loki-mode 9.66.0 → 9.67.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v9.66.0
+# Loki Mode v9.67.0
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -470,4 +470,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v9.66.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**
+**v9.67.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**

package/VERSION

@@ -1 +1 @@
-9.66.0
+9.67.0

package/autonomy/lib/done-recognition.sh

@@ -461,8 +461,20 @@ def tests_axis(path):
         if ec != 0:
             return "red"
         # exit 0 alone is green only if nothing else contradicts it (checked below).
+    def _nonzero_int(v):
+        return isinstance(v, int) and not isinstance(v, bool) and v != 0
+    # Zero-test record: nothing actually ran, regardless of self-reported
+    # pass/fail. Checked before the pass:true/false branches below so a
+    # plausible {"pass": true, "total": 0} shape cannot slip through the
+    # pass:true branch as a false green.
+    if isinstance(d.get("total"), int) and d.get("total") == 0:
+        return "unknown"
     p = d.get("pass")
     if p is True:
+        # A self-reported pass contradicted by a nonzero failure count (under
+        # either key production/legacy shapes use) is not authoritative green.
+        if _nonzero_int(d.get("failed")) or _nonzero_int(d.get("failed_count")):
+            return "red"
         # A clean pass:true with no contradicting red signal is authoritative green.
         if d.get("failed") in (None, 0) and (ec in (None, 0)):
             return "green"

package/autonomy/loki

@@ -856,8 +856,48 @@ PY
 # absent measurement is not evidence, and inventing a PASS here would be worse
 # than inventing a FAIL.
 loki_remote_attestation_status() {
-    local pj="$1" url="$2"
+    local pj="$1" url="$2" _jh
     [ -n "$url" ] || { printf ''; return 0; }
+    # A JWKS key set travels over the same channel as the receipt it certifies.
+    # Plain http lets anyone on the network path swap in their own key set, and
+    # the attestation would then "verify" against a forged key -- a MITM the
+    # TLS the API already uses is meant to prevent. Only https is trusted;
+    # loopback http and file:// are the exceptions, because neither one leaves
+    # this machine for anyone to sit on. Checked here, before python is even
+    # invoked, so a rejected URL is never fetched -- not "fetched and then
+    # distrusted". Same check in loki_proof_attestation_check below -- change
+    # both.
+    #
+    # The host is bounded exactly (up to the first "/", then stripped of any
+    # port) rather than matched with a trailing glob, and a userinfo "@" is
+    # rejected outright -- "http://127.0.0.1:80@evil.com" is host evil.com to
+    # any real URL parser (userinfo before the @, host after), and a loose
+    # `http://127.0.0.1:*` glob would wrongly wave that straight through.
+    case "$url" in
+        https://*|file://*) ;;
+        http://*)
+            _jh="${url#http://}"; _jh="${_jh%%/*}"
+            case "$_jh" in
+                *@*) printf ''; return 0 ;;
+            esac
+            # A bracketed IPv6 literal must be the WHOLE host: "[::1]" or
+            # "[::1]:port", never a prefix, or "[::1].evil.com" (not itself
+            # resolvable as loopback, but not rejected either) would parse as
+            # loopback "::1" with everything after the first "]" silently
+            # dropped instead of validated.
+            case "$_jh" in
+                \[*\]) _jh="${_jh#\[}"; _jh="${_jh%\]}" ;;
+                \[*\]:*) _jh="${_jh#\[}"; _jh="${_jh%%\]:*}" ;;
+                \[*) printf ''; return 0 ;;
+                *) _jh="${_jh%%:*}" ;;
+            esac
+            case "$_jh" in
+                127.0.0.1|localhost|::1) ;;
+                *) printf ''; return 0 ;;
+            esac
+            ;;
+        *) printf ''; return 0 ;;
+    esac
     command -v python3 >/dev/null 2>&1 || { printf ''; return 0; }
     local tok
     # jq's `//` treats JSON false the same as null/missing, which is exactly
@@ -954,8 +994,53 @@ PY
 # testing found exactly this: a mutation applied to the first copy left every
 # assertion of the second suite green.
 loki_proof_attestation_check() {
-    local pj="$1" src="$2"
+    local pj="$1" src="$2" _jh
     [ -n "$src" ] || { printf ''; return 0; }
+    # Same MITM guard as loki_remote_attestation_status above -- change both.
+    # Only applies to a URL source; a local file (the third-party offline case)
+    # never travels a network and needs no scheme at all. The host is bounded
+    # exactly and a userinfo "@" is rejected outright -- see the sibling
+    # function's comment for why a trailing glob is not safe here.
+    #
+    # A recognized scheme prefix is checked FIRST, before any "-f" test: the
+    # process cwd is the checkout being verified (attacker-controlled), and a
+    # repo can ship a file whose literal name IS a URL string (for example
+    # "https:/evil.example.com/.well-known/jwks.json" as a real path on disk).
+    # Testing "-f" first would treat that shadow file as the local-file form
+    # and hand its content straight to the caller with no network involved at
+    # all -- silently defeating the "only https is trusted" guarantee this
+    # function exists to provide. Scheme detection must win over the
+    # filesystem every time, not just when no file happens to collide.
+    case "$src" in
+        https://*|http://*|file://*)
+            case "$src" in
+                https://*|file://*) ;;
+                http://*)
+                    _jh="${src#http://}"; _jh="${_jh%%/*}"
+                    case "$_jh" in
+                        *@*) printf ''; return 0 ;;
+                    esac
+                    # See loki_remote_attestation_status above for why the
+                    # bracketed-IPv6 match must bound the closing bracket.
+                    case "$_jh" in
+                        \[*\]) _jh="${_jh#\[}"; _jh="${_jh%\]}" ;;
+                        \[*\]:*) _jh="${_jh#\[}"; _jh="${_jh%%\]:*}" ;;
+                        \[*) printf ''; return 0 ;;
+                        *) _jh="${_jh%%:*}" ;;
+                    esac
+                    case "$_jh" in
+                        127.0.0.1|localhost|::1) ;;
+                        *) printf ''; return 0 ;;
+                    esac
+                    ;;
+            esac
+            ;;
+        *)
+            # A plain path is decided in python below, which reports an
+            # unsigned receipt as "none" BEFORE it looks at the key file, so a
+            # missing key file on an unsigned receipt still fails (exit 1).
+            ;;
+    esac
     command -v python3 >/dev/null 2>&1 || { printf ''; return 0; }
     python3 -E - "$pj" "$src" "${_LOKI_SCRIPT_DIR}" <<'PY' 2>/dev/null || printf ''
 # The cwd is the checkout being verified: drop it from sys.path before any
@@ -984,15 +1069,20 @@ if tok is None or tok == "" or tok is False:
     print("none"); sys.exit(0)       # a FACT about the receipt, not an error
 src = sys.argv[2]
 try:
-    if os.path.isfile(src):
-        jwks = json.load(open(src))
-    else:
-        if not src.startswith(("http://", "https://")):
-            sys.exit(1)
+    # Scheme check first, same as the bash gate above -- a "-f" test run
+    # first would let a local file whose literal name IS an http(s) URL
+    # string (the process cwd is the checkout being verified) silently stand
+    # in for a real fetch. A recognized scheme always means "URL", even if a
+    # same-named file happens to exist on disk.
+    if src.startswith(("http://", "https://")):
         url = src if src.rstrip("/").endswith("jwks.json") else \
             src.rstrip("/") + "/.well-known/jwks.json"
         with urllib.request.urlopen(url, timeout=10) as r:
             jwks = json.loads(r.read())
+    elif os.path.isfile(src):
+        jwks = json.load(open(src))
+    else:
+        sys.exit(1)
 except Exception:
     sys.exit(1)                      # "" : unreachable/unreadable, no verdict
 # A key set that is not {"keys": [{...}, ...]} -- INCLUDING an empty list -- is
@@ -1177,7 +1267,8 @@ loki_remote_verify_receipt() {
     # gpg-unavailable branch above: NOT CHECKED, return 0, provenance unproven.
     if [ -z "$_attest" ] && jq -e '.verification.attestation // empty' "$pj" >/dev/null 2>&1; then
         echo -e "  ${YELLOW}NOT CHECKED${NC}: the receipt carries an attestation, but it could not be checked"
-        echo "    against ${_attest_url:-<no url>} (JWKS unreachable, or python cryptography missing)."
+        echo "    against ${_attest_url:-<no url>} (JWKS unreachable, python cryptography missing, or"
+        echo "    the JWKS URL is not https -- only loopback is allowed over plain http)."
         echo "    Its integrity hash matches. Provenance is unproven here, not disproven."
         echo "    Install python3 cryptography, or re-run where the build server is reachable."
         return 0
@@ -37014,7 +37105,8 @@ print(json.dumps(json.load(open(os.environ['LOKI_PROOF_JSON'])), indent=2))
                         # read as either a pass or an accusation, so it exits 2
                         # (could not check). A tamper/drift 1 from the base
                         # verifier is a finding and is never softened to 2.
-                        echo -e "${YELLOW}attestation: NOT CHECKED -- could not check against ${_pv_jwks} (key set unreadable, or verifier dependency missing).${NC}" >&2
+                        echo -e "${YELLOW}attestation: NOT CHECKED -- could not check against ${_pv_jwks} (key set unreadable,${NC}" >&2
+                        echo -e "${YELLOW}  verifier dependency missing, or the JWKS URL is not https -- only loopback is allowed over plain http).${NC}" >&2
                         echo "  This is not a failure of the receipt. Nothing was proven either way (exit 2)." >&2
                         if [ "$_pv_rc" -eq 0 ]; then _pv_rc=2; fi
                         _pv_attestation_field="NOT CHECKED"

