.bash

@@ -5,7 +5,8 @@ _loki_completion() {
     _init_completion || return
 
     # Main subcommands (must match autonomy/loki main case statement)
-    local main_commands="start quick monitor demo tour welcome init stop pause resume steer status next ship dashboard web serve api sandbox notify import github issue config provider reset memory compound checkpoint council dogfood projects enterprise secrets cockpit secure own handoff doctor watchdog audit metrics syslog onboard share proof receipt explain plan report cost estimate kpis stats test ci watch telemetry agent context ctx code run export review optimize heal modernize migrate cluster worktree wt trigger failover remote deploy docker mcp magic assets analyze compliance crash open otel preview quickstart rc rollback self-update sentrux setup-skill spec state template trust trust-metrics ultracode update verify voice why wiki bench cleanup logs grill docs cp version completions help"
+    local main_commands="start quick monitor demo tour welcome init stop pause resume steer status next ship dashboard web serve api sandbox notify import github issue config provider reset memory compound checkpoint council dogfood projects enterprise secrets cockpit secure own handoff doctor watchdog audit metrics syslog onboard share proof receipt outcomes verdict readiness explain plan report cost estimate kpis stats test ci watch telemetry agent context ctx code run export review optimize heal modernize migrate cluster worktree wt trigger failover remote deploy docker mcp magic assets analyze compliance crash open otel preview quickstart rc rollback self-update sentrux setup-skill spec state template trust trust-metrics ultracode update verify voice why wiki bench cleanup logs grill docs cp version completions help"
+    local main_commands="start quick monitor demo tour welcome init stop pause resume steer status next ship dashboard web serve api sandbox notify import github issue intent config provider reset memory compound checkpoint council dogfood projects enterprise secrets cockpit secure own handoff doctor watchdog audit metrics syslog onboard share proof receipt explain plan report cost estimate kpis stats test ci watch telemetry agent context ctx code run export review optimize heal modernize migrate cluster worktree wt trigger failover remote deploy docker mcp magic assets analyze compliance crash open otel preview quickstart rc rollback self-update sentrux setup-skill spec state template trust trust-metrics ultracode update verify voice why wiki bench cleanup logs grill docs cp version completions help"
 
     # 1. If we are on the first argument (subcommand)
     if [[ $cword -eq 1 ]]; then

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "9.12.6"
+__version__ = "9.16.0"
 
 # Expose the control app for easy import
 try:

package/dashboard/run.py

@@ -8,15 +8,26 @@ Usage:
 """
 
 import argparse
+import os
 import sys
 
 
 def main():
     parser = argparse.ArgumentParser(description="Loki Mode Dashboard Server")
+    # Loopback by default, matching server.py:run_server and control.py. This
+    # launcher defaulted to 0.0.0.0, which published an UNAUTHENTICATED control
+    # plane on every interface: dashboard auth is opt-in
+    # (LOKI_ENTERPRISE_AUTH, default false in dashboard/auth.py), so with it
+    # unset -- the default -- anyone routable to the host could reach endpoints
+    # that stop builds and read receipts. A default must be safe on its own;
+    # exposing the network is a decision an operator makes explicitly, so
+    # --host 0.0.0.0 and LOKI_DASHBOARD_HOST both still work for the container
+    # and Helm paths that genuinely need it.
     parser.add_argument(
         "--host",
-        default="0.0.0.0",
-        help="Host to bind to (default: 0.0.0.0)",
+        default=os.environ.get("LOKI_DASHBOARD_HOST", "127.0.0.1"),
+        help="Host to bind to (default: $LOKI_DASHBOARD_HOST or 127.0.0.1). "
+             "Use 0.0.0.0 only with authentication enabled.",
     )
     parser.add_argument(
         "--port",

