loki-mode 9.65.0 → 9.67.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v9.65.0
+# Loki Mode v9.67.0
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -470,4 +470,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v9.65.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**
+**v9.67.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**

package/VERSION

@@ -1 +1 @@
-9.65.0
+9.67.0

package/autonomy/completion-council.sh

@@ -1856,6 +1856,12 @@ _loki_test_provenance() {
 # legitimate completion is never falsely stopped. Default-on; opt out with
 # LOKI_EVIDENCE_GATE=0 (byte-identical to prior behavior, no read/write).
 council_evidence_gate() {
+    # P2 (S-116): when the caller sets _LOKI_EVIDENCE_REQUIRE_TESTS=1, inconclusive
+    # test evidence blocks instead of passing through. council_evaluate sets it as
+    # a function-local (bash dynamic scope, gone on return), so the vote alone can
+    # never approve while every other caller keeps the old pass-through rc.
+    local _require_tests="false"
+    [ "${_LOKI_EVIDENCE_REQUIRE_TESTS:-0}" = "1" ] && _require_tests="true"
     # Knob first: opt-out is exact-as-today, before any file read or write.
     [ "${LOKI_EVIDENCE_GATE:-1}" = "0" ] && return 0
 
@@ -2702,6 +2708,15 @@ PYEOF
         # silently. The durable detail is in evidence-gate-details.json; this is
         # the human-visible honesty at the pass site.
         if [ "$test_inconclusive" = "true" ]; then
+            # Tautological provenance is excluded: tests DID run green (e.g.
+            # characterization tests pass on the base by design), and the
+            # provenance block above promises that downgrade never blocks.
+            if [ "$_require_tests" = "true" ] && [ "$test_inconclusive_reason" != "test_provenance_unconfirmed" ]; then
+                # Council route: a vote over inconclusive tests is the vote alone.
+                log_warn "[Council] Evidence gate: completion not backed by test evidence (${test_inconclusive_reason}); the council vote alone cannot approve. Record a real test run, or set LOKI_EVIDENCE_NO_TESTS_AFFIRMATIVE=1 to treat no-tests as affirmative."
+                _write_evidence_details "block"
+                return 1
+            fi
             log_warn "[Council] Evidence gate: completion not backed by test evidence (${test_inconclusive_reason}). Pass-through; set LOKI_EVIDENCE_NO_TESTS_AFFIRMATIVE=1 to treat no-tests as affirmative."
         fi
         # Same honesty for the runtime-boot axis: a pass that could not confirm the
@@ -4176,7 +4191,9 @@ council_evaluate() {
     fi
 
     # Phase 2.5 (v7.19.1): evidence hard gate - block completion unless there is
-    # real evidence that files changed AND tests are green.
+    # real evidence that files changed AND tests are green. The local below makes
+    # an inconclusive test signal block here, so the vote never approves alone.
+    local _LOKI_EVIDENCE_REQUIRE_TESTS=1
     if ! council_evidence_gate; then
         log_info "[Council] Completion blocked by evidence hard gate"
         return 1  # CONTINUE - cannot complete without real evidence

package/autonomy/lib/done-recognition.sh

@@ -461,8 +461,20 @@ def tests_axis(path):
         if ec != 0:
             return "red"
         # exit 0 alone is green only if nothing else contradicts it (checked below).
+    def _nonzero_int(v):
+        return isinstance(v, int) and not isinstance(v, bool) and v != 0
+    # Zero-test record: nothing actually ran, regardless of self-reported
+    # pass/fail. Checked before the pass:true/false branches below so a
+    # plausible {"pass": true, "total": 0} shape cannot slip through the
+    # pass:true branch as a false green.
+    if isinstance(d.get("total"), int) and d.get("total") == 0:
+        return "unknown"
     p = d.get("pass")
     if p is True:
+        # A self-reported pass contradicted by a nonzero failure count (under
+        # either key production/legacy shapes use) is not authoritative green.
+        if _nonzero_int(d.get("failed")) or _nonzero_int(d.get("failed_count")):
+            return "red"
         # A clean pass:true with no contradicting red signal is authoritative green.
         if d.get("failed") in (None, 0) and (ec in (None, 0)):
             return "green"