package/autonomy/run.sh

@@ -5911,6 +5911,27 @@ _loki_trusted_push() {
         log_warn "Not pushing branch '$_branch': origin changed during the run (it was $(_loki_github_repo_from_url "$_LOKI_PINNED_ORIGIN" 2>/dev/null || echo "not a GitHub repository") when the run started). Loki does not push to a destination the agent could have chosen."
         return 2
     fi
+    # S-100: never push a default branch, for every caller (on_run_complete,
+    # create_session_pr): the branch name can come from agent-writable state.
+    # The default branch is resolved for the origin just validated (the pinned
+    # one when pinned), gh run from / with an explicit OWNER/REPO. An
+    # unresolvable default branch refuses: fail closed.
+    local _repo _def=""
+    case "$_branch" in
+        main|master|HEAD)
+            log_warn "Not pushing branch '$_branch': Loki never pushes directly to a default branch."
+            return 2 ;;
+    esac
+    _repo="$(_loki_github_repo_from_url "$_url")"
+    _def="$(_loki_run_neutral "$_repo" "$_runner" gh repo view "$_repo" --json defaultBranchRef --jq '.defaultBranchRef.name' 2>/dev/null)" || _def=""
+    if [ -z "$_def" ]; then
+        log_warn "Not pushing branch '$_branch': could not resolve the default branch of $_repo, and Loki never risks a direct push to it."
+        return 2
+    fi
+    if [ "$_branch" = "$_def" ]; then
+        log_warn "Not pushing branch '$_branch': it is the default branch of $_repo, and Loki never pushes directly to the default branch."
+        return 2
+    fi
     _tmp="$(mktemp -d "${TMPDIR:-/tmp}/loki-push.XXXXXX")" || return 1
     # --update-shallow: a shallow agent repo's history ends in shallow roots,
     # which a plain fetch rejects while still exiting 0. The rev-parse makes a
@@ -6070,6 +6091,8 @@ on_run_complete() {
     case "$branch" in
         ""|main|master|HEAD) return 0 ;;
     esac
+    # S-100: the repository's ACTUAL default branch (develop, trunk, ...) is
+    # refused inside _loki_trusted_push, for every caller.
     log_info "LOKI_DELEGATE_PR=1: opening a local pull request for branch '$branch'..."
     # Push, then create. Non-interactive (no tty in --bg). Best-effort, each
     # network call bounded by the timeout guard above.
@@ -21516,9 +21539,14 @@ except (json.JSONDecodeError, KeyError, TypeError, OSError):
                 mv "$state_file" "${state_file}.corrupt.$(date +%s)" 2>/dev/null || true
                 # Starts at iteration 0: drop the previous session's test
                 # evidence, as the iteration-0 block at the end does.
+                # S-124 follow-up: static-analysis.pass has no freshness
+                # marker of its own (same reasoning as the block below), so
+                # this corrupted-state restart must drop it too, or a stale
+                # copy survives this sibling iteration-0 trigger.
                 rm -f "${TARGET_DIR:-.}/.loki/quality/.test-results.iter" \
                       "${TARGET_DIR:-.}/.loki/quality/unit-tests.pass" \
-                      "${TARGET_DIR:-.}/.loki/quality/test-results.json" 2>/dev/null || true
+                      "${TARGET_DIR:-.}/.loki/quality/test-results.json" \
+                      "${TARGET_DIR:-.}/.loki/quality/static-analysis.pass" 2>/dev/null || true
                 return
             fi
 
@@ -21589,16 +21617,19 @@ except (json.JSONDecodeError, KeyError, TypeError, OSError):
         RETRY_COUNT=0
     fi
     # A session that starts at iteration 0 has run nothing yet, so a leftover
-    # freshness marker or unit-tests.pass is a previous session's evidence.
-    # Iterations restart at 0, so keeping them would let an old pass:true read
-    # as this iteration's result.
+    # freshness marker, unit-tests.pass, or static-analysis.pass is a previous
+    # session's evidence. Iterations restart at 0, so keeping them would let
+    # an old pass:true read as this iteration's result.
     if [ "${ITERATION_COUNT:-0}" = "0" ]; then
-        # Same path the writer (enforce_test_coverage) and the freshness
-        # readers use.
+        # Same path the writer (enforce_test_coverage, enforce_static_analysis)
+        # and the freshness readers use.
         local _q="${TARGET_DIR:-.}/.loki/quality"
         # test-results.json too: with the marker gone the receipt's quality
         # gates fall back to its status, reporting a previous session's run.
-        rm -f "$_q/.test-results.iter" "$_q/unit-tests.pass" "$_q/test-results.json" 2>/dev/null || true
+        # static-analysis.pass has no freshness marker of its own, so a stale
+        # copy from a previous session reads as a pass of this session's
+        # exogenous static_analysis gate unless it is dropped here too.
+        rm -f "$_q/.test-results.iter" "$_q/unit-tests.pass" "$_q/test-results.json" "$_q/static-analysis.pass" 2>/dev/null || true
     fi
 }
 

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "9.66.0"
+__version__ = "9.67.0"
 
 # Expose the control app for easy import
 try:

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v9.66.0
+**Version:** v9.67.0
 