package/dashboard/scim.py

@@ -0,0 +1,221 @@
+"""SCIM 2.0 user provisioning: deprovisioning that actually revokes access.
+
+WHY THIS EXISTS. Measured against our own code before writing any: OIDC is real
+here (76 references in dashboard/auth.py) and SAML and SCIM are both ZERO. That
+is the whole enterprise identity gap -- not authentication as a category, which
+we have, but PROVISIONING, which we do not.
+
+It matters more than its size suggests. With OIDC alone, an employee removed
+from the IdP stops being able to LOG IN, but any token already issued to them
+keeps working until it expires. For a buyer whose security review asks "show me
+that a terminated employee loses access within minutes", that is the answer that
+fails the review. SCIM is the protocol that answers it.
+
+WORTH KNOWING ABOUT THE COMPETITION. Factory ships SCIM. Devin's SCIM is
+documented only for Devin DESKTOP -- the page instructs you to configure it at
+windsurf.com/team/settings under the app name "Windsurf" -- and no page documents
+SCIM provisioning for Devin CLOUD sessions, which get SAML/OIDC plus IdP-group
+sync only. So this is table stakes against one competitor and a genuine gap in
+the other.
+
+WHAT THIS IS NOT. It is not a second identity system. It maps IdP group
+membership onto the scope hierarchy dashboard/auth.py already enforces
+(* -> control -> write -> read), so there is exactly one authorization model and
+SCIM only decides who holds which scope. A parallel permission model would
+eventually disagree with the real one, and the disagreement would be invisible
+until an audit.
+
+DEPROVISIONING IS SOFT BY DEFAULT, AND THAT IS DELIBERATE. `active: false`
+revokes access immediately but PRESERVES the record, because an audit trail that
+loses the identity of whoever performed past actions is not an audit trail. Hard
+delete is available and separate, so destroying history is always an explicit act.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+from datetime import datetime, timezone
+from typing import Optional
+
+SCIM_SCHEMA_USER = "urn:ietf:params:scim:schemas:core:2.0:User"
+SCIM_SCHEMA_LIST = "urn:ietf:params:scim:api:messages:2.0:ListResponse"
+SCIM_SCHEMA_ERROR = "urn:ietf:params:scim:api:messages:2.0:Error"
+
+# IdP group -> our scope. Mirrors the hierarchy in dashboard/auth.py rather than
+# inventing a second one: * grants everything, control grants write and read.
+# An unrecognised group maps to "read", never to a higher scope -- an unknown
+# group is not evidence of privilege, and defaulting upward is how a
+# misconfigured IdP silently grants admin.
+GROUP_SCOPE_MAP = {
+    "loki-admins": "*",
+    "loki-owners": "*",
+    "loki-operators": "control",
+    "loki-writers": "write",
+    "loki-readers": "read",
+}
+DEFAULT_SCOPE = "read"
+
+
+def _now():
+    return datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+
+
+def _store_path(loki_dir):
+    return os.path.join(loki_dir, "scim", "users.json")
+
+
+def _load(loki_dir):
+    p = _store_path(loki_dir)
+    if not os.path.isfile(p):
+        return {}
+    try:
+        with open(p, "r", encoding="utf-8") as fh:
+            return json.load(fh)
+    except (OSError, ValueError):
+        # A corrupt store must not silently become an empty one: returning {}
+        # here would read as "no users provisioned" and could re-grant access to
+        # someone who was deprovisioned. Signalled to the caller instead.
+        return None
+
+
+def _save(loki_dir, data):
+    p = _store_path(loki_dir)
+    os.makedirs(os.path.dirname(p), exist_ok=True)
+    tmp = p + ".tmp"
+    with open(tmp, "w", encoding="utf-8") as fh:
+        json.dump(data, fh, indent=2, sort_keys=True)
+        fh.write("\n")
+    # Atomic replace: a half-written user store is an access-control decision
+    # made from corrupt data.
+    os.replace(tmp, p)
+
+
+def scope_for_groups(groups):
+    """Highest scope any of the user's groups grants.
+
+    Highest-wins, because a user in both loki-readers and loki-admins is an
+    admin. Unknown groups contribute DEFAULT_SCOPE and never more.
+    """
+    rank = {"read": 1, "write": 2, "control": 3, "*": 4}
+    best = DEFAULT_SCOPE