package/autonomy/loki

@@ -856,8 +856,48 @@ PY
 # absent measurement is not evidence, and inventing a PASS here would be worse
 # than inventing a FAIL.
 loki_remote_attestation_status() {
-    local pj="$1" url="$2"
+    local pj="$1" url="$2" _jh
     [ -n "$url" ] || { printf ''; return 0; }
+    # A JWKS key set travels over the same channel as the receipt it certifies.
+    # Plain http lets anyone on the network path swap in their own key set, and
+    # the attestation would then "verify" against a forged key -- a MITM the
+    # TLS the API already uses is meant to prevent. Only https is trusted;
+    # loopback http and file:// are the exceptions, because neither one leaves
+    # this machine for anyone to sit on. Checked here, before python is even
+    # invoked, so a rejected URL is never fetched -- not "fetched and then
+    # distrusted". Same check in loki_proof_attestation_check below -- change
+    # both.
+    #
+    # The host is bounded exactly (up to the first "/", then stripped of any
+    # port) rather than matched with a trailing glob, and a userinfo "@" is
+    # rejected outright -- "http://127.0.0.1:80@evil.com" is host evil.com to
+    # any real URL parser (userinfo before the @, host after), and a loose
+    # `http://127.0.0.1:*` glob would wrongly wave that straight through.
+    case "$url" in
+        https://*|file://*) ;;
+        http://*)
+            _jh="${url#http://}"; _jh="${_jh%%/*}"
+            case "$_jh" in
+                *@*) printf ''; return 0 ;;
+            esac
+            # A bracketed IPv6 literal must be the WHOLE host: "[::1]" or
+            # "[::1]:port", never a prefix, or "[::1].evil.com" (not itself
+            # resolvable as loopback, but not rejected either) would parse as
+            # loopback "::1" with everything after the first "]" silently
+            # dropped instead of validated.
+            case "$_jh" in
+                \[*\]) _jh="${_jh#\[}"; _jh="${_jh%\]}" ;;
+                \[*\]:*) _jh="${_jh#\[}"; _jh="${_jh%%\]:*}" ;;
+                \[*) printf ''; return 0 ;;
+                *) _jh="${_jh%%:*}" ;;
+            esac
+            case "$_jh" in
+                127.0.0.1|localhost|::1) ;;
+                *) printf ''; return 0 ;;
+            esac
+            ;;
+        *) printf ''; return 0 ;;
+    esac
     command -v python3 >/dev/null 2>&1 || { printf ''; return 0; }
     local tok
     # jq's `//` treats JSON false the same as null/missing, which is exactly
@@ -954,8 +994,53 @@ PY
 # testing found exactly this: a mutation applied to the first copy left every
 # assertion of the second suite green.
 loki_proof_attestation_check() {
-    local pj="$1" src="$2"
+    local pj="$1" src="$2" _jh
     [ -n "$src" ] || { printf ''; return 0; }
+    # Same MITM guard as loki_remote_attestation_status above -- change both.
+    # Only applies to a URL source; a local file (the third-party offline case)
+    # never travels a network and needs no scheme at all. The host is bounded
+    # exactly and a userinfo "@" is rejected outright -- see the sibling
+    # function's comment for why a trailing glob is not safe here.
+    #
+    # A recognized scheme prefix is checked FIRST, before any "-f" test: the
+    # process cwd is the checkout being verified (attacker-controlled), and a
+    # repo can ship a file whose literal name IS a URL string (for example
+    # "https:/evil.example.com/.well-known/jwks.json" as a real path on disk).
+    # Testing "-f" first would treat that shadow file as the local-file form
+    # and hand its content straight to the caller with no network involved at
+    # all -- silently defeating the "only https is trusted" guarantee this
+    # function exists to provide. Scheme detection must win over the
+    # filesystem every time, not just when no file happens to collide.
+    case "$src" in
+        https://*|http://*|file://*)
+            case "$src" in
+                https://*|file://*) ;;
+                http://*)
+                    _jh="${src#http://}"; _jh="${_jh%%/*}"
+                    case "$_jh" in
+                        *@*) printf ''; return 0 ;;
+                    esac
+                    # See loki_remote_attestation_status above for why the
+                    # bracketed-IPv6 match must bound the closing bracket.
+                    case "$_jh" in
+                        \[*\]) _jh="${_jh#\[}"; _jh="${_jh%\]}" ;;
+                        \[*\]:*) _jh="${_jh#\[}"; _jh="${_jh%%\]:*}" ;;
+                        \[*) printf ''; return 0 ;;
+                        *) _jh="${_jh%%:*}" ;;
+                    esac
+                    case "$_jh" in
+                        127.0.0.1|localhost|::1) ;;
+                        *) printf ''; return 0 ;;
+                    esac
+                    ;;
+            esac
+            ;;
+        *)
+            # A plain path is decided in python below, which reports an
+            # unsigned receipt as "none" BEFORE it looks at the key file, so a
+            # missing key file on an unsigned receipt still fails (exit 1).
+            ;;
+    esac
     command -v python3 >/dev/null 2>&1 || { printf ''; return 0; }
     python3 -E - "$pj" "$src" "${_LOKI_SCRIPT_DIR}" <<'PY' 2>/dev/null || printf ''
 # The cwd is the checkout being verified: drop it from sys.path before any
@@ -984,15 +1069,20 @@ if tok is None or tok == "" or tok is False:
     print("none"); sys.exit(0)       # a FACT about the receipt, not an error
 src = sys.argv[2]
 try:
-    if os.path.isfile(src):
-        jwks = json.load(open(src))
-    else:
-        if not src.startswith(("http://", "https://")):
-            sys.exit(1)
+    # Scheme check first, same as the bash gate above -- a "-f" test run
+    # first would let a local file whose literal name IS an http(s) URL
+    # string (the process cwd is the checkout being verified) silently stand
+    # in for a real fetch. A recognized scheme always means "URL", even if a
+    # same-named file happens to exist on disk.
+    if src.startswith(("http://", "https://")):
         url = src if src.rstrip("/").endswith("jwks.json") else \
             src.rstrip("/") + "/.well-known/jwks.json"
         with urllib.request.urlopen(url, timeout=10) as r:
             jwks = json.loads(r.read())
+    elif os.path.isfile(src):
+        jwks = json.load(open(src))
+    else:
+        sys.exit(1)
 except Exception:
     sys.exit(1)                      # "" : unreachable/unreadable, no verdict
 # A key set that is not {"keys": [{...}, ...]} -- INCLUDING an empty list -- is
@@ -1177,7 +1267,8 @@ loki_remote_verify_receipt() {
     # gpg-unavailable branch above: NOT CHECKED, return 0, provenance unproven.
     if [ -z "$_attest" ] && jq -e '.verification.attestation // empty' "$pj" >/dev/null 2>&1; then
         echo -e "  ${YELLOW}NOT CHECKED${NC}: the receipt carries an attestation, but it could not be checked"
-        echo "    against ${_attest_url:-<no url>} (JWKS unreachable, or python cryptography missing)."
+        echo "    against ${_attest_url:-<no url>} (JWKS unreachable, python cryptography missing, or"
+        echo "    the JWKS URL is not https -- only loopback is allowed over plain http)."
         echo "    Its integrity hash matches. Provenance is unproven here, not disproven."
         echo "    Install python3 cryptography, or re-run where the build server is reachable."
         return 0
@@ -37014,7 +37105,8 @@ print(json.dumps(json.load(open(os.environ['LOKI_PROOF_JSON'])), indent=2))
                         # read as either a pass or an accusation, so it exits 2
                         # (could not check). A tamper/drift 1 from the base
                         # verifier is a finding and is never softened to 2.
-                        echo -e "${YELLOW}attestation: NOT CHECKED -- could not check against ${_pv_jwks} (key set unreadable, or verifier dependency missing).${NC}" >&2
+                        echo -e "${YELLOW}attestation: NOT CHECKED -- could not check against ${_pv_jwks} (key set unreadable,${NC}" >&2
+                        echo -e "${YELLOW}  verifier dependency missing, or the JWKS URL is not https -- only loopback is allowed over plain http).${NC}" >&2
                         echo "  This is not a failure of the receipt. Nothing was proven either way (exit 2)." >&2
                         if [ "$_pv_rc" -eq 0 ]; then _pv_rc=2; fi
                         _pv_attestation_field="NOT CHECKED"