 ---
 

package/docs/v10/ARCHITECT-CUTS.md

@@ -0,0 +1,89 @@
+# Architect slice cuts (2026-09-27)
+
+Verbatim final reports from the two Architect agents, kept so BOARD rows S-112..S-151 can cite a durable source.
+
+## 17:10Z cut: S-112..S-131
+
+Here are 20 new slices, S-112 to S-131. I edited no files. Each red condition below comes from reading or grepping the current source. I did not run any failing command to confirm a red.
+
+Two rules apply to every moat row. First, the Wall check is the single moat script's `CASE ... PASS` line, not `tests/moat/run.sh`. `pending.txt` is a Captain-owned hot file, and `run.sh` fails the suite when a case that is still listed there passes. So `run.sh` is expected to go red on exactly the named case ID, and the Captain deletes that pending line at merge. Second, any new test file is registered in `tests/run-all-tests.sh` by the Captain, because that file is hot too.
+
+| S-112 | P8 pending (P8.ablation-runtime-change-load-bearing, P8.ablation-na-docs-only): build the ablation producer to the interface in the p8 script header, writing `.loki/quality/ablation.json` with status load_bearing, not_load_bearing or not_applicable | autonomy/lib/ablation.py (new), tests/test-ablation.sh (new) | HIGH | red: `python3 autonomy/lib/ablation.py --help` fails today (file absent); green: on a fixture repo whose check exercises the changed function, ablation.json has status load_bearing; a docs-only change gives not_applicable with a non-empty reason; the working tree is byte-identical after the run, and after a SIGTERM sent mid-ablation (git status clean, sha256 of every file unchanged) | ready@2026-09-27T17:10Z | It rewrites the user's working tree in place (data-risk class), so restore on signal is required. Contract: tests/moat/p8-load-bearing-proof.sh lines 22-50. The P8 cases go green only once both S-112 and S-113 are merged. Neither half flips a case alone. Do not promote until a wiring slice lands (BACKLOG 34). |
+| S-113 | P8 pending (P8.ablation-dead-code-not-sealed): proof-generator copies ablation.json verbatim into facts.ablation, and _compute_headline never returns VERIFIED when status is not_load_bearing | autonomy/lib/proof-generator.py (the facts.ablation collector and _compute_headline only), tests/test-proof-ablation-headline.sh (new) | HIGH | red: on a fixture .loki with a hand-written ablation.json of status not_load_bearing and otherwise green evidence, the generated proof.json headline reads VERIFIED; green: facts.ablation equals the file's keys and the headline is not VERIFIED; an absent ablation.json leaves today's headline unchanged | ready@2026-09-27T17:10Z | Seal work. Independent of S-112 because it reads the file only. Other slices that touched proof-generator.py (S-52, S-59, S-60) are all released. Same BACKLOG 34 caveat: not wired into run.sh. |
+| S-114 | P3 pending (P3.check-author-context-excludes-implementation): build `check_author.py context --spec --repo` to interface A, printing spec_sha256, inputs and prompt, with the spec as the only repo input | autonomy/lib/check_author.py (new), tests/test-check-author-context.sh (new) | HIGH | red: `bash tests/moat/p3-the-wall.sh` emits `CASE P3.check-author-context-excludes-implementation FAIL` today; green: the same script emits PASS, and a fixture repo with src/app.py never appears in inputs or prompt | ready@2026-09-27T17:10Z | Contract: tests/moat/p3-the-wall.sh interface A (~lines 70-85). The script is present but not invoked by the pipeline, so do not promote until a wiring slice exists (BACKLOG 34). |
+| S-115 | P3 pending (P3.checks-frozen-before-eval): add `checklist-verify.py --freeze`, which records a digest of check definitions only; a later verify on edited definitions exits non-zero with "hash mismatch", and the verifier's own write-back never trips the digest | autonomy/checklist-verify.py, tests/test-checklist-freeze.sh (new) | HIGH | red: `python3 autonomy/checklist-verify.py --checklist x --freeze` is an unknown flag today, and p3-the-wall.sh emits `CASE P3.checks-frozen-before-eval FAIL`; green: that case emits PASS; freezing then verifying twice in a row exits 0 both times; editing one verification spec gives a non-zero exit with "hash mismatch" | ready@2026-09-27T17:10Z | Contract: interface B in the p3 header. Nothing in the pipeline calls --freeze yet (BACKLOG 34 caveat). |
+| S-116 | P2 pending (P2.council-inconclusive-cannot-exit-zero, BACKLOG 4): council_evidence_gate must not let inconclusive evidence through, and council_evaluate must not approve on the vote alone | autonomy/completion-council.sh (council_evidence_gate ~1858 and council_evaluate ~4154 only), tests/test-council-inconclusive-no-approve.sh (new) | HIGH | red: `bash tests/moat/p2-honest-verdict.sh` emits `CASE P2.council-inconclusive-cannot-exit-zero FAIL`; green: that case emits PASS; a genuine green-evidence fixture still approves (positive control); every other P2 case is unchanged | ready@2026-09-27T17:10Z | Honest-verdict moat. The case looks bash-only (case_council_inconclusive has no loki_route call). If the builder finds a Bun leg, return BLOCKED and do not touch council.ts. The S-49 and S-17 edits to this file are released. |
+| S-117 | P4 pending (P4.seeded-defect-corpus-present, BACKLOG 6 and 9), part 1 of 5: 20 logic-bug seeded defects to the manifest contract at p4-model-freedom.sh lines 65-84 | benchmarks/seeded-defects/cases/SD-0001 to SD-0020 (new), benchmarks/seeded-defects/fragments/logic-bug.json (new) | MEDIUM | red: benchmarks/seeded-defects does not exist; green: the fragment lists 20 entries of category logic-bug with expected_verdict NOT_SEALED; each deterministic check exits non-zero on its fixture (the defect is real); no two fixtures are byte-identical, and a renamed copy of one defect does not count as a new one | ready@2026-09-27T17:10Z | ID ranges are pre-assigned so the five corpus builders cannot collide. The moat script's corpus.py checker (line ~361) is the acceptance oracle once S-122 assembles the manifest. |
+| S-118 | P4 corpus part 2 of 5: 20 spec-miss seeded defects | benchmarks/seeded-defects/cases/SD-0021 to SD-0040 (new), benchmarks/seeded-defects/fragments/spec-miss.json (new) | MEDIUM | red: fragment absent; green: 20 spec-miss entries, each fixture with a spec plus code that misses it and a check that fails; unique and non-duplicate as in S-117 | ready@2026-09-27T17:10Z | Same contract as S-117. |
+| S-119 | P4 corpus part 3 of 5: 20 test-fitting seeded defects (tests pass by being fitted to wrong code) | benchmarks/seeded-defects/cases/SD-0041 to SD-0060 (new), benchmarks/seeded-defects/fragments/test-fitting.json (new) | MEDIUM | red: fragment absent; green: 20 test-fitting entries; each fixture's own tests pass while a held-out check named in "check" fails; verdict_path set honestly (model where no deterministic check exists) | ready@2026-09-27T17:10Z | Same contract. This is the hardest category to make deterministic. |
+| S-120 | P4 corpus part 4 of 5: 20 mock-abuse seeded defects | benchmarks/seeded-defects/cases/SD-0061 to SD-0080 (new), benchmarks/seeded-defects/fragments/mock-abuse.json (new) | MEDIUM | red: fragment absent; green: 20 mock-abuse entries, each with a mock that hides the real defect and a check that exposes it | ready@2026-09-27T17:10Z | Same contract. |
+| S-121 | P4 corpus part 5 of 5: 20 security seeded defects (hermetic, no network) | benchmarks/seeded-defects/cases/SD-0081 to SD-0100 (new), benchmarks/seeded-defects/fragments/security.json (new) | MEDIUM | red: fragment absent; green: 20 security entries (injection, path traversal, secret in code and similar), each with a check that fails on the fixture, no live exploit and no network | ready@2026-09-27T17:10Z | Same contract. |
+| S-122 | P4 corpus assembler: build_manifest.py merges fragments/*.json into manifest.json with schema loki.seeded-defects/v2 and fails on a duplicate id, a missing category or fewer than 100 defects | benchmarks/seeded-defects/build_manifest.py (new), tests/test-seeded-defects-manifest.sh (new) | LOW | red: script absent; green: on synthetic fragments it writes a valid manifest; a duplicate id, a missing category or 99 defects each exits non-zero with the reason | ready@2026-09-27T17:10Z | Buildable now against fixtures. The Captain runs it once S-117 to S-121 merge, and only then does `CASE P4.seeded-defect-corpus-present PASS` appear. P4.floor-does-not-raise-wrong-pass still needs a real measurement run that no slice covers. |
+| S-123 | BACKLOG 20: loki_proof_attestation_check accepts plain http:// JWKS URLs (a MITM controls the key set). Require https, allowing only loopback http | autonomy/loki (loki_proof_attestation_check ~956 and loki_remote_attestation_status, same guard), tests/test-jwks-https-only.sh (new) | MEDIUM | red: `loki proof verify <receipt> --jwks http://example.invalid` attempts the fetch today (source line ~990 accepts http://); green: a non-loopback http:// JWKS reads NOT CHECKED with a reason naming https, without fetching; http://127.0.0.1 still works, so tests/test-remote-attestation-verdict.sh stays green | ready@2026-09-27T17:10Z | Security. The Bun route forwards --jwks to bash (loki-ts/src/commands/proof.ts:646), so there is no TS change. This is the only slice on autonomy/loki. |
+| S-124 | BACKLOG 79: a previous session's static-analysis.pass survives iteration 0 and reads as a pass of the exogenous static_analysis gate | autonomy/run.sh (the iteration-0 evidence drop at ~21595 only), tests/test-iteration0-drops-static-analysis.sh (new) | LOW | red: with .loki/quality/static-analysis.pass present and ITERATION_COUNT=0, the file survives the drop block today (it removes only .test-results.iter, unit-tests.pass and test-results.json); green: it is removed, and a mid-session (iteration above 0) static-analysis.pass is kept | ready@2026-09-27T17:10Z | Honest verdict. It does not touch S-100's trusted-push area. This is the only slice on run.sh. |
+| S-125 | BACKLOG 76 and 89: done-recognition tests_axis reads a zero-test record ({"passed":0,"failed":0,"total":0}) as green via the failed==0 branch, and ignores failed_count on a pass:true record | autonomy/lib/done-recognition.sh (tests_axis classifier ~434-485 only), tests/test-done-recognition-tests-axis.sh (new) | MEDIUM | red: the zero-test record and {"pass":true,"failed_count":2} each classify green today; green: they classify unknown and red respectively; a real {"pass":true,"exit_code":0,"failed_count":0} stays green | ready@2026-09-27T17:10Z | Honest verdict. Current source read confirms the fall-through at the "failed == 0" line. |
+| S-126 | BACKLOG 94 part a: test_all_data_gets_scoped walks server.app.routes, which on FastAPI 0.141 and later never lists the v2 or operator routes, so its v2 coverage is vacuous on CI | tests/dashboard/test_all_data_gets_scoped.py | MEDIUM | red: under FastAPI 0.141 or later, the audited route set contains zero /api/v2 paths while app.openapi() lists them; green: the route set comes from the app router in the way the P7 matcher does it, asserts at least one /api/v2 route was audited, and passes on 0.128 and 0.141 | ready@2026-09-27T17:10Z | Local FastAPI is 0.128.0, so the red must be run on a 0.141 venv (requirements-test.txt resolves it). Avoid vacuity: assert the count is non-zero. |