+    for g in groups or []:
+        s = GROUP_SCOPE_MAP.get(str(g).strip().lower(), DEFAULT_SCOPE)
+        if rank.get(s, 1) > rank.get(best, 1):
+            best = s
+    return best
+
+
+def provision(loki_dir, user_name, external_id=None, groups=None, active=True):
+    """Create or update a user. Returns a SCIM User resource."""
+    if not user_name:
+        return {"schemas": [SCIM_SCHEMA_ERROR], "status": "400",
+                "detail": "userName is required"}
+
+    data = _load(loki_dir)
+    if data is None:
+        return {"schemas": [SCIM_SCHEMA_ERROR], "status": "500",
+                "detail": "user store is unreadable; refusing to make an access "
+                          "decision from corrupt data"}
+
+    uid = external_id or user_name
+    existing = data.get(uid, {})
+    rec = {
+        "id": uid,
+        "userName": user_name,
+        "externalId": external_id or "",
+        "groups": list(groups or []),
+        "scope": scope_for_groups(groups),
+        "active": bool(active),
+        "created": existing.get("created") or _now(),
+        "lastModified": _now(),
+    }
+    data[uid] = rec
+    _save(loki_dir, data)
+    return to_scim_user(rec)
+
+
+def deprovision(loki_dir, uid, hard=False):
+    """Revoke access. Soft by default so the audit trail survives.
+
+    An audit log that cannot say WHO performed an action is not an audit log, so
+    a departed user's record is retained by default and merely marked inactive.
+    Hard delete exists and is separate, so destroying history is always explicit.
+    """
+    data = _load(loki_dir)
+    if data is None:
+        return {"schemas": [SCIM_SCHEMA_ERROR], "status": "500",
+                "detail": "user store is unreadable"}
+    if uid not in data:
+        return {"schemas": [SCIM_SCHEMA_ERROR], "status": "404",
+                "detail": f"no such user: {uid}"}
+
+    if hard:
+        data.pop(uid)
+        _save(loki_dir, data)
+        return {"status": "204", "deleted": uid, "audit_trail_preserved": False}
+
+    data[uid]["active"] = False
+    data[uid]["lastModified"] = _now()
+    _save(loki_dir, data)
+    return {"status": "200", "deactivated": uid, "audit_trail_preserved": True}
+
+
+def is_active(loki_dir, uid):
+    """Authorization answer for one user. Fails CLOSED on any doubt.
+
+    An unreadable store, an unknown user, and an inactive user all return False.
+    A provisioning system that fails open is worse than none, because it creates
+    the belief that deprovisioning works.
+    """
+    data = _load(loki_dir)
+    if data is None:
+        return False
+    rec = data.get(uid)
+    if not rec:
+        return False
+    return bool(rec.get("active"))
+
+
+def effective_scope(loki_dir, uid):
+    """The scope a user actually holds, or None when they hold none."""
+    data = _load(loki_dir)
+    if data is None:
+        return None
+    rec = data.get(uid)
+    if not rec or not rec.get("active"):
+        return None
+    return rec.get("scope") or DEFAULT_SCOPE
+
+
+def to_scim_user(rec):
+    return {
+        "schemas": [SCIM_SCHEMA_USER],
+        "id": rec["id"],
+        "userName": rec["userName"],
+        "externalId": rec.get("externalId", ""),
+        "active": rec.get("active", False),
+        "groups": [{"value": g} for g in rec.get("groups", [])],
+        "meta": {
+            "resourceType": "User",
+            "created": rec.get("created"),
+            "lastModified": rec.get("lastModified"),
+        },
+        # Not part of the SCIM spec, surfaced because an operator reading this
+        # response needs to see what the group mapping actually granted rather
+        # than deriving it.
+        "lokiScope": rec.get("scope"),
+    }
+
+
+def list_users(loki_dir, active_only=False):
+    data = _load(loki_dir)
+    if data is None:
+        return {"schemas": [SCIM_SCHEMA_ERROR], "status": "500",
+                "detail": "user store is unreadable"}
+    recs = [r for r in data.values() if (not active_only or r.get("active"))]
+    return {
+        "schemas": [SCIM_SCHEMA_LIST],
+        "totalResults": len(recs),
+        "Resources": [to_scim_user(r) for r in sorted(recs, key=lambda r: r["id"])],
+    }