package/autonomy/run.sh

@@ -5911,6 +5911,27 @@ _loki_trusted_push() {
         log_warn "Not pushing branch '$_branch': origin changed during the run (it was $(_loki_github_repo_from_url "$_LOKI_PINNED_ORIGIN" 2>/dev/null || echo "not a GitHub repository") when the run started). Loki does not push to a destination the agent could have chosen."
         return 2
     fi
+    # S-100: never push a default branch, for every caller (on_run_complete,
+    # create_session_pr): the branch name can come from agent-writable state.
+    # The default branch is resolved for the origin just validated (the pinned
+    # one when pinned), gh run from / with an explicit OWNER/REPO. An
+    # unresolvable default branch refuses: fail closed.
+    local _repo _def=""
+    case "$_branch" in
+        main|master|HEAD)
+            log_warn "Not pushing branch '$_branch': Loki never pushes directly to a default branch."
+            return 2 ;;
+    esac
+    _repo="$(_loki_github_repo_from_url "$_url")"
+    _def="$(_loki_run_neutral "$_repo" "$_runner" gh repo view "$_repo" --json defaultBranchRef --jq '.defaultBranchRef.name' 2>/dev/null)" || _def=""
+    if [ -z "$_def" ]; then
+        log_warn "Not pushing branch '$_branch': could not resolve the default branch of $_repo, and Loki never risks a direct push to it."
+        return 2
+    fi
+    if [ "$_branch" = "$_def" ]; then
+        log_warn "Not pushing branch '$_branch': it is the default branch of $_repo, and Loki never pushes directly to the default branch."
+        return 2
+    fi
     _tmp="$(mktemp -d "${TMPDIR:-/tmp}/loki-push.XXXXXX")" || return 1
     # --update-shallow: a shallow agent repo's history ends in shallow roots,
     # which a plain fetch rejects while still exiting 0. The rev-parse makes a
@@ -6070,6 +6091,8 @@ on_run_complete() {
     case "$branch" in
         ""|main|master|HEAD) return 0 ;;
     esac
+    # S-100: the repository's ACTUAL default branch (develop, trunk, ...) is
+    # refused inside _loki_trusted_push, for every caller.
     log_info "LOKI_DELEGATE_PR=1: opening a local pull request for branch '$branch'..."
     # Push, then create. Non-interactive (no tty in --bg). Best-effort, each
     # network call bounded by the timeout guard above.
@@ -21516,9 +21539,14 @@ except (json.JSONDecodeError, KeyError, TypeError, OSError):
                 mv "$state_file" "${state_file}.corrupt.$(date +%s)" 2>/dev/null || true
                 # Starts at iteration 0: drop the previous session's test
                 # evidence, as the iteration-0 block at the end does.
+                # S-124 follow-up: static-analysis.pass has no freshness
+                # marker of its own (same reasoning as the block below), so
+                # this corrupted-state restart must drop it too, or a stale
+                # copy survives this sibling iteration-0 trigger.
                 rm -f "${TARGET_DIR:-.}/.loki/quality/.test-results.iter" \
                       "${TARGET_DIR:-.}/.loki/quality/unit-tests.pass" \
-                      "${TARGET_DIR:-.}/.loki/quality/test-results.json" 2>/dev/null || true
+                      "${TARGET_DIR:-.}/.loki/quality/test-results.json" \
+                      "${TARGET_DIR:-.}/.loki/quality/static-analysis.pass" 2>/dev/null || true
                 return
             fi
 
@@ -21589,16 +21617,19 @@ except (json.JSONDecodeError, KeyError, TypeError, OSError):
         RETRY_COUNT=0
     fi
     # A session that starts at iteration 0 has run nothing yet, so a leftover
-    # freshness marker or unit-tests.pass is a previous session's evidence.
-    # Iterations restart at 0, so keeping them would let an old pass:true read
-    # as this iteration's result.
+    # freshness marker, unit-tests.pass, or static-analysis.pass is a previous
+    # session's evidence. Iterations restart at 0, so keeping them would let
+    # an old pass:true read as this iteration's result.
     if [ "${ITERATION_COUNT:-0}" = "0" ]; then
-        # Same path the writer (enforce_test_coverage) and the freshness
-        # readers use.
+        # Same path the writer (enforce_test_coverage, enforce_static_analysis)
+        # and the freshness readers use.
         local _q="${TARGET_DIR:-.}/.loki/quality"
         # test-results.json too: with the marker gone the receipt's quality
         # gates fall back to its status, reporting a previous session's run.
-        rm -f "$_q/.test-results.iter" "$_q/unit-tests.pass" "$_q/test-results.json" 2>/dev/null || true
+        # static-analysis.pass has no freshness marker of its own, so a stale
+        # copy from a previous session reads as a pass of this session's
+        # exogenous static_analysis gate unless it is dropped here too.
+        rm -f "$_q/.test-results.iter" "$_q/unit-tests.pass" "$_q/test-results.json" "$_q/static-analysis.pass" 2>/dev/null || true
     fi
 }
 

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "9.65.0"
+__version__ = "9.67.0"
 
 # Expose the control app for easy import
 try:

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v9.65.0
+**Version:** v9.67.0
 