+| S-127 | BACKLOG 94 part b: the same vacuous app.routes walk in test_fleet_observability (~171), test_fleet_retry (~414) and test_memory_read_scope_auth (~94) | tests/dashboard/test_fleet_observability.py, tests/dashboard/test_fleet_retry.py, tests/dashboard/test_memory_read_scope_auth.py | MEDIUM | red: under FastAPI 0.141 or later, each walk sees zero v2 or operator routes; green: each asserts a non-zero count of the route class it audits and passes on both versions | ready@2026-09-27T17:10Z | Reuse the approach from S-126, but do not edit that file. Running in parallel is fine. |
+| S-128 | BACKLOG 148: moat baseline detection (read_baselines, unreached_release) cannot see a symlinked pending.txt, because git grep -l and -L both return rc 1 on a mode-120000 blob | tests/moat/run.sh (read_baselines and unreached_release only), tests/test-moat-runner.sh | MEDIUM | red: a fixture repo with a release tag whose tests/moat/pending.txt is a symlink is treated as carrying no baseline (bootstrap), so it is unratcheted; green: that tag is either read as a baseline or refused outright with a named reason; every existing test-moat-runner.sh case stays green | ready@2026-09-27T17:10Z | Moat integrity. It does not touch pending.txt or cases.txt. |
+| S-129 | BACKLOG 93: the "zero-exit leader" case in test-hard-deadline-confinement.sh waits only 0.2s for the child PID file, so under CI load the PID is empty and the case fails on correct product behaviour | tests/test-hard-deadline-confinement.sh | LOW | red: the source has `deadline = time.monotonic() + 0.2` (~line 199), and the case fails when run under stress (for example 4 parallel copies with a CPU hog); green: a bounded wait of 10s or more for the PID file, 20/20 green under the same stress, and the rc 125 plus no-mutation assertions unchanged | ready@2026-09-27T17:10Z | Load-flake fix only. Do not weaken the fail-closed assertion. |
+| S-130 | S-51 follow-up (BACKLOG 117 remainder): SettingsPage lists Gemini as an active provider (deprecated and removed from the runtime in v7.5.18), and its build date is hardcoded to 2026-03-24 | web-app/src/pages/SettingsPage.tsx | LOW | red: `grep -n "gemini" web-app/src/pages/SettingsPage.tsx` shows a provider entry (~108) and the default providerPriority (~220), and the file contains the literal 2026-03-24 (~1003); green: Gemini is removed from PROVIDERS and the default priority (or marked deprecated and not selectable), the build date comes from build metadata or is dropped, and the web-app typecheck passes | ready@2026-09-27T17:10Z | User-visible. The Captain rebuilds web-app/dist. opencode, missing from the list, can be added the same way if trivial. |
+| S-131 | BACKLOG 106 (Bun half): the budget breaker treats unmeasured spend as $0 and never warns; warn (never pause) when a cap is set and spend is unmeasured | loki-ts/src/runner/budget.ts, loki-ts/tests/runner/budget.test.ts | MEDIUM | red: a unit test with a cap of $10 and zero measured iterations gets budget_used 0 and no warning; green: the state marks spend as unmeasured and a warning is emitted, while exceeded stays false and nothing pauses; measured runs are unchanged | ready@2026-09-27T17:10Z | P7-class honesty. The bash half (autonomy/loki cost and check_budget_limit) is a later slice, because autonomy/loki is taken by S-123 and run.sh by S-124. The Captain rebuilds loki-ts/dist. |
+
+Notes:
+1. The task premise is stale: tests/moat/pending.txt holds 13 entries, not 38. Two of them I did not slice, because they need a CEO decision (both are breaking changes deferred to v10.0.0): P2.fast-verify-inconclusive-not-zero, which is also dispatched through autonomy/loki and so collides with S-123, and P2.verify-exit-contract. P1.verification-metadata-signed is Seal work bigger than 30 minutes.
+2. Risky: S-112 rewrites the user's working tree in place. S-112 to S-115 would promote P3 and P8 as present but not wired (BACKLOG 34 says do not promote until a stub-provider run.sh session records facts.ablation and invokes check-author), so a wiring slice on run.sh has to follow S-124.
+3. CEO decisions: whether to spend 6 slices on the corpus (S-117 to S-122, which prove only P4.seeded-defect-corpus-present, not the floor-vs-top measurement), and S-131's warn-never-pause default. GUARDS 11 and 13 were not cut because they collide with S-99 (v10-guard.sh) and the pulse script. GUARDS 12 (gitconfig-write lint) is the next alternate.
+
+## 18:05Z cut: S-132..S-151
+
+I've cut 20 slices, S-132 to S-151, and checked each one against the current tree. Every row below names something still open in the code or in CI, and no two rows edit the same file. None of them edits a file or block the in-flight reworks own (S-30/S-50, S-96, S-99, S-100, S-123, S-124, S-125, S-126).
+
+Candidates I dropped because they are already fixed or would not help:
+- **BACKLOG 13:** no Docker pin is left.
+- **BACKLOG 35:** `tests/test-moat-runner.sh:653` already has the 0-byte case.
+- **BACKLOG 37 and 60:** already fixed in `quality_gates.ts`.
+- **BACKLOG 53 and 54:** those files already use `-E` everywhere.
+- **Pinning pytest-xdist:** every entry in `requirements-test.txt` is unpinned, so pinning one would break the file's convention.
+
+| S-132 | Velocity: skip the full Tests workflow on a version-bump-only commit whose parent's Tests run succeeded; run it in full otherwise (source 4) | .github/workflows/test.yml (new first gate job, `actions: read`, `needs`/`if` on the heavy jobs), scripts/ci/version-bump-only.sh (new), tests/test-version-bump-only.sh (new) | HIGH | red: on a bump-only fixture commit, test.yml runs every job; a fixture whose `loki-ts/dist` differs by more than the version string is judged eligible by nothing yet. green: bump-only plus parent Tests success skips the heavy jobs; parent pending or red runs the full suite (never waits); any non-allowlisted file runs the full suite; a parity test pulls release.yml's STEP 1 out by its content markers and gets the same eligibility verdict as the new script on at least 6 fixture diffs; mutating the script's allowlist turns the parity test red | ready@2026-09-27T18:05Z | Why HIGH: a Tests run whose jobs are all skipped concludes success, and required-ci rule (a) accepts success at the release SHA without looking at the parent. So the gate job itself must confirm the parent's Tests run succeeded, and its eligibility must be no looser than release.yml STEP 1. Never skip the version-bump consistency step (test.yml:81). Do not edit release.yml; deduplicating STEP 1 is a later slice. What it buys: runner capacity, plus no flaky failure at the release SHA (rule (b)) can block a release whose parent is green. The Captain registers the new test. |
+| S-133 | Velocity: make the Release workflow's required-ci poll faster (source 4), and fix the stale publish-npm comment S-85's review flagged as non-blocking (source 1) | .github/workflows/release.yml (the `sleep 30` in the STEP 2 poll loop, and that one comment in publish-npm) | LOW | red: `grep -n 'sleep 30' release.yml` matches inside the required-ci loop, and the publish-npm comment names publish-docker for the dist assert. green: poll interval is 10s or less, the 2400s deadline is unchanged, the comment names publish-docker-build, actionlint is clean | ready@2026-09-27T18:05Z | Token budget: 2 API calls per iteration at 10s is 12 a minute, at most 480 across the 40-minute deadline, against GITHUB_TOKEN's shared 1000 an hour per repo. Keep it at 10s or more. Edit STEP 2 only; S-132's parity test reads STEP 1 by content markers. Ships alone, since it touches release.yml (D22). |
+| S-134 | Velocity: shorten the slowest Tests shard by re-measuring shard-durations.tsv (it is from run 36319020918, now stale), plus the duration-table drift detector S-81's review listed as a follow-up (sources 4 and 1) | tests/shard-durations.tsv, tests/test-shard-durations-drift.sh (new) | LOW | red: Tests run 36338540948 shows shard 2/8 at 325s against shard 7/8 at 124s; the drift test fails today on any registered suite missing from the table, or any table row naming no registered suite. green: the table is rebuilt from the `END: <name> (Ns)` lines of all 8 shard logs of a recent green run, the drift test passes, and the next real Tests run's max shard is under 250s | ready@2026-09-27T18:05Z | Measure the whole workflow's wall clock, not just the max shard: once rebalanced, the 195s Moat suite likely becomes the floor. The floor for any single shard is ShellCheck at 140s. The Captain registers the drift test. |
+| S-135 | Velocity: run tests/test-trust-core-tests-detect.sh's 90 probe_case mutations in parallel (130s in shard 1, the second-slowest suite) (source 4) | tests/test-trust-core-tests-detect.sh | MEDIUM | red: 130s on CI and one probe at a time. green: bounded parallel probes under 50s locally; the case count stays exactly 90 and every case still executes; a deliberately removed guard still turns its case red; 5 runs under 4-way CPU load with 0 flakes | ready@2026-09-27T18:05Z | First confirm probe_case mutates a private copy. If it edits the shared tree in place, parallel runs corrupt each other and the slice changes shape. Its anchors point into completion-council.sh (line 196 loops council_checklist_gate/council_heldout_gate) and probably into the run.sh failure-count awk, so rebase after S-141 and S-140 if they land first. |
+| S-136 | Velocity: tests/test-select-tests.sh hit the 60s D27 cap (rc=124) on S-49's and S-91's train 4 checks (source 1) | tests/test-select-tests.sh | MEDIUM | red: `timeout 60 bash tests/test-select-tests.sh` returns rc=124. green: it finishes in under 30s with rc=0, still 38/38 cases, and a mutation of scripts/select-tests.sh (drop one rule) still turns it red | ready@2026-09-27T18:05Z | Coverage must not drop: assert the case count, not just the time. Do not touch scripts/select-tests.sh or tier-a.yml (S-96). |
+| S-137 | S-81 review follow-up: shard-coverage check T4 recomputes a static count instead of running the real runner (source 1) | tests/test-shard-coverage.sh | LOW | red: a mutation that makes run-all-tests.sh's LPT assignment drop one suite from shard 0 leaves T4 green. green: T4 enumerates every shard of the real runner at n=4 and n=8 through a dry-run/list path, the union equals the registration list, and the same mutation turns it red | ready@2026-09-27T18:05Z | If run-all-tests.sh has no list mode, stop and report. Adding one would touch a Captain-owned hot file. |
+| S-138 | GUARDS 12 (no guard yet): a lint so test fixtures never write the operator's real ~/.gitconfig (source 3) | tests/test-no-ambient-gitconfig-writes.sh (new) | LOW | red: a planted fixture with `git config --global url.x.insteadOf y` and no `HOME=`/`GIT_CONFIG_GLOBAL=` isolation before it is flagged, rc=1. green: the lint passes on the current 5 files that do global writes (test-trusted-push-agent-config, -acceptance-resume-idempotence, -enterprise-resilience, -branch-lifecycle, plus the moat p6/p9 scripts) only if each isolates first; any real offender is named, not allowlisted in silence | ready@2026-09-27T18:05Z | If a current file really does write the ambient config, report it; do not fix it inside this slice. The Captain registers the lint and updates GUARDS 12. |