package/dashboard/server.py

@@ -1224,6 +1224,28 @@ class WebSocketBoundaryMiddleware:
                 # accept-then-drop, which reads to a client as a flaky network.
                 await send({"type": "websocket.close", "code": 1008})
                 return
+            # Cross-Site WebSocket Hijacking. The address check above proves the
+            # PEER is local; it says nothing about who told that peer to connect.
+            # A browser on any origin can open ws://127.0.0.1:57374/ws -- the
+            # request comes FROM the loopback interface and passes the check
+            # above, and CORS does not apply to WebSocket upgrades, so no
+            # existing control stops it. /ws/collab is writable, so this is not
+            # read-only exposure.
+            #
+            # Same-origin browsers send Origin; non-browser clients (CLI, tests,
+            # health probes) send none. An ABSENT Origin is therefore allowed --
+            # it cannot be forged by a page, since browsers always attach it --
+            # while a PRESENT one must be in the allowlist the HTTP path already
+            # uses. That keeps every scripted client working and closes the
+            # browser-driven path, without a second source of truth for origins.
+            origin = None
+            for raw_name, raw_value in scope.get("headers", []):
+                if raw_name == b"origin":
+                    origin = raw_value.decode("latin-1").strip()
+                    break
+            if origin and "*" not in _cors_origins and origin not in _cors_origins:
+                await send({"type": "websocket.close", "code": 1008})
+                return
         await self.app(scope, receive, send)
 
 