 ---
 

package/docs/v10/ARCHITECT-CUTS.md

@@ -0,0 +1,89 @@
+# Architect slice cuts (2026-09-27)
+
+Verbatim final reports from the two Architect agents, kept so BOARD rows S-112..S-151 can cite a durable source.
+
+## 17:10Z cut: S-112..S-131
+
+Here are 20 new slices, S-112 to S-131. I edited no files. Each red condition below comes from reading or grepping the current source. I did not run any failing command to confirm a red.
+
+Two rules apply to every moat row. First, the Wall check is the single moat script's `CASE ... PASS` line, not `tests/moat/run.sh`. `pending.txt` is a Captain-owned hot file, and `run.sh` fails the suite when a case that is still listed there passes. So `run.sh` is expected to go red on exactly the named case ID, and the Captain deletes that pending line at merge. Second, any new test file is registered in `tests/run-all-tests.sh` by the Captain, because that file is hot too.
+
+| S-112 | P8 pending (P8.ablation-runtime-change-load-bearing, P8.ablation-na-docs-only): build the ablation producer to the interface in the p8 script header, writing `.loki/quality/ablation.json` with status load_bearing, not_load_bearing or not_applicable | autonomy/lib/ablation.py (new), tests/test-ablation.sh (new) | HIGH | red: `python3 autonomy/lib/ablation.py --help` fails today (file absent); green: on a fixture repo whose check exercises the changed function, ablation.json has status load_bearing; a docs-only change gives not_applicable with a non-empty reason; the working tree is byte-identical after the run, and after a SIGTERM sent mid-ablation (git status clean, sha256 of every file unchanged) | ready@2026-09-27T17:10Z | It rewrites the user's working tree in place (data-risk class), so restore on signal is required. Contract: tests/moat/p8-load-bearing-proof.sh lines 22-50. The P8 cases go green only once both S-112 and S-113 are merged. Neither half flips a case alone. Do not promote until a wiring slice lands (BACKLOG 34). |
+| S-113 | P8 pending (P8.ablation-dead-code-not-sealed): proof-generator copies ablation.json verbatim into facts.ablation, and _compute_headline never returns VERIFIED when status is not_load_bearing | autonomy/lib/proof-generator.py (the facts.ablation collector and _compute_headline only), tests/test-proof-ablation-headline.sh (new) | HIGH | red: on a fixture .loki with a hand-written ablation.json of status not_load_bearing and otherwise green evidence, the generated proof.json headline reads VERIFIED; green: facts.ablation equals the file's keys and the headline is not VERIFIED; an absent ablation.json leaves today's headline unchanged | ready@2026-09-27T17:10Z | Seal work. Independent of S-112 because it reads the file only. Other slices that touched proof-generator.py (S-52, S-59, S-60) are all released. Same BACKLOG 34 caveat: not wired into run.sh. |
+| S-114 | P3 pending (P3.check-author-context-excludes-implementation): build `check_author.py context --spec --repo` to interface A, printing spec_sha256, inputs and prompt, with the spec as the only repo input | autonomy/lib/check_author.py (new), tests/test-check-author-context.sh (new) | HIGH | red: `bash tests/moat/p3-the-wall.sh` emits `CASE P3.check-author-context-excludes-implementation FAIL` today; green: the same script emits PASS, and a fixture repo with src/app.py never appears in inputs or prompt | ready@2026-09-27T17:10Z | Contract: tests/moat/p3-the-wall.sh interface A (~lines 70-85). The script is present but not invoked by the pipeline, so do not promote until a wiring slice exists (BACKLOG 34). |
+| S-115 | P3 pending (P3.checks-frozen-before-eval): add `checklist-verify.py --freeze`, which records a digest of check definitions only; a later verify on edited definitions exits non-zero with "hash mismatch", and the verifier's own write-back never trips the digest | autonomy/checklist-verify.py, tests/test-checklist-freeze.sh (new) | HIGH | red: `python3 autonomy/checklist-verify.py --checklist x --freeze` is an unknown flag today, and p3-the-wall.sh emits `CASE P3.checks-frozen-before-eval FAIL`; green: that case emits PASS; freezing then verifying twice in a row exits 0 both times; editing one verification spec gives a non-zero exit with "hash mismatch" | ready@2026-09-27T17:10Z | Contract: interface B in the p3 header. Nothing in the pipeline calls --freeze yet (BACKLOG 34 caveat). |
+| S-116 | P2 pending (P2.council-inconclusive-cannot-exit-zero, BACKLOG 4): council_evidence_gate must not let inconclusive evidence through, and council_evaluate must not approve on the vote alone | autonomy/completion-council.sh (council_evidence_gate ~1858 and council_evaluate ~4154 only), tests/test-council-inconclusive-no-approve.sh (new) | HIGH | red: `bash tests/moat/p2-honest-verdict.sh` emits `CASE P2.council-inconclusive-cannot-exit-zero FAIL`; green: that case emits PASS; a genuine green-evidence fixture still approves (positive control); every other P2 case is unchanged | ready@2026-09-27T17:10Z | Honest-verdict moat. The case looks bash-only (case_council_inconclusive has no loki_route call). If the builder finds a Bun leg, return BLOCKED and do not touch council.ts. The S-49 and S-17 edits to this file are released. |
+| S-117 | P4 pending (P4.seeded-defect-corpus-present, BACKLOG 6 and 9), part 1 of 5: 20 logic-bug seeded defects to the manifest contract at p4-model-freedom.sh lines 65-84 | benchmarks/seeded-defects/cases/SD-0001 to SD-0020 (new), benchmarks/seeded-defects/fragments/logic-bug.json (new) | MEDIUM | red: benchmarks/seeded-defects does not exist; green: the fragment lists 20 entries of category logic-bug with expected_verdict NOT_SEALED; each deterministic check exits non-zero on its fixture (the defect is real); no two fixtures are byte-identical, and a renamed copy of one defect does not count as a new one | ready@2026-09-27T17:10Z | ID ranges are pre-assigned so the five corpus builders cannot collide. The moat script's corpus.py checker (line ~361) is the acceptance oracle once S-122 assembles the manifest. |
+| S-118 | P4 corpus part 2 of 5: 20 spec-miss seeded defects | benchmarks/seeded-defects/cases/SD-0021 to SD-0040 (new), benchmarks/seeded-defects/fragments/spec-miss.json (new) | MEDIUM | red: fragment absent; green: 20 spec-miss entries, each fixture with a spec plus code that misses it and a check that fails; unique and non-duplicate as in S-117 | ready@2026-09-27T17:10Z | Same contract as S-117. |
+| S-119 | P4 corpus part 3 of 5: 20 test-fitting seeded defects (tests pass by being fitted to wrong code) | benchmarks/seeded-defects/cases/SD-0041 to SD-0060 (new), benchmarks/seeded-defects/fragments/test-fitting.json (new) | MEDIUM | red: fragment absent; green: 20 test-fitting entries; each fixture's own tests pass while a held-out check named in "check" fails; verdict_path set honestly (model where no deterministic check exists) | ready@2026-09-27T17:10Z | Same contract. This is the hardest category to make deterministic. |