+| S-139 | GUARDS 13 (pending) plus BACKLOG 136: pulse flags a `released@` row stamped after npm's newest publish time (RELEASED_AHEAD_OF_NPM), and reports UNKNOWN when the local release tag disagrees with npm's latest version (sources 3 and 2) | scripts/v10-pulse.sh, tests/test-v10-pulse.sh | MEDIUM | red: a fixture BOARD with a row stamped `released@15:54Z` while the PULSE_NPM_CMD fixture's latest publish is 15:00Z raises no violation; a local tag v9.54.2 against npm latest 9.55.0 prints a confident "N commits since". green: both fixtures give the new violation and an UNKNOWN respectively, existing pulse tests stay green, runtime stays under 5s | ready@2026-09-27T18:05Z | Reuse the existing `npm view loki-mode time --json` result and its cache. No new network call, to stay inside S-104's 5s budget. Chosen over a board-row-status precondition because the pulse runs on every prompt, while nothing shows the Captain writes `released` through v10-ops.sh. |
+| S-140 | BACKLOG 103: jest "Test Suites: 1 failed" alongside "Tests: 2 passed", and vitest "Test Files 1 failed", still record as passed (source 2) | autonomy/run.sh (the BACKLOG 73/111 failure-count awk near line 14240 only), plus the existing S-45 summary-parser test | MEDIUM | red: fixture output with "Test Suites: 1 failed, 1 total" and "Tests: 2 passed" records failed_count 0 and pass true; same for vitest "Test Files  1 failed \| 2 passed". green: both count at least 1 failed and the gate fails; a pure-green jest/vitest summary is still a measured 0; the trust-core suite still passes | ready@2026-09-27T18:05Z | Far from S-100's region (on_run_complete ~6012, trusted push) and S-124's (iteration 0, load_state ~21470). Run the trust-core suite in the wall and fix any anchor this breaks. |
+| S-141 | S-49 follow-up: council verdict readers outside the 3 fixed functions still run bare `python3 -E` (~1425, ~1564 gate results; ~4232 aggregate_result) (source 1) | autonomy/completion-council.sh (those 3 call sites only), tests/test-council-gate-readers-pth.sh (new) | HIGH | red: a user-site `.pth` planted under a scratch HOME flips each of the 3 readers' verdicts (as S-49 reproduced). green: all 3 go through the resolved `-I -S` interpreter helper, fail closed when no interpreter is found, the `.pth` has no effect, and a mutation reverting one site turns the test red; the trust-core suite passes | ready@2026-09-27T18:05Z | A standalone suite, not a moat case, because tests/moat/cases.txt is a hot file. The Captain registers the suite. Line numbers drift, so find the sites by grep. |
+| S-142 | S-48 follow-up: convergence-floor NEGATIVE-B passes even without the `runner!='none'` guard (source 1) | tests/test-council-convergence-floor.sh | LOW | red: removing the runner guard from the fast-path check (a scratch-copy mutation) leaves every case green. green: a new NEGATIVE-C writes the legacy shape `runner:"none", pass:true`, returns 1, and turns red under that mutation | ready@2026-09-27T18:05Z | Test-only. Confirm the guard still exists before writing; if it was removed on purpose, report that instead. |
+| S-143 | BACKLOG 117 remainder / S-51 follow-ups: Gemini, Railway, stale gate counts and "Q2 2026 Current" copy (source 2) | web-app/src/components/Roadmap.tsx, DocsSidebar.tsx, ContextualHelp.tsx, ProductTour.tsx, CostEstimator.tsx, web-app/src/pages/SystemSettingsPage.tsx | LOW | red: `grep -il -E 'gemini\|railway\|9 (automated )?quality gates\|10 quality gates\|Q2 2026'` matches all 6 files. green: 0 matches in them; gate count is 8; deploy targets are Vercel, Netlify and GitHub Pages only | ready@2026-09-27T18:05Z | Copy only. If CostEstimator's Gemini entry is pricing logic, remove the option and note it. ProjectWorkspace.tsx is out of scope. The Captain rebuilds web-app/dist. |
+| S-144 | S-51 follow-up: Footer.tsx shows v9.55.0 against VERSION 9.66.0 and is not in the bump list (source 1) | scripts/release.sh, tests/test-release-sh.sh, web-app/src/components/Footer.tsx | LOW | red: Footer.tsx holds v9.55.0 while VERSION is 9.66.0, and a `--bump-only` fixture run leaves Footer unchanged. green: `--bump-only` rewrites the Footer version slot, and the test asserts it for that file by name | ready@2026-09-27T18:05Z | WhatsNew.tsx is deliberately excluded. Its modal opens when `lastSeen !== CURRENT_VERSION`, so bumping it automatically would pop the same stale modal for every user at every release (3-5 an hour). Keying it to its own content version is a separate question (see the end list). |
+| S-145 | BACKLOG 118: GET /api/checklist/waivers answers 200 `{waivers: []}` when waivers.json is corrupt, so a read error looks like "no waivers" (source 2) | dashboard/server.py (get_checklist_waivers only), tests/dashboard/test_checklist_waivers_read_error.py (new) | LOW | red: a corrupt waivers.json returns 200 with an empty list. green: it returns 500 with an error body, matching the POST sibling at ~10431; a missing file still returns 200 with an empty list | ready@2026-09-27T18:05Z | Survey the consumers first (dashboard-ui checklist viewer, standalone): each must show "Could not load" on 500, not an empty state. Note which consumers were checked in the wall. |
+| S-146 | BACKLOG 118: the dashboard shell has two elements with `id="budget-banner"` (source 2) | dashboard-ui/scripts/build-standalone.js | LOW | red: `grep -c 'id="budget-banner"'` returns 2. green: returns 1, and the banner script still finds and updates the remaining element (a node or DOM check in the builder's evidence) | ready@2026-09-27T18:05Z | While in the file, check the other two 118 items (the "Newest first" reversal at ~2510); fix only if trivial, otherwise report. The Captain rebuilds dashboard/static/index.html. |
+| S-147 | BACKLOG 118: `loki metrics --json` sends `tokens.total` 0 and `total_iterations` 0 when nothing was recorded, and invents `time_saved_hours = iterations*15/60` (source 2) | autonomy/loki (cmd_metrics only), tests/test-metrics-json-unmeasured.sh (new) | MEDIUM | red: on an empty .loki, `loki metrics --json` prints total 0, iterations 0 and a numeric time_saved_hours. green: null (unknown) for unrecorded values, time_saved_hours removed or null, real recorded values unchanged | ready@2026-09-27T18:05Z | cmd_metrics (~28481) is far from S-123's attestation region (~956); rebase if S-123 lands first. Survey consumers of the JSON (dashboard, docs) before changing 0 to null. The Captain registers the test. |
+| S-148 | BACKLOG 118: trust.html says "Stable: no significant change" when every axis lacks the 2+ runs of history needed (source 2) | dashboard/static/trust.html | LOW | red: an API fixture where every axis has `insufficient: true` renders the "Stable" headline. green: it renders "Not enough history yet"; a fixture with real flat axes still says "Stable" (pull the headline into a named function and check it with a small node assertion) | ready@2026-09-27T18:05Z | Hand-written page, not a generated bundle. The `delta: 0.0` on an insufficient axis in trust_trajectory.py is out of scope; note it for later. |
+| S-149 | BACKLOG 118: prompt_optimizer.get_current_version returns never-ran zeros (version 0, based_on_sessions 0), and a corrupt latest file is folded into the same default (source 2) | dashboard/prompt_optimizer.py, tests/dashboard/test_prompt_optimizer_sentinels.py (new) | LOW | red: a corrupt latest file and a missing one return the identical zero dict. green: missing returns an explicit never-ran marker (nulls); corrupt returns an error marker distinct from never-ran | ready@2026-09-27T18:05Z | Survey the endpoint and panel consumers first so the new fields render as unknown, not crash. |
+| S-150 | BACKLOG 118: migration_engine.get_progress reports 0/0 features and steps when the features or plan file is corrupt or missing (source 2) | dashboard/migration_engine.py (get_progress only), tests/dashboard/test_migration_progress_unknown.py (new) | LOW | red: a corrupt plan.json gives `steps_total 0, steps_completed 0`, identical to a real empty plan. green: corrupt or missing gives null counts plus a reason; a real empty plan still gives 0 | ready@2026-09-27T18:05Z | Survey consumers (loki-migration-dashboard.js, server endpoint) to make sure null renders as unknown. |
+| S-151 | BACKLOG 118: loki-analytics heatmap counts days before the returned activity window as 0 activities (source 2) | dashboard-ui/components/loki-analytics.js (_computeHeatmap and the cell render only) | LOW | red: a fixture with activity starting 10 days ago renders the previous ~355 days as "0 activities". green: days before the earliest returned entry (or the API's window start) render as "no data", while days inside the window with no activity stay 0 | ready@2026-09-27T18:05Z | The Captain rebuilds dashboard/static/index.html. Different file from S-146. |
+
+**Risks**
+- **Registration is on the Captain.** 8 rows add a new test file (S-132, S-134, S-138, S-141, S-145, S-147, S-149, S-150). Each needs the Captain to register it in `tests/run-all-tests.sh`, or it never runs in CI.
+- **Rebuilds are on the Captain.** S-143 needs web-app/dist rebuilt; S-146 and S-151 need dashboard/static rebuilt.
+- **Test anchors, not files, couple S-135, S-140 and S-141.** Trust-core probes anchor into completion-council.sh and probably into the run.sh failure-count awk. Merge S-140 and S-141 first, and each of them must run the trust-core suite in its wall. S-135's first step is confirming probes use a private copy.
+- **Two rows touch the release gate.** S-132 is the highest-risk slice: an all-skipped Tests run reads as success at the release SHA. It needs a HIGH review focused on the parent-green check and on eligibility never being looser than release.yml STEP 1. S-133 also touches release.yml, so under D22 it ships in its own train.
+- **Same-file neighbours.** S-140 (run.sh) and S-147 (autonomy/loki) share a file with in-flight S-100/S-124 and S-123, in regions far from theirs. Expect rebases, not conflicts.
+- **S-134's gain only shows on a real CI run.** The first Tests run after merge is the evidence; the Moat suite (195s) may become the new floor.
+- **Changing zeros to null or 200 to 500 changes response shapes.** S-145, S-147, S-149 and S-150 must name the consumers they checked, or a panel can crash where it used to show a false zero.
+
+**Held for a CEO decision or waiting on another slice (not in the 20)**
+- S-112 and S-117 to S-122 (P4 corpus and ablation producer): already held.
+- BACKLOG 4: breaking exit-code renumber for `loki verify` (v10.0.0).
+- BACKLOG 18: Caveman bootstrap and its global `~/.claude` hook default-on; changing the default is a product decision.
+- BACKLOG 121: browser-only settings (plain-text API keys in localStorage, unwired "Budget limit" and "Auto-deploy"): remove or wire is a product decision.
+- BACKLOG 77: whether Bun should write its own test-results freshness marker.
+- BACKLOG 123: `audit.py verify` reporting valid on nothing checked; the cross-chain verifier reads it, so it needs its own review.
+- WhatsNew.tsx version: stays stale until someone decides what should trigger the modal.
+- GUARDS 11 (scratchpad glob `rm`): a helper nobody is forced to call blocks nothing. The real rule belongs in `scripts/v10-guard.sh`, so cut it after S-99 lands.
+- Waiting on a slice in this set: BACKLOG 127 remainder (`run.sh` auto_capture_episode, `cd "$PROJECT_DIR"` with no unset guard, ~21361) after S-140; BACKLOG 38 after S-141; BACKLOG 133 after S-139.
+
+I edited no files. The only temp file was a log saved under `$TMPDIR` and deleted in the same command. I started no background processes.