package/docs/GATE-FAILURE-TRIAGE.md

@@ -0,0 +1,254 @@
+# Gate failure triage: exact-SHA classification
+
+Ordered by the steer: reproduce locally against exact HEAD, classify each
+failure as environment / baseline / candidate regression, evidence every claim
+with a command and its output. Nothing here was pushed.
+
+| Field | Value |
+|---|---|
+| HEAD at triage | `d230a3b2` (the steer named `09138e26`; that SHA is not in this worktree) |
+| baseline compared | `dda8beec` = origin/main |
+| held commits | `22199024`, `94315f35`, `d230a3b2`, plus `94f7639a` from this triage |
+| pushed | **nothing** |
+
+## Classification
+
+| Failure | Class | Evidence |
+|---|---|---|
+| `test-onboard-command` (6 of 9) | **BASELINE**, now FIXED | `autonomy/loki` byte-identical to origin/main; `git diff --name-only dda8beec..HEAD` returns zero matches for that path |
+| `test-model-override` | **BASELINE**, 1 of 66, still open | identical failure at `dda8beec` and at HEAD: `Results: 65 passed, 1 failed (of 66)`, `EXIT=1` |
+| `bun run typecheck` | **ENVIRONMENT** | `tsc` not installed locally; unchanged |
+
+## The onboard defect
+
+`loki onboard --stdout` exited **141** and wrote **0 bytes** on this repo,
+while passing on small fixtures.
+
+```
+EXIT=141
+STDOUT bytes: 0
+STDERR bytes: 242
+```
+
+141 = 128+13 = SIGPIPE. `cmd_onboard`'s find fallback ends
+`| sed | sort | head -200`. Under the file's `set -euo pipefail` (line 22),
+`head` exits after 200 lines; `sort` -- which must consume ALL input before it
+emits anything -- then takes SIGPIPE, the pipeline returns 141, and `-e` aborts
+before a byte is written. The sibling `git ls-files` branch two lines above was
+already guarded with `|| true`. The find branch never was.
+
+`sort`, not `find`, is the process that dies. That distinction sets the test
+size: see below.
+
+### Why no existing test caught it
+
+**1. Every fixture was too small.** The residual output has to exceed the 64KB
+pipe buffer before the signal lands. Measured:
+
+| Fixture | Result vs unfixed code |
+|---|---|
+| 250 files | **passes** -- ~50 lines left after the cut, fits the buffer |
+| 3000 files | **exit 141**, deterministic |
+
+A 250-file regression test would have been worthless. I wrote one first,
+confirmed it passed against the pre-fix binary, and resized it.
+
+**2. This worktree never reached the guarded branch.** The check was
+`[ -d "$target_path/.git" ]`, and in a git **worktree** `.git` is a pointer
+**file**, not a directory:
+
+```
+-rw-r--r--  1 lokesh  staff  83 Jul 31 19:25 .git
+gitdir: /Users/lokesh/git/lokimode-anthropic/.git/worktrees/pre-push-scoped-pytest
+```
+
+So every worktree silently fell through to the find path. Proven by trace:
+
+```
+PRE-FIX   ++ find ... -maxdepth 4
+FIXED     ++ git ls-files
+```
+
+### The fix
+
+`-e` instead of `-d`, and `|| true` matching the sibling branch. Two lines.
+
+### Two sibling sites, quieter symptom
+
+`cmd_explain` and `_docs_scan_project` carry the same pipeline at `head -500`.
+Fixed alongside -- patching only the path the failure named would leave the
+siblings broken.
+
+They fail *differently*, which is why nothing ever caught them: both assign via
+`local x=$(...)`, and `local` resets `$?`, swallowing the 141. Demonstrated:
+
+```
+$ f() { local x=$(false | head -1); echo "rc=$?"; }
+rc=0
+```
+
+So they **silently truncate** their file tree instead of aborting. Same root
+cause, no visible symptom.
+
+### Sweep
+
+Three unguarded `sort | head -N` sites existed; zero remain. The sweep pattern
+is not vacuous -- it matches 3 in the pre-fix file and 0 now.
+
+The other two `-d .../.git` checks in the file (`loki:11113`, `loki:13473`) are
+CORRECT as `-d`: one detects a clone (a worktree is not one), the other guards
+`git init` on a fresh demo dir. Left alone.
+
+## Verification
+
+| Check | Before | After |
+|---|---|---|
+| `test-onboard-command.sh` | 3/9 | **10/10** |
+| new Test 10 vs pre-fix binary | **FAIL** (exit 141) | PASS |
+| `test-onboard-json-injection-wave10.sh` | 2/2 | 2/2 |
+| `test-contradiction-detection.sh` | 19/19 | 19/19 |
+| `bash -n autonomy/loki` | OK | OK |
+
+Test 10 was mutation-tested against `dda8beec`: it fails with the exact
+diagnostic `exit 141 (SIGPIPE)` on the old code and passes on the new. It also
+carries a vacuity guard rejecting exit 0 with under 100 bytes of output -- the
+precise shape of the bug, since the abort produced exit 141 *and* silence.
+
+## Correction: I called test-model-override a non-failure before it finished
+
+An earlier revision of THIS FILE classified `test-model-override` as "NOT A
+FAILURE -- slow suite, mis-measured". That was wrong, and it was wrong in the
+worst available way: I wrote the classification while the run was still
+executing, from a partial log that showed 50 PASS and no failures yet.
+
+The completed run:
+
+```
+FAIL: architect no-cap mismatch: estimator='Opus' runner-dispatch='opus'
+      runner-tier='fable' (expected Opus,Sonnet / opus / fable)
+Results: 65 passed, 1 failed (of 66)
+EXIT=1
+```
+
+The slowness was real -- a 224-cell parity matrix, each cell spawning a
+`python3` that imports the FastAPI dashboard at ~0.46s -- and it was NOT the
+explanation for the failure. Both things were true and I reported only the
+convenient one.
+