+| S-120 | P4 corpus part 4 of 5: 20 mock-abuse seeded defects | benchmarks/seeded-defects/cases/SD-0061 to SD-0080 (new), benchmarks/seeded-defects/fragments/mock-abuse.json (new) | MEDIUM | red: fragment absent; green: 20 mock-abuse entries, each with a mock that hides the real defect and a check that exposes it | ready@2026-09-27T17:10Z | Same contract. |
+| S-121 | P4 corpus part 5 of 5: 20 security seeded defects (hermetic, no network) | benchmarks/seeded-defects/cases/SD-0081 to SD-0100 (new), benchmarks/seeded-defects/fragments/security.json (new) | MEDIUM | red: fragment absent; green: 20 security entries (injection, path traversal, secret in code and similar), each with a check that fails on the fixture, no live exploit and no network | ready@2026-09-27T17:10Z | Same contract. |
+| S-122 | P4 corpus assembler: build_manifest.py merges fragments/*.json into manifest.json with schema loki.seeded-defects/v2 and fails on a duplicate id, a missing category or fewer than 100 defects | benchmarks/seeded-defects/build_manifest.py (new), tests/test-seeded-defects-manifest.sh (new) | LOW | red: script absent; green: on synthetic fragments it writes a valid manifest; a duplicate id, a missing category or 99 defects each exits non-zero with the reason | ready@2026-09-27T17:10Z | Buildable now against fixtures. The Captain runs it once S-117 to S-121 merge, and only then does `CASE P4.seeded-defect-corpus-present PASS` appear. P4.floor-does-not-raise-wrong-pass still needs a real measurement run that no slice covers. |
+| S-123 | BACKLOG 20: loki_proof_attestation_check accepts plain http:// JWKS URLs (a MITM controls the key set). Require https, allowing only loopback http | autonomy/loki (loki_proof_attestation_check ~956 and loki_remote_attestation_status, same guard), tests/test-jwks-https-only.sh (new) | MEDIUM | red: `loki proof verify <receipt> --jwks http://example.invalid` attempts the fetch today (source line ~990 accepts http://); green: a non-loopback http:// JWKS reads NOT CHECKED with a reason naming https, without fetching; http://127.0.0.1 still works, so tests/test-remote-attestation-verdict.sh stays green | ready@2026-09-27T17:10Z | Security. The Bun route forwards --jwks to bash (loki-ts/src/commands/proof.ts:646), so there is no TS change. This is the only slice on autonomy/loki. |
+| S-124 | BACKLOG 79: a previous session's static-analysis.pass survives iteration 0 and reads as a pass of the exogenous static_analysis gate | autonomy/run.sh (the iteration-0 evidence drop at ~21595 only), tests/test-iteration0-drops-static-analysis.sh (new) | LOW | red: with .loki/quality/static-analysis.pass present and ITERATION_COUNT=0, the file survives the drop block today (it removes only .test-results.iter, unit-tests.pass and test-results.json); green: it is removed, and a mid-session (iteration above 0) static-analysis.pass is kept | ready@2026-09-27T17:10Z | Honest verdict. It does not touch S-100's trusted-push area. This is the only slice on run.sh. |
+| S-125 | BACKLOG 76 and 89: done-recognition tests_axis reads a zero-test record ({"passed":0,"failed":0,"total":0}) as green via the failed==0 branch, and ignores failed_count on a pass:true record | autonomy/lib/done-recognition.sh (tests_axis classifier ~434-485 only), tests/test-done-recognition-tests-axis.sh (new) | MEDIUM | red: the zero-test record and {"pass":true,"failed_count":2} each classify green today; green: they classify unknown and red respectively; a real {"pass":true,"exit_code":0,"failed_count":0} stays green | ready@2026-09-27T17:10Z | Honest verdict. Current source read confirms the fall-through at the "failed == 0" line. |
+| S-126 | BACKLOG 94 part a: test_all_data_gets_scoped walks server.app.routes, which on FastAPI 0.141 and later never lists the v2 or operator routes, so its v2 coverage is vacuous on CI | tests/dashboard/test_all_data_gets_scoped.py | MEDIUM | red: under FastAPI 0.141 or later, the audited route set contains zero /api/v2 paths while app.openapi() lists them; green: the route set comes from the app router in the way the P7 matcher does it, asserts at least one /api/v2 route was audited, and passes on 0.128 and 0.141 | ready@2026-09-27T17:10Z | Local FastAPI is 0.128.0, so the red must be run on a 0.141 venv (requirements-test.txt resolves it). Avoid vacuity: assert the count is non-zero. |
+| S-127 | BACKLOG 94 part b: the same vacuous app.routes walk in test_fleet_observability (~171), test_fleet_retry (~414) and test_memory_read_scope_auth (~94) | tests/dashboard/test_fleet_observability.py, tests/dashboard/test_fleet_retry.py, tests/dashboard/test_memory_read_scope_auth.py | MEDIUM | red: under FastAPI 0.141 or later, each walk sees zero v2 or operator routes; green: each asserts a non-zero count of the route class it audits and passes on both versions | ready@2026-09-27T17:10Z | Reuse the approach from S-126, but do not edit that file. Running in parallel is fine. |
+| S-128 | BACKLOG 148: moat baseline detection (read_baselines, unreached_release) cannot see a symlinked pending.txt, because git grep -l and -L both return rc 1 on a mode-120000 blob | tests/moat/run.sh (read_baselines and unreached_release only), tests/test-moat-runner.sh | MEDIUM | red: a fixture repo with a release tag whose tests/moat/pending.txt is a symlink is treated as carrying no baseline (bootstrap), so it is unratcheted; green: that tag is either read as a baseline or refused outright with a named reason; every existing test-moat-runner.sh case stays green | ready@2026-09-27T17:10Z | Moat integrity. It does not touch pending.txt or cases.txt. |
+| S-129 | BACKLOG 93: the "zero-exit leader" case in test-hard-deadline-confinement.sh waits only 0.2s for the child PID file, so under CI load the PID is empty and the case fails on correct product behaviour | tests/test-hard-deadline-confinement.sh | LOW | red: the source has `deadline = time.monotonic() + 0.2` (~line 199), and the case fails when run under stress (for example 4 parallel copies with a CPU hog); green: a bounded wait of 10s or more for the PID file, 20/20 green under the same stress, and the rc 125 plus no-mutation assertions unchanged | ready@2026-09-27T17:10Z | Load-flake fix only. Do not weaken the fail-closed assertion. |
+| S-130 | S-51 follow-up (BACKLOG 117 remainder): SettingsPage lists Gemini as an active provider (deprecated and removed from the runtime in v7.5.18), and its build date is hardcoded to 2026-03-24 | web-app/src/pages/SettingsPage.tsx | LOW | red: `grep -n "gemini" web-app/src/pages/SettingsPage.tsx` shows a provider entry (~108) and the default providerPriority (~220), and the file contains the literal 2026-03-24 (~1003); green: Gemini is removed from PROVIDERS and the default priority (or marked deprecated and not selectable), the build date comes from build metadata or is dropped, and the web-app typecheck passes | ready@2026-09-27T17:10Z | User-visible. The Captain rebuilds web-app/dist. opencode, missing from the list, can be added the same way if trivial. |