package/docs/v10/BOARD.md

@@ -104,49 +104,70 @@ set is declared to avoid overlap with those and with each other.
 | S-85 | CEO Part C item 8: Docker arm64 on a native ubuntu-24.04-arm runner instead of QEMU (release.yml:665-687); no gha cache in publish jobs (:54-56) | release.yml publish-docker job and cache config | MEDIUM | multi-arch image still published for amd64 and arm64; publish jobs restore no cache | released@2026-09-27T16:40Z | release.yml: own train (D22). Different region from S-84 and S-83. Built and committed d8f98328 (native amd64/arm64 by digest plus manifest merge job, qemu removed, cache-binary false; provenance 11/11, SBOM 9/9, P9 4/4). 2 reviewers dispatched 14:29. Own train (D22). 2/2 APPROVE. Manifest-digest technique checked against a real multi-arch index (alpine:latest): sha256 of imagetools --raw equals the registry index digest. Missing arch fails closed (needs + count guard). Non-blocking: stale comment in publish-npm names publish-docker for the dist assert (now in publish-docker-build). Only a real release proves the arm64 runner and timing. Train 3: 3a372c8e, release commit c2eccb21 (v9.58.0) pushed 15:53:26Z, ls-remote verified; released when publish-npm succeeds. Released in v9.59.0 (Release run 36332036567 publish-npm success; v9.58.0 itself never published, superseded). |
 | S-86 | CEO Part C item 9: pytest -n auto (test.yml:73), all 4 Python versions still required; fix any order-dependent tests it exposes | test.yml python job, the tests it exposes | MEDIUM | python job wall time drops; 4 versions still required; no test skipped to get green | released@2026-09-27T16:40Z |  Built 0b82b63e: python suite 261.9s serial -> 79-82s with -n auto (14 cores, 3 runs, identical counts 3469/22); one racy test given a private TMPDIR, assertion unchanged. 2 reviewers dispatched 14:37 (asked to verify at -n 4, the CI core count). 2/2 APPROVE: assertion mutation-tested (still red when the tool leaks a scratch dir); no other shared-tempdir hazards; -n 4 x3 deterministic (109-121s on 14 cores). Follow-ups: local-ci/pre-push still serial; pytest-xdist unpinned (matches file convention). Train 2: 6c35aac0. In train 2 release commit 5332bfc3 (v9.57.0), pushed 15:50:12Z (ls-remote verified); becomes released when publish-npm succeeds (D27). Correction 15:54: I had marked this released too early. Released in v9.57.0 (Release run 36331009098 publish-npm success). |
 | S-87 | CEO Part C item 10a: remove built-in waits (review-tail stub blocks on a FIFO and drop the 4x scale at :388-390; mock vectors setup in test-e2e-features.sh:344; go-gate stub sleep 60 to 2s; test-dashboard-multiproject.sh:160 poll instead of sleep 25; pytest-gate fixture sleep 10 to 1) | the named test files only | MEDIUM | each named suite is faster, measured before and after; none weakened (mutation check per change) | released@2026-09-27T16:40Z | OVER BUDGET 14:56 (33.5 min vs 30): told to stop and commit; the rest gets re-sliced. Committed 7935ed68 (worktree-agent-a6e52768add598d70) at 38 min, over budget: 4 of 5 waits cut (go-cargo 24.9s to 12.9s, pytest-gate 13.3s to 2.0s, multiproject 27.3s to 16.9s, e2e 26.6s to 22.2s; each mutation-checked). Remainder re-sliced as S-95. MEDIUM review (with a load-flake check) dispatched 15:05. 1/1 APPROVE: 4 mutations red; 12 runs under 4-way CPU load, 0 flakes. Cherry-picked 11c9df0c. In train 2 release commit 5332bfc3 (v9.57.0), pushed 15:50:12Z (ls-remote verified); becomes released when publish-npm succeeds (D27). Correction 15:54: I had marked this released too early. Released in v9.57.0 (Release run 36331009098 publish-npm success). |
-| S-88 | CEO Part C item 10b: parallelize moat P6, P9 and P5 internally | tests/moat/p6-*.sh, p9-rule-of-two.sh, p5-*.sh | MEDIUM | moat suite wall time drops; same cases, same verdicts | building@2026-09-27T17:14Z | SEQUENCING: p9-rule-of-two.sh is in S-18's file set; start only after S-18 merges. Batch 1 (build then review), dispatched 17:06. |
+| S-88 | CEO Part C item 10b: parallelize moat P6, P9 and P5 internally | tests/moat/p6-*.sh, p9-rule-of-two.sh, p5-*.sh | MEDIUM | moat suite wall time drops; same cases, same verdicts | released@2026-09-27T18:12Z | SEQUENCING: p9-rule-of-two.sh is in S-18's file set; start only after S-18 merges. Batch 1 (build then review), dispatched 17:06. Train 5, pushed 51ae52fe at 17:52:16Z (ls-remote verified); approved by review. S-88: P9 4/4 in 43s (was about 90s). S-130: web-app dist rebuilt. S-111: pytest -n auto back on after S-102. Released in v9.66.0 (release commit 0a69d19b, pushed 18:03:32Z). |
 | S-89 | CEO Part C item 11: pip and bun install caches on read-only test jobs | test.yml cache steps only | LOW | cache hits on a second run; never on a job holding a write token or publish secret (P9) | released@2026-09-27T16:40Z | Dispatched 15:00 (workflow wf_29a75a9c-652, slice-card brief). Built e85a23d4. Reviewer dispatched 15:16. CONCERN: the fixed -A5 permissions window misses a late contents: write. Rework sent 15:28 (parse the YAML). Rework ab32c540: YAML-parsed permissions, 15/15. Re-review dispatched 15:40. 1/1 APPROVE. Train 4. Cherry-picked onto main for train 4 (2 commits); D27 checks green except tests/test-select-tests.sh, which hit the 60s cap (rc=124; CI runs it in full; reviewer ran 38/38). Train 4 release commit 08d64f4e (v9.59.0) pushed 16:07:02Z, ls-remote verified. Released in v9.59.0 (Release run 36332036567 publish-npm success; v9.58.0 itself never published, superseded). |
 | S-90 | CEO Part C item 12: move bun=latest, macOS bun and hyperfine to nightly (test.yml:303-312, 390-400) | test.yml those jobs, a nightly workflow | LOW | those jobs no longer run on push; they run on a nightly schedule | released@2026-09-27T16:40Z |  Built 93482497 (bun matrix 4->1 on push; nightly.yml runs the other 3 plus hyperfine). Reviewer dispatched 14:24. 1/1 APPROVE. Non-blocking: release gate now requires only the pinned bun combo (intended); hyperfine no longer runs for the pinned combo anywhere; macOS-only branches in a few test files now run nightly only. Train 2: 329882d7. In train 2 release commit 5332bfc3 (v9.57.0), pushed 15:50:12Z (ls-remote verified); becomes released when publish-npm succeeds (D27). Correction 15:54: I had marked this released too early. Released in v9.57.0 (Release run 36331009098 publish-npm success). |
 | S-91 | CEO Part C item 13: Tier A diff-selected tests with selection rules R0-R7; anything touching tests/lib, run-all-tests.sh, package.json, requirements*, loki-ts/dist, VERSION or .github/workflows runs everything | a selection script, a Tier A workflow or job | MEDIUM | Tier A finishes in 2 min or less on a typical change; the run-everything triggers are honored; Tier A never replaces Tier B | released@2026-09-27T16:40Z | OVER BUDGET 14:56 (33.5 min vs 30): told to stop and commit; the rest gets re-sliced. Committed cb8ddb07 at 39 min (over budget): R0-R7 done, 29/29, P9 4/4 on tier-a.yml, real-commit runs 25s/86s/5s. Remainder re-sliced as S-96. Tech Lead review dispatched 15:08. REJECT: the .py-suffixed grep misses Python imports (workspace_diff.py, fast_verify.py moat miss); R5 targets tests/dashboard only; no dashboard-ui rule. Round 2 sent 15:23. Round 2 52a58e86: import needles, dashboard-ui rule, node match kind; 38/38. Re-review dispatched 15:46. Round 2: 1/1 APPROVE (all 4 misses reproduced as fixed, 38/38, shellcheck clean). Advisory: generic stems (base.py) over-select (bloat, not a miss). Train 4. Cherry-picked onto main for train 4 (3ee19595+10090cd3); D27 checks green except tests/test-select-tests.sh, which hit the 60s cap (rc=124; CI runs it in full; reviewer ran 38/38). Train 4 release commit 08d64f4e (v9.59.0) pushed 16:07:02Z, ls-remote verified. Released in v9.59.0 (Release run 36332036567 publish-npm success; v9.58.0 itself never published, superseded). |
 | S-92 | CEO Part C item 14: tests/quarantine.txt (suite, owner, expiry max 7 days, issue); quarantined suites still run but do not block; moat and review suites can never be quarantined; no retry loops | tests/quarantine.txt, tests/run-all-tests.sh (quarantine handling) | LOW | a listed suite's failure is reported but non-blocking; an expired or moat entry is rejected | merged@2026-09-27T16:35Z | SEQUENCING: after S-79 and S-81 merge (same runner file). Dispatched 15:49 on top of S-79+S-81. Train 7 (release 9218ea04, v9.62.0, pushed 16:29:17Z, ls-remote and tag ^{} verified), unreviewed (founder "release everything"). The v9.62.0 Release run was cancelled at 16:30 (the tree carries the S-18 P9 regression). |
 | S-93 | CEO Part C item 15: the 38 unregistered test files: register each or delete it with a reason | tests/run-all-tests.sh registrations, the files | LOW | zero unregistered test files; each deletion has a stated reason | merged@2026-09-27T16:35Z | SEQUENCING: after S-79 and S-81 merge (same runner file). Dispatched 15:49 on top of S-79+S-81. Train 7 (release 9218ea04, v9.62.0, pushed 16:29:17Z, ls-remote and tag ^{} verified), unreviewed (founder "release everything"). The v9.62.0 Release run was cancelled at 16:30 (the tree carries the S-18 P9 regression). |
-| S-94 | Worktree follow-up: triage the 27 worktrees whose branches hold commits not on main (merge, record in BOARD, or discard with a reason), check the 3 with an uncommitted edit to tests/moat/p7-no-fabricated-data.sh, and add a pulse violation for more than 15 worktrees | scripts/v10-pulse.sh, tests/test-v10-pulse.sh (violation only); triage is a Captain decision per branch | LOW | worktree count at or below 10 with no unmerged work lost; the new violation fires above 15 with a fixture | building@2026-09-27T17:14Z | SEQUENCING: the pulse change waits for S-75 (same file). Triage list: scratchpad/s72-classification.tsv. Dispatched 15:00 (workflow wf_29a75a9c-652, slice-card brief). Built ad60e018 (WORKTREE_COUNT violation). Reviewer dispatched 15:16; worktree triage still pending (orchestrator). CONCERN: git merge-tree with S-76 (30ed0f19) conflicts in both files (adjacent inserts). Rebase onto S-76 after its rework lands. Back to ready: ad60e018 must be rebuilt on main after S-109 lands (both edit v10-pulse.sh); fold WORKTREE_COUNT in then. Batch 1 (build then review), dispatched 17:06. |
+| S-94 | Worktree follow-up: triage the 27 worktrees whose branches hold commits not on main (merge, record in BOARD, or discard with a reason), check the 3 with an uncommitted edit to tests/moat/p7-no-fabricated-data.sh, and add a pulse violation for more than 15 worktrees | scripts/v10-pulse.sh, tests/test-v10-pulse.sh (violation only); triage is a Captain decision per branch | LOW | worktree count at or below 10 with no unmerged work lost; the new violation fires above 15 with a fixture | released@2026-09-27T17:53Z | SEQUENCING: the pulse change waits for S-75 (same file). Triage list: scratchpad/s72-classification.tsv. Dispatched 15:00 (workflow wf_29a75a9c-652, slice-card brief). Built ad60e018 (WORKTREE_COUNT violation). Reviewer dispatched 15:16; worktree triage still pending (orchestrator). CONCERN: git merge-tree with S-76 (30ed0f19) conflicts in both files (adjacent inserts). Rebase onto S-76 after its rework lands. Back to ready: ad60e018 must be rebuilt on main after S-109 lands (both edit v10-pulse.sh); fold WORKTREE_COUNT in then. Batch 1 (build then review), dispatched 17:06. In v9.65.0 (release commit 0103adfa, pushed 17:45:33Z; required-ci success). |