+The rule this violates is one already written down in this repo: an absent
+measurement is not a measurement. A log with no FAIL line yet is not a log with
+no failures; it is an unfinished log. I should have blocked on the EXIT marker
+before classifying, exactly as I did for the onboard suite.
+
+### The actual failure
+
+`tests/test-model-override.sh:827`. A three-way coherence assertion; two of the
+three legs are correct:
+
+| Leg | Expected | Actual |
+|---|---|---|
+| runner dispatch | `opus` | `opus` -- correct |
+| runner tier (pre-collapse) | `fable` | `fable` -- correct |
+| estimator quote | `Opus,Sonnet` | `Opus` -- **mismatch** |
+
+So the runtime routing is right and only the cost QUOTE disagrees: the
+estimator names one model where the run actually uses two. Per the test's own
+comment (line 800), this is the known "estimator needs the sonnet5-default
+update" case -- iter-1 collapses fable to opus, later iterations run the
+development tier which defaults to sonnet since v7.104.0, so an honest quote
+must name both.
+
+It under-quotes cost. It does not mis-route a model.
+
+### Root cause: the fixture stopped producing enough iterations
+
+The estimator is CORRECT. The expectation is only reachable when the estimate
+spans more than one iteration, and the suite's fixture no longer does.
+
+`autonomy/loki:18342` prices iteration 0 as Opus (the fable architect pass
+collapsing to opus), and every LATER iteration through
+`_priced_model_for(_dispatched_model)`, which defaults to Sonnet since
+v7.104.0. So `Opus,Sonnet` requires **iterations >= 2**.
+
+Measured on the suite's own fixture (`# PRD\nBuild a small todo API with one
+endpoint.`, byte-identical to v7.104.0):
+
+| Binary | tier | estimated iterations | nonzero models |
+|---|---|---|---|
+| `766219ac` (v7.104.0, where this was written and passed 66/0) | simple | **4** | `Opus,Sonnet` |
+| HEAD | simple | **1** | `Opus` |
+
+The complexity TIER is unchanged (`simple` in both). Only the iteration count
+for that tier fell, 4 -> 1, and with a single iteration the loop never reaches
+the branch where Sonnet appears.
+
+Confirmed causal by holding the binary fixed and enlarging the input: a 24-
+feature PRD at HEAD estimates 4 iterations and returns exactly `Opus,Sonnet`
+(`{"Fable":0,"Opus":1,"Sonnet":3,"Haiku":0}`). Same code, more iterations,
+expected answer.
+
+So the assertion is a **stale coupling**: it encodes "a simple PRD takes
+several iterations", which stopped being true. The v7.104.0 commit message
+claims "locked by tests/test-model-override.sh (66/0)" -- that lock silently
+came undone when the iteration estimate for simple PRDs changed.
+
+### Classification: BASELINE
+
+Run against `dda8beec`'s `autonomy/loki` (my onboard fix reverted), the failure
+is **identical**:
+
+```
+FAIL: architect no-cap mismatch: estimator='Opus' ...
+Results: 65 passed, 1 failed (of 66)
+EXIT=1
+```
+
+Not caused by any held commit. My `autonomy/loki` diff touches only three
+tree-building sites and no pricing or routing code.
+
+### Not fixed here, deliberately
+
+Two candidate fixes, and choosing between them is a product call I should not
+make unilaterally:
+
+1. **Enlarge the fixture** so a multi-iteration estimate is exercised. Restores
+   the assertion's original intent (verify the architect collapse across a
+   real multi-iteration run) and keeps its coverage.
+2. **Weaken the assertion** to accept `Opus`. Cheaper, and wrong: it would
+   stop testing the later-iteration Sonnet attribution entirely.
+
+(1) is almost certainly right, but it changes what the test measures, and the
+prior instruction excluded runtime changes without an evidenced deterministic
+requirement. The evidence is now here; the decision is not mine.
+
+`docs/LOOP-CANDIDATE-PROPOSAL-v1.md` states the onboard defect "cannot be
+addressed by any of [the six cheaper surfaces]" because it is a bash command
+that never calls a model. That reasoning was right, and the conclusion drawn
+from it was too weak: it is not a model-loop problem, it is a **two-line shell
+bug**, and the correct action was to fix it rather than to route around it.
+
+It also claimed the failure needed "a runtime fix to `autonomy/loki`" of
+unknown size. Measured: 28 lines changed across three sites, all mechanical.
+
+## Gate status
+
+Still not green, and this triage does not make it so.
+
+- `test-onboard-command`: **RESOLVED** (3/9 -> 10/10)
+- `test-model-override`: **1 of 66 still failing, BASELINE** -- a stale test
+  coupling, not an estimator defect. Root-caused (fixture no longer produces a
+  multi-iteration estimate); two candidate fixes named, neither applied.
+- `bun run typecheck`: **unchanged**, `tsc` still absent
+
+Two items remain, not one. Both are pre-existing at `dda8beec`; neither was
+introduced by a held commit.
+
+| Item | Needs |
+|---|---|
+| `bun run typecheck` | install the TS toolchain -- the environment fix already named |
+| `test-model-override` | a decision between enlarging the fixture and weakening the assertion |
+
+Neither is unblocked by the other, so "install tsc" was never sufficient on its
+own. That was an error in the earlier proposal, which named a single
+gate-closing action while a second real failure sat unclassified behind a
+measurement I had cut short.