+| S-131 | BACKLOG 106 (Bun half): the budget breaker treats unmeasured spend as $0 and never warns; warn (never pause) when a cap is set and spend is unmeasured | loki-ts/src/runner/budget.ts, loki-ts/tests/runner/budget.test.ts | MEDIUM | red: a unit test with a cap of $10 and zero measured iterations gets budget_used 0 and no warning; green: the state marks spend as unmeasured and a warning is emitted, while exceeded stays false and nothing pauses; measured runs are unchanged | ready@2026-09-27T17:10Z | P7-class honesty. The bash half (autonomy/loki cost and check_budget_limit) is a later slice, because autonomy/loki is taken by S-123 and run.sh by S-124. The Captain rebuilds loki-ts/dist. |
+
+Notes:
+1. The task premise is stale: tests/moat/pending.txt holds 13 entries, not 38. Two of them I did not slice, because they need a CEO decision (both are breaking changes deferred to v10.0.0): P2.fast-verify-inconclusive-not-zero, which is also dispatched through autonomy/loki and so collides with S-123, and P2.verify-exit-contract. P1.verification-metadata-signed is Seal work bigger than 30 minutes.
+2. Risky: S-112 rewrites the user's working tree in place. S-112 to S-115 would promote P3 and P8 as present but not wired (BACKLOG 34 says do not promote until a stub-provider run.sh session records facts.ablation and invokes check-author), so a wiring slice on run.sh has to follow S-124.
+3. CEO decisions: whether to spend 6 slices on the corpus (S-117 to S-122, which prove only P4.seeded-defect-corpus-present, not the floor-vs-top measurement), and S-131's warn-never-pause default. GUARDS 11 and 13 were not cut because they collide with S-99 (v10-guard.sh) and the pulse script. GUARDS 12 (gitconfig-write lint) is the next alternate.
+
+## 18:05Z cut: S-132..S-151
+
+I've cut 20 slices, S-132 to S-151, and checked each one against the current tree. Every row below names something still open in the code or in CI, and no two rows edit the same file. None of them edits a file or block the in-flight reworks own (S-30/S-50, S-96, S-99, S-100, S-123, S-124, S-125, S-126).
+
+Candidates I dropped because they are already fixed or would not help:
+- **BACKLOG 13:** no Docker pin is left.
+- **BACKLOG 35:** `tests/test-moat-runner.sh:653` already has the 0-byte case.
+- **BACKLOG 37 and 60:** already fixed in `quality_gates.ts`.
+- **BACKLOG 53 and 54:** those files already use `-E` everywhere.
+- **Pinning pytest-xdist:** every entry in `requirements-test.txt` is unpinned, so pinning one would break the file's convention.
+
+| S-132 | Velocity: skip the full Tests workflow on a version-bump-only commit whose parent's Tests run succeeded; run it in full otherwise (source 4) | .github/workflows/test.yml (new first gate job, `actions: read`, `needs`/`if` on the heavy jobs), scripts/ci/version-bump-only.sh (new), tests/test-version-bump-only.sh (new) | HIGH | red: on a bump-only fixture commit, test.yml runs every job; a fixture whose `loki-ts/dist` differs by more than the version string is judged eligible by nothing yet. green: bump-only plus parent Tests success skips the heavy jobs; parent pending or red runs the full suite (never waits); any non-allowlisted file runs the full suite; a parity test pulls release.yml's STEP 1 out by its content markers and gets the same eligibility verdict as the new script on at least 6 fixture diffs; mutating the script's allowlist turns the parity test red | ready@2026-09-27T18:05Z | Why HIGH: a Tests run whose jobs are all skipped concludes success, and required-ci rule (a) accepts success at the release SHA without looking at the parent. So the gate job itself must confirm the parent's Tests run succeeded, and its eligibility must be no looser than release.yml STEP 1. Never skip the version-bump consistency step (test.yml:81). Do not edit release.yml; deduplicating STEP 1 is a later slice. What it buys: runner capacity, plus no flaky failure at the release SHA (rule (b)) can block a release whose parent is green. The Captain registers the new test. |
+| S-133 | Velocity: make the Release workflow's required-ci poll faster (source 4), and fix the stale publish-npm comment S-85's review flagged as non-blocking (source 1) | .github/workflows/release.yml (the `sleep 30` in the STEP 2 poll loop, and that one comment in publish-npm) | LOW | red: `grep -n 'sleep 30' release.yml` matches inside the required-ci loop, and the publish-npm comment names publish-docker for the dist assert. green: poll interval is 10s or less, the 2400s deadline is unchanged, the comment names publish-docker-build, actionlint is clean | ready@2026-09-27T18:05Z | Token budget: 2 API calls per iteration at 10s is 12 a minute, at most 480 across the 40-minute deadline, against GITHUB_TOKEN's shared 1000 an hour per repo. Keep it at 10s or more. Edit STEP 2 only; S-132's parity test reads STEP 1 by content markers. Ships alone, since it touches release.yml (D22). |
+| S-134 | Velocity: shorten the slowest Tests shard by re-measuring shard-durations.tsv (it is from run 36319020918, now stale), plus the duration-table drift detector S-81's review listed as a follow-up (sources 4 and 1) | tests/shard-durations.tsv, tests/test-shard-durations-drift.sh (new) | LOW | red: Tests run 36338540948 shows shard 2/8 at 325s against shard 7/8 at 124s; the drift test fails today on any registered suite missing from the table, or any table row naming no registered suite. green: the table is rebuilt from the `END: <name> (Ns)` lines of all 8 shard logs of a recent green run, the drift test passes, and the next real Tests run's max shard is under 250s | ready@2026-09-27T18:05Z | Measure the whole workflow's wall clock, not just the max shard: once rebalanced, the 195s Moat suite likely becomes the floor. The floor for any single shard is ShellCheck at 140s. The Captain registers the drift test. |
+| S-135 | Velocity: run tests/test-trust-core-tests-detect.sh's 90 probe_case mutations in parallel (130s in shard 1, the second-slowest suite) (source 4) | tests/test-trust-core-tests-detect.sh | MEDIUM | red: 130s on CI and one probe at a time. green: bounded parallel probes under 50s locally; the case count stays exactly 90 and every case still executes; a deliberately removed guard still turns its case red; 5 runs under 4-way CPU load with 0 flakes | ready@2026-09-27T18:05Z | First confirm probe_case mutates a private copy. If it edits the shared tree in place, parallel runs corrupt each other and the slice changes shape. Its anchors point into completion-council.sh (line 196 loops council_checklist_gate/council_heldout_gate) and probably into the run.sh failure-count awk, so rebase after S-141 and S-140 if they land first. |