 | S-95 | S-87 remainder (CEO Part C item 10): tests/test-review-assurance-tail.sh, which did not finish in 120s on its own (rc=124). Replace the DA-block poll with a FIFO wake, check for orphaned sleep 30/120 children, and drop the 4x LOKI_TEST_SHARD scale only if it is proven safe under 4-way contention | tests/test-review-assurance-tail.sh only | MEDIUM | the suite finishes under 60s alone and under 4-way load 3 times in a row; mutating the code under test still turns it red | merged@2026-09-27T16:35Z | Known load-flaky (memory: review-assurance-tail). Measure before optimizing. Dispatched 15:49. Train 7 (release 9218ea04, v9.62.0, pushed 16:29:17Z, ls-remote and tag ^{} verified), unreviewed (founder "release everything"). The v9.62.0 Release run was cancelled at 16:30 (the tree carries the S-18 P9 regression). |
-| S-96 | S-91 remainder: re-collect the last-10-main-code-commits Tier A selection report (time and selected tests per commit), add bun/pip/npm install caches to tier-a.yml, and set an explicit timeout-minutes on its R0 full-suite path | .github/workflows/tier-a.yml, docs/v10/METRICS.md | LOW | the METRICS.md table shows 10 real commits each under 120s or labeled R0; caches never on a job with write permissions or secrets (P9) | building@2026-09-27T17:14Z | After S-91 merges. Batch 1 (build then review), dispatched 17:06. |
+| S-96 | S-91 remainder: re-collect the last-10-main-code-commits Tier A selection report (time and selected tests per commit), add bun/pip/npm install caches to tier-a.yml, and set an explicit timeout-minutes on its R0 full-suite path | .github/workflows/tier-a.yml, docs/v10/METRICS.md | LOW | the METRICS.md table shows 10 real commits each under 120s or labeled R0; caches never on a job with write permissions or secrets (P9) | merged@2026-09-27T18:12Z | After S-91 merges. Batch 1 (build then review), dispatched 17:06. Review CONCERN/REJECT; rework plus re-review dispatched 17:49 (workflow wf_b1414df6-a66) with the reviewer findings. Rework re-review APPROVE (workflow wf_b1414df6-a66); train 6 pushed 0bd45144 at 18:10:14Z (ls-remote verified). |
 | S-97 | D27 item 2: .githooks/pre-push becomes identity check + bash -n + red-main warning only; remove the pytest run; target under 5s; update docs/dev/release-checklist.md to retire the local-CI mandate | .githooks/pre-push, its test, docs/dev/release-checklist.md | LOW | the hook finishes under 5s on this repo (timed 3x); a wrong identity and a bash -n error still block; no pytest invocation remains | merged@2026-09-27T16:27Z | Train 3. Built b72e9ab7: hook runs in 0.78-0.89s (3 runs), 7/7, 4 mutations red. Review dispatched 16:07. Train 5 (1cde81a7), unreviewed (founder instruction). Live: the tag push at 16:25 ran only the identity and bash -n checks. |
 | S-98 | D27 items 3 and 6: TRAIN_LATE pulse violation (more than 25 min since the last train push while merged-unreleased commits exist) and a push helper in scripts/v10-ops.sh that pushes without a pipe and succeeds only when git ls-remote equals HEAD | scripts/v10-pulse.sh, scripts/v10-ops.sh, their tests | LOW | fixtures: TRAIN_LATE fires at 26 min with an unreleased merge and not at 24 min or with none; the push helper returns non-zero when the remote does not match | merged@2026-09-27T16:27Z | Train 3. Last train push time comes from git reflog or the push log, not the release tag. Built b44571ba: pulse 61/61, ops 60/60, mutations red. Review dispatched 16:07. Train 5 (1cde81a7), unreviewed (founder instruction). |
-| S-99 | S-73 follow-ups (non-blocking review findings): carry quote state across lines in strip_heredocs; exact terminator whitespace; a quoted ">" must not hide an rm target; sed -i, cp, tee, perl -pi or python open() writes to BOARD.md chained before a commit set the pending flag | scripts/v10-guard.sh, tests/test-v10-guard.sh | MEDIUM | each reviewer repro becomes a blocked fixture; no everyday command becomes blocked | building@2026-09-27T17:14Z | Repros in the S-73 round 3 and 4 reviews. Batch 1 (build then review), dispatched 17:06. |
-| S-100 | S-18 follow-up (reviewer A F1): record the origin URL before the first agent iteration and refuse the trusted push if it changed; also refuse the repo default branch, not just main and master | autonomy/run.sh (trusted push only), a test | HIGH | an agent that repoints origin to another github.com repo gets a refused push with a visible warning | building@2026-09-27T17:14Z | After S-18 merges. Batch 1 (build then review), dispatched 17:06. |
+| S-99 | S-73 follow-ups (non-blocking review findings): carry quote state across lines in strip_heredocs; exact terminator whitespace; a quoted ">" must not hide an rm target; sed -i, cp, tee, perl -pi or python open() writes to BOARD.md chained before a commit set the pending flag | scripts/v10-guard.sh, tests/test-v10-guard.sh | MEDIUM | each reviewer repro becomes a blocked fixture; no everyday command becomes blocked | merged@2026-09-27T18:12Z | Repros in the S-73 round 3 and 4 reviews. Batch 1 (build then review), dispatched 17:06. Review CONCERN/REJECT; rework plus re-review dispatched 17:49 (workflow wf_b1414df6-a66) with the reviewer findings. Rework re-review APPROVE (workflow wf_b1414df6-a66); train 6 pushed 0bd45144 at 18:10:14Z (ls-remote verified). |
+| S-100 | S-18 follow-up (reviewer A F1): record the origin URL before the first agent iteration and refuse the trusted push if it changed; also refuse the repo default branch, not just main and master | autonomy/run.sh (trusted push only), a test | HIGH | an agent that repoints origin to another github.com repo gets a refused push with a visible warning | merged@2026-09-27T18:12Z | After S-18 merges. Batch 1 (build then review), dispatched 17:06. Review CONCERN/REJECT; rework plus re-review dispatched 17:49 (workflow wf_b1414df6-a66) with the reviewer findings. Rework re-review APPROVE (workflow wf_b1414df6-a66); train 6 pushed 0bd45144 at 18:10:14Z (ls-remote verified). |
 | S-101 | D27 follow-up: scripts/release.sh --bump-only (no prompt, no commit, no push) that bumps every checklist file and rebuilds loki-ts/dist, so the Release Manager no longer edits VERSION with the editor tool | scripts/release.sh, tests/test-release-sh.sh | LOW | --bump-only bumps all 13 files and the dist version and exits without git side effects (asserted via git status and git log in a temp repo) | parked@2026-09-27T16:35Z | Ends the D27 VERSION exception. Superseded by S-108. |
 | S-102 | P0 fix-forward: tests/dashboard/test_build_supervisor.py fails intermittently under pytest -n auto (S-86) with "provider attempt lineage marker is unavailable" (rc 127), raised at autonomy/lib/deadline.py:415. Hit Python 3.11+3.12 on 89e350bd and 3.10+3.11 on c2eccb21 (train 3 Tests run 36331204715, so required-ci failed); identical code passed on 5332bfc3 | autonomy/lib/deadline.py and/or tests/dashboard/test_build_supervisor.py | HIGH | reproduced in Linux docker with -n 4 before the fix; 0 failures over at least 3x the runs after; no assertion loosened, no retry | merged@2026-09-27T16:57Z | Dispatched 16:06 (opus). Train 3 failed jobs rerun at 16:05:48Z. Still running; its container s102-repro-a167 was capped at 16:30 (--cpus 2, 4g, restart=no). pytest -n auto reverted on main (b01bd36c) meanwhile. Real product race: spawn_tracked read /proc/<pid>/environ before exec finished (empty environ on a live child: 4/2000 idle, 22/2000 loaded). Fix 157dc713 (a ready byte after exec, 30s cap, fail closed). Linux, -n 4, 2x load: 20/20 runs failed before, 0/30 after; direct launches 54/1000 failed before, 0/3000 after. Cherry-picked onto main 16:57. Item 9 (-n auto) can return. |
 | S-103 | Founder directive: tests and agent runs are headless; no code path opens a browser to the dashboard when LOKI_NO_BROWSER=1, CI, a test marker or a non-TTY holds; every test runner exports LOKI_NO_BROWSER=1 | autonomy/run.sh, autonomy/loki (open sites), loki-ts/src if any, tests/run-all-tests.sh, a guard test | MEDIUM | a stub open on PATH records zero calls under every runner; a grep test proves every open site uses the guard | merged@2026-09-27T16:35Z | Dispatched 16:23 after dozens of stray "Loki Mode" Chrome tabs. a9792295 cherry-picked as 03d5b515 plus a dist rebuild (11c302bf), pushed 16:34:08Z (ls-remote verified). Cause of the tabs: loki migrate opened its dashboard on port 57376 with a bare open. One guard, loki_browser_allowed/loki_open_url; LOKI_NO_BROWSER=1 in every runner; tests/test-browser-open-guard.sh 15/15. |
-| S-104 | Founder report: the UserPromptSubmit pulse hook timed out at 15s and the ponytail hook at 5s under load. Make scripts/v10-pulse.sh finish under 5s with a cached, background-refreshed network layer and hard 3s timeouts; report the ponytail fix | scripts/v10-pulse.sh, scripts/v10-drift-audit-counter.sh, tests | MEDIUM | pulse under 5s under load (timed); a cached run makes no network call; stale values are labeled stale | merged@2026-09-27T17:05Z | Stopgap: local hook timeout raised 15 to 45s at 16:24 (settings.local.json, not committed). 5d60a2a8: pulse 2.18s to 0.20s from cache, 64/64. Conflicts with S-76 (T30) on main; S-109 builds on it and resolves. Hook timeout stopgap is 45s locally; the agent recommends 10s after it lands. Ponytail hook: the plugin hooks.json already says 20s (edited today 12:20); sessions started earlier still use 5s; an override outside the plugin cache would survive updates. Being rebased onto main together with S-109 (dispatched 16:48). Cherry-picked (b0f22616) and pushed in cc105687 at 17:05:47Z (ls-remote verified); tests/test-v10-pulse.sh 78/78 on main. |
-| S-105 | Release job cannot push its tag when the release changes workflow files: "refusing to allow a GitHub App to create or update workflow .github/workflows/release.yml without workflows permission"; it logs "continuing", then gh release create fails ("tag v9.57.0 exists locally but has not been pushed"). Make the tag step fail loudly and document that the Release Manager pre-pushes the tag, or use a token with workflows permission | .github/workflows/release.yml (tag step) | HIGH | a rejected tag push fails that step with a clear message; a pre-pushed tag is detected and reused | building@2026-09-27T17:14Z | Worked around at 16:25: v9.57.0..v9.61.0 pushed by the Release Manager (ls-remote verified), train 2 Release fully rerun. Evidence: Release run 36331009098 release-job log line 5126 "! [remote rejected] v9.57.0 ... without workflows permission" and line 5171 "tag v9.57.0 exists locally but has not been pushed". Batch 1 (build then review), dispatched 17:06. |