+| S-136 | Velocity: tests/test-select-tests.sh hit the 60s D27 cap (rc=124) on S-49's and S-91's train 4 checks (source 1) | tests/test-select-tests.sh | MEDIUM | red: `timeout 60 bash tests/test-select-tests.sh` returns rc=124. green: it finishes in under 30s with rc=0, still 38/38 cases, and a mutation of scripts/select-tests.sh (drop one rule) still turns it red | ready@2026-09-27T18:05Z | Coverage must not drop: assert the case count, not just the time. Do not touch scripts/select-tests.sh or tier-a.yml (S-96). |
+| S-137 | S-81 review follow-up: shard-coverage check T4 recomputes a static count instead of running the real runner (source 1) | tests/test-shard-coverage.sh | LOW | red: a mutation that makes run-all-tests.sh's LPT assignment drop one suite from shard 0 leaves T4 green. green: T4 enumerates every shard of the real runner at n=4 and n=8 through a dry-run/list path, the union equals the registration list, and the same mutation turns it red | ready@2026-09-27T18:05Z | If run-all-tests.sh has no list mode, stop and report. Adding one would touch a Captain-owned hot file. |
+| S-138 | GUARDS 12 (no guard yet): a lint so test fixtures never write the operator's real ~/.gitconfig (source 3) | tests/test-no-ambient-gitconfig-writes.sh (new) | LOW | red: a planted fixture with `git config --global url.x.insteadOf y` and no `HOME=`/`GIT_CONFIG_GLOBAL=` isolation before it is flagged, rc=1. green: the lint passes on the current 5 files that do global writes (test-trusted-push-agent-config, -acceptance-resume-idempotence, -enterprise-resilience, -branch-lifecycle, plus the moat p6/p9 scripts) only if each isolates first; any real offender is named, not allowlisted in silence | ready@2026-09-27T18:05Z | If a current file really does write the ambient config, report it; do not fix it inside this slice. The Captain registers the lint and updates GUARDS 12. |
+| S-139 | GUARDS 13 (pending) plus BACKLOG 136: pulse flags a `released@` row stamped after npm's newest publish time (RELEASED_AHEAD_OF_NPM), and reports UNKNOWN when the local release tag disagrees with npm's latest version (sources 3 and 2) | scripts/v10-pulse.sh, tests/test-v10-pulse.sh | MEDIUM | red: a fixture BOARD with a row stamped `released@15:54Z` while the PULSE_NPM_CMD fixture's latest publish is 15:00Z raises no violation; a local tag v9.54.2 against npm latest 9.55.0 prints a confident "N commits since". green: both fixtures give the new violation and an UNKNOWN respectively, existing pulse tests stay green, runtime stays under 5s | ready@2026-09-27T18:05Z | Reuse the existing `npm view loki-mode time --json` result and its cache. No new network call, to stay inside S-104's 5s budget. Chosen over a board-row-status precondition because the pulse runs on every prompt, while nothing shows the Captain writes `released` through v10-ops.sh. |
+| S-140 | BACKLOG 103: jest "Test Suites: 1 failed" alongside "Tests: 2 passed", and vitest "Test Files 1 failed", still record as passed (source 2) | autonomy/run.sh (the BACKLOG 73/111 failure-count awk near line 14240 only), plus the existing S-45 summary-parser test | MEDIUM | red: fixture output with "Test Suites: 1 failed, 1 total" and "Tests: 2 passed" records failed_count 0 and pass true; same for vitest "Test Files  1 failed \| 2 passed". green: both count at least 1 failed and the gate fails; a pure-green jest/vitest summary is still a measured 0; the trust-core suite still passes | ready@2026-09-27T18:05Z | Far from S-100's region (on_run_complete ~6012, trusted push) and S-124's (iteration 0, load_state ~21470). Run the trust-core suite in the wall and fix any anchor this breaks. |
+| S-141 | S-49 follow-up: council verdict readers outside the 3 fixed functions still run bare `python3 -E` (~1425, ~1564 gate results; ~4232 aggregate_result) (source 1) | autonomy/completion-council.sh (those 3 call sites only), tests/test-council-gate-readers-pth.sh (new) | HIGH | red: a user-site `.pth` planted under a scratch HOME flips each of the 3 readers' verdicts (as S-49 reproduced). green: all 3 go through the resolved `-I -S` interpreter helper, fail closed when no interpreter is found, the `.pth` has no effect, and a mutation reverting one site turns the test red; the trust-core suite passes | ready@2026-09-27T18:05Z | A standalone suite, not a moat case, because tests/moat/cases.txt is a hot file. The Captain registers the suite. Line numbers drift, so find the sites by grep. |
+| S-142 | S-48 follow-up: convergence-floor NEGATIVE-B passes even without the `runner!='none'` guard (source 1) | tests/test-council-convergence-floor.sh | LOW | red: removing the runner guard from the fast-path check (a scratch-copy mutation) leaves every case green. green: a new NEGATIVE-C writes the legacy shape `runner:"none", pass:true`, returns 1, and turns red under that mutation | ready@2026-09-27T18:05Z | Test-only. Confirm the guard still exists before writing; if it was removed on purpose, report that instead. |
+| S-143 | BACKLOG 117 remainder / S-51 follow-ups: Gemini, Railway, stale gate counts and "Q2 2026 Current" copy (source 2) | web-app/src/components/Roadmap.tsx, DocsSidebar.tsx, ContextualHelp.tsx, ProductTour.tsx, CostEstimator.tsx, web-app/src/pages/SystemSettingsPage.tsx | LOW | red: `grep -il -E 'gemini\|railway\|9 (automated )?quality gates\|10 quality gates\|Q2 2026'` matches all 6 files. green: 0 matches in them; gate count is 8; deploy targets are Vercel, Netlify and GitHub Pages only | ready@2026-09-27T18:05Z | Copy only. If CostEstimator's Gemini entry is pricing logic, remove the option and note it. ProjectWorkspace.tsx is out of scope. The Captain rebuilds web-app/dist. |
+| S-144 | S-51 follow-up: Footer.tsx shows v9.55.0 against VERSION 9.66.0 and is not in the bump list (source 1) | scripts/release.sh, tests/test-release-sh.sh, web-app/src/components/Footer.tsx | LOW | red: Footer.tsx holds v9.55.0 while VERSION is 9.66.0, and a `--bump-only` fixture run leaves Footer unchanged. green: `--bump-only` rewrites the Footer version slot, and the test asserts it for that file by name | ready@2026-09-27T18:05Z | WhatsNew.tsx is deliberately excluded. Its modal opens when `lastSeen !== CURRENT_VERSION`, so bumping it automatically would pop the same stale modal for every user at every release (3-5 an hour). Keying it to its own content version is a separate question (see the end list). |
+| S-145 | BACKLOG 118: GET /api/checklist/waivers answers 200 `{waivers: []}` when waivers.json is corrupt, so a read error looks like "no waivers" (source 2) | dashboard/server.py (get_checklist_waivers only), tests/dashboard/test_checklist_waivers_read_error.py (new) | LOW | red: a corrupt waivers.json returns 200 with an empty list. green: it returns 500 with an error body, matching the POST sibling at ~10431; a missing file still returns 200 with an empty list | ready@2026-09-27T18:05Z | Survey the consumers first (dashboard-ui checklist viewer, standalone): each must show "Could not load" on 500, not an empty state. Note which consumers were checked in the wall. |
+| S-146 | BACKLOG 118: the dashboard shell has two elements with `id="budget-banner"` (source 2) | dashboard-ui/scripts/build-standalone.js | LOW | red: `grep -c 'id="budget-banner"'` returns 2. green: returns 1, and the banner script still finds and updates the remaining element (a node or DOM check in the builder's evidence) | ready@2026-09-27T18:05Z | While in the file, check the other two 118 items (the "Newest first" reversal at ~2510); fix only if trivial, otherwise report. The Captain rebuilds dashboard/static/index.html. |
+| S-147 | BACKLOG 118: `loki metrics --json` sends `tokens.total` 0 and `total_iterations` 0 when nothing was recorded, and invents `time_saved_hours = iterations*15/60` (source 2) | autonomy/loki (cmd_metrics only), tests/test-metrics-json-unmeasured.sh (new) | MEDIUM | red: on an empty .loki, `loki metrics --json` prints total 0, iterations 0 and a numeric time_saved_hours. green: null (unknown) for unrecorded values, time_saved_hours removed or null, real recorded values unchanged | ready@2026-09-27T18:05Z | cmd_metrics (~28481) is far from S-123's attestation region (~956); rebase if S-123 lands first. Survey consumers of the JSON (dashboard, docs) before changing 0 to null. The Captain registers the test. |
+| S-148 | BACKLOG 118: trust.html says "Stable: no significant change" when every axis lacks the 2+ runs of history needed (source 2) | dashboard/static/trust.html | LOW | red: an API fixture where every axis has `insufficient: true` renders the "Stable" headline. green: it renders "Not enough history yet"; a fixture with real flat axes still says "Stable" (pull the headline into a named function and check it with a small node assertion) | ready@2026-09-27T18:05Z | Hand-written page, not a generated bundle. The `delta: 0.0` on an insufficient axis in trust_trajectory.py is out of scope; note it for later. |
+| S-149 | BACKLOG 118: prompt_optimizer.get_current_version returns never-ran zeros (version 0, based_on_sessions 0), and a corrupt latest file is folded into the same default (source 2) | dashboard/prompt_optimizer.py, tests/dashboard/test_prompt_optimizer_sentinels.py (new) | LOW | red: a corrupt latest file and a missing one return the identical zero dict. green: missing returns an explicit never-ran marker (nulls); corrupt returns an error marker distinct from never-ran | ready@2026-09-27T18:05Z | Survey the endpoint and panel consumers first so the new fields render as unknown, not crash. |
+| S-150 | BACKLOG 118: migration_engine.get_progress reports 0/0 features and steps when the features or plan file is corrupt or missing (source 2) | dashboard/migration_engine.py (get_progress only), tests/dashboard/test_migration_progress_unknown.py (new) | LOW | red: a corrupt plan.json gives `steps_total 0, steps_completed 0`, identical to a real empty plan. green: corrupt or missing gives null counts plus a reason; a real empty plan still gives 0 | ready@2026-09-27T18:05Z | Survey consumers (loki-migration-dashboard.js, server endpoint) to make sure null renders as unknown. |
+| S-151 | BACKLOG 118: loki-analytics heatmap counts days before the returned activity window as 0 activities (source 2) | dashboard-ui/components/loki-analytics.js (_computeHeatmap and the cell render only) | LOW | red: a fixture with activity starting 10 days ago renders the previous ~355 days as "0 activities". green: days before the earliest returned entry (or the API's window start) render as "no data", while days inside the window with no activity stay 0 | ready@2026-09-27T18:05Z | The Captain rebuilds dashboard/static/index.html. Different file from S-146. |
+
+**Risks**
+- **Registration is on the Captain.** 8 rows add a new test file (S-132, S-134, S-138, S-141, S-145, S-147, S-149, S-150). Each needs the Captain to register it in `tests/run-all-tests.sh`, or it never runs in CI.
+- **Rebuilds are on the Captain.** S-143 needs web-app/dist rebuilt; S-146 and S-151 need dashboard/static rebuilt.
+- **Test anchors, not files, couple S-135, S-140 and S-141.** Trust-core probes anchor into completion-council.sh and probably into the run.sh failure-count awk. Merge S-140 and S-141 first, and each of them must run the trust-core suite in its wall. S-135's first step is confirming probes use a private copy.
+- **Two rows touch the release gate.** S-132 is the highest-risk slice: an all-skipped Tests run reads as success at the release SHA. It needs a HIGH review focused on the parent-green check and on eligibility never being looser than release.yml STEP 1. S-133 also touches release.yml, so under D22 it ships in its own train.
+- **Same-file neighbours.** S-140 (run.sh) and S-147 (autonomy/loki) share a file with in-flight S-100/S-124 and S-123, in regions far from theirs. Expect rebases, not conflicts.
+- **S-134's gain only shows on a real CI run.** The first Tests run after merge is the evidence; the Moat suite (195s) may become the new floor.
+- **Changing zeros to null or 200 to 500 changes response shapes.** S-145, S-147, S-149 and S-150 must name the consumers they checked, or a panel can crash where it used to show a false zero.
+
+**Held for a CEO decision or waiting on another slice (not in the 20)**
+- S-112 and S-117 to S-122 (P4 corpus and ablation producer): already held.
+- BACKLOG 4: breaking exit-code renumber for `loki verify` (v10.0.0).
+- BACKLOG 18: Caveman bootstrap and its global `~/.claude` hook default-on; changing the default is a product decision.
+- BACKLOG 121: browser-only settings (plain-text API keys in localStorage, unwired "Budget limit" and "Auto-deploy"): remove or wire is a product decision.
+- BACKLOG 77: whether Bun should write its own test-results freshness marker.
+- BACKLOG 123: `audit.py verify` reporting valid on nothing checked; the cross-chain verifier reads it, so it needs its own review.
+- WhatsNew.tsx version: stays stale until someone decides what should trigger the modal.
+- GUARDS 11 (scratchpad glob `rm`): a helper nobody is forced to call blocks nothing. The real rule belongs in `scripts/v10-guard.sh`, so cut it after S-99 lands.
+- Waiting on a slice in this set: BACKLOG 127 remainder (`run.sh` auto_capture_episode, `cd "$PROJECT_DIR"` with no unset guard, ~21361) after S-140; BACKLOG 38 after S-141; BACKLOG 133 after S-139.
+
+I edited no files. The only temp file was a log saved under `$TMPDIR` and deleted in the same command. I started no background processes.