-| S-106 | tests/test-runtime-gate-port-scoping.sh positive control races its own background listener ("lsof cannot enumerate the own-tree decoy listener"); failed shard 0 in train 1 and train 4. Wait for the port to be LISTENing before the positive control | tests/test-runtime-gate-port-scoping.sh | LOW | 20/20 green in Linux docker under 4-way load; the positive control still fails when the listener never starts | building@2026-09-27T17:14Z | Test race, not product code. Suite quarantined until 2026-10-03 (ea8ecf1c); the fix is still needed before expiry. Evidence: Tests run 36332036570, shard 0/8 job 108655699267: "FAIL: positive control failed: lsof cannot enumerate the own-tree decoy listener", "RESULT: 9 passed, 1 failed". Batch 1 (build then review), dispatched 17:06. |
+| S-104 | Founder report: the UserPromptSubmit pulse hook timed out at 15s and the ponytail hook at 5s under load. Make scripts/v10-pulse.sh finish under 5s with a cached, background-refreshed network layer and hard 3s timeouts; report the ponytail fix | scripts/v10-pulse.sh, scripts/v10-drift-audit-counter.sh, tests | MEDIUM | pulse under 5s under load (timed); a cached run makes no network call; stale values are labeled stale | released@2026-09-27T17:53Z | Stopgap: local hook timeout raised 15 to 45s at 16:24 (settings.local.json, not committed). 5d60a2a8: pulse 2.18s to 0.20s from cache, 64/64. Conflicts with S-76 (T30) on main; S-109 builds on it and resolves. Hook timeout stopgap is 45s locally; the agent recommends 10s after it lands. Ponytail hook: the plugin hooks.json already says 20s (edited today 12:20); sessions started earlier still use 5s; an override outside the plugin cache would survive updates. Being rebased onto main together with S-109 (dispatched 16:48). Cherry-picked (b0f22616) and pushed in cc105687 at 17:05:47Z (ls-remote verified); tests/test-v10-pulse.sh 78/78 on main. In v9.64.0 (Release run 36337270762: publish-npm success). |
+| S-105 | Release job cannot push its tag when the release changes workflow files: "refusing to allow a GitHub App to create or update workflow .github/workflows/release.yml without workflows permission"; it logs "continuing", then gh release create fails ("tag v9.57.0 exists locally but has not been pushed"). Make the tag step fail loudly and document that the Release Manager pre-pushes the tag, or use a token with workflows permission | .github/workflows/release.yml (tag step) | HIGH | a rejected tag push fails that step with a clear message; a pre-pushed tag is detected and reused | released@2026-09-27T17:53Z | Worked around at 16:25: v9.57.0..v9.61.0 pushed by the Release Manager (ls-remote verified), train 2 Release fully rerun. Evidence: Release run 36331009098 release-job log line 5126 "! [remote rejected] v9.57.0 ... without workflows permission" and line 5171 "tag v9.57.0 exists locally but has not been pushed". Batch 1 (build then review), dispatched 17:06. In v9.65.0 (release commit 0103adfa, pushed 17:45:33Z; required-ci success). |
+| S-106 | tests/test-runtime-gate-port-scoping.sh positive control races its own background listener ("lsof cannot enumerate the own-tree decoy listener"); failed shard 0 in train 1 and train 4. Wait for the port to be LISTENing before the positive control | tests/test-runtime-gate-port-scoping.sh | LOW | 20/20 green in Linux docker under 4-way load; the positive control still fails when the listener never starts | released@2026-09-27T17:53Z | Test race, not product code. Suite quarantined until 2026-10-03 (ea8ecf1c); the fix is still needed before expiry. Evidence: Tests run 36332036570, shard 0/8 job 108655699267: "FAIL: positive control failed: lsof cannot enumerate the own-tree decoy listener", "RESULT: 9 passed, 1 failed". Batch 1 (build then review), dispatched 17:06. In v9.65.0 (release commit 0103adfa, pushed 17:45:33Z; required-ci success). |
 | S-107 | P0 moat regression from S-18 (train 5): P9.injection-cannot-reach-token fails on Linux CI only in the opt-out positive control ("the hosts.yml probe is blind under the opt-out"); fails closed but blocks every tree from 1cde81a7 | autonomy/run.sh and/or loki-ts/src/runner/github_token.ts (opt-out path) | HIGH | red then green in a capped Linux container; P9 4/4 in Linux; nested and trusted-push suites still pass | merged@2026-09-27T16:43Z | Dispatched 16:31 (opus, docker --cpus=2 --memory=4g). Root cause in the test harness: the GitHub ubuntu runner sets XDG_CONFIG_HOME, so gh ignored the planted $HOME/.config/gh/hosts.yml; only the opt-out leg (no GH_CONFIG_DIR override) noticed. The default and hosts-only checks were false greens on CI. Fix 445efcba (cherry-picked as 298f027e, pushed 16:43:06Z, ls-remote verified) unsets XDG_CONFIG_HOME and GH_CONFIG_DIR per scenario. Linux container with XDG set: before 3/4, after 4/4 CASE PASS; a product mutation now turns default and hosts-only red. No assertion changed. |
 | S-108 | D28: scripts/release.sh --bump-only (no prompt, commit or push; bumps 13 files and rebuilds dist) plus a guard that refuses any bump unless Tests and Bun Parity are completed-success for HEAD SHA | scripts/release.sh, tests/test-release-sh.sh | MEDIUM | red, no-run and other-SHA cases refuse with exit 3 and no file changed; green bumps; --bump-only leaves no git side effects | merged@2026-09-27T16:48Z | Replaces S-101 and ends the D27 VERSION exception. f5f5f6cf cherry-picked as a537bb22: RELEASE_ON_RED gate (Tests and Bun Parity completed-success for HEAD SHA, else exit 3) and --bump-only; tests/test-release-sh.sh 28/28 on main. |
-| S-109 | D28: pulse violations HIGH_LOAD (load > 28), ORPHAN_TEST (tests/* process with PPID 1 or etime > 30 min), STRAY_CONTAINER (swarm container older than 1h or with a restart policy), RELEASE_ON_RED (newest VERSION bump whose Tests failed), built on S-104 | scripts/v10-pulse.sh, tests/test-v10-pulse.sh | MEDIUM | fire and no-fire fixture per violation; pulse under 1s from cache | merged@2026-09-27T17:05Z | Must resolve the S-76 T30 test-number collision with S-104. First build stopped on the S-104/S-76 T30 collision (as instructed). Re-dispatched 16:48: rebase S-104, then S-109. Cherry-picked (0986ab39) and pushed in cc105687 at 17:05:47Z (ls-remote verified); tests/test-v10-pulse.sh 78/78 on main. |
-| S-110 | Fix the 3 suites S-93 newly registered that fail on CI (quarantined until 2026-10-03): test-add-dir-reaches-provider.sh (--add-dir never reaches the provider argv; possibly a real product defect), test-static-analysis-tsconfig.sh (tsc -p . fails on a path-aliased import on CI), test-doctor-json-skills.sh | the three suites and the code each exercises | MEDIUM | each passes on Linux CI (or is deleted with a stated reason) and its quarantine entry is removed | building@2026-09-27T17:14Z | Evidence: Tests run 36334599806, jobs 108662926880 and 108662926920. Batch 1 (build then review), dispatched 17:06. |
-| S-112 | P8 pending: ablation producer writing .loki/quality/ablation.json (load_bearing / not_load_bearing / not_applicable) | autonomy/lib/ablation.py, tests/test-ablation.sh | HIGH | Architect wall check (17:10 report) | ready@2026-09-27T17:14Z | RISKY: rewrites the user working tree in place; needs restore-on-signal. Not wired into run.sh (BACKLOG 34). Held. |
-| S-113 | P8 pending: proof-generator copies ablation.json into facts.ablation; never VERIFIED when not_load_bearing | autonomy/lib/proof-generator.py (collector and _compute_headline), tests/test-proof-ablation-headline.sh | HIGH | Architect wall check (17:10 report) | building@2026-09-27T17:14Z | Batch 2, dispatched 17:14. |
-| S-114 | P3 pending: check_author.py context (spec-only inputs) | autonomy/lib/check_author.py, tests/test-check-author-context.sh | HIGH | Architect wall check (17:10 report) | ready@2026-09-27T17:14Z | Held: present-but-unwired promotion risk (BACKLOG 34); needs a run.sh wiring slice. |
-| S-115 | P3 pending: checklist-verify.py --freeze (definition digest, hash mismatch on edit) | autonomy/checklist-verify.py, tests/test-checklist-freeze.sh | HIGH | Architect wall check (17:10 report) | ready@2026-09-27T17:14Z | Held: unwired (BACKLOG 34). |
-| S-116 | P2 pending: council must not approve inconclusive evidence on the vote alone | autonomy/completion-council.sh (evidence gate, evaluate), tests/test-council-inconclusive-no-approve.sh | HIGH | Architect wall check (17:10 report) | building@2026-09-27T17:14Z | Batch 2, dispatched 17:14. |
-| S-117 | P4 corpus 1/5: 20 logic-bug seeded defects | benchmarks/seeded-defects/cases/SD-0001..0020, fragments/logic-bug.json | MEDIUM | Architect wall check (17:10 report) | ready@2026-09-27T17:14Z | CEO decision: whether to spend 6 slices on the corpus (S-117..S-122). |
-| S-118 | P4 corpus 2/5: 20 spec-miss seeded defects | benchmarks/seeded-defects/cases/SD-0021..0040, fragments/spec-miss.json | MEDIUM | Architect wall check (17:10 report) | ready@2026-09-27T17:14Z | CEO decision (corpus). |
-| S-119 | P4 corpus 3/5: 20 test-fitting seeded defects | benchmarks/seeded-defects/cases/SD-0041..0060, fragments/test-fitting.json | MEDIUM | Architect wall check (17:10 report) | ready@2026-09-27T17:14Z | CEO decision (corpus). |
-| S-120 | P4 corpus 4/5: 20 mock-abuse seeded defects | benchmarks/seeded-defects/cases/SD-0061..0080, fragments/mock-abuse.json | MEDIUM | Architect wall check (17:10 report) | ready@2026-09-27T17:14Z | CEO decision (corpus). |
-| S-121 | P4 corpus 5/5: 20 security seeded defects (hermetic) | benchmarks/seeded-defects/cases/SD-0081..0100, fragments/security.json | MEDIUM | Architect wall check (17:10 report) | ready@2026-09-27T17:14Z | CEO decision (corpus). |
-| S-122 | P4 corpus assembler build_manifest.py (schema v2, duplicate/category/count checks) | benchmarks/seeded-defects/build_manifest.py, tests/test-seeded-defects-manifest.sh | LOW | Architect wall check (17:10 report) | ready@2026-09-27T17:14Z | CEO decision (corpus). |
-| S-123 | BACKLOG 20: JWKS must be https (loopback http only) | autonomy/loki (attestation check), tests/test-jwks-https-only.sh | MEDIUM | Architect wall check (17:10 report) | building@2026-09-27T17:14Z | Batch 2, dispatched 17:14. |
-| S-124 | BACKLOG 79: iteration 0 drops a stale static-analysis.pass | autonomy/run.sh (iteration-0 drop block), tests/test-iteration0-drops-static-analysis.sh | LOW | Architect wall check (17:10 report) | building@2026-09-27T17:14Z | Batch 2, dispatched 17:14. |
-| S-125 | BACKLOG 76/89: done-recognition tests_axis zero-test and failed_count honesty | autonomy/lib/done-recognition.sh (tests_axis), tests/test-done-recognition-tests-axis.sh | MEDIUM | Architect wall check (17:10 report) | building@2026-09-27T17:14Z | Batch 2, dispatched 17:14. |
-| S-126 | BACKLOG 94a: route walk vacuous on FastAPI >=0.141 in test_all_data_gets_scoped | tests/dashboard/test_all_data_gets_scoped.py | MEDIUM | Architect wall check (17:10 report) | building@2026-09-27T17:14Z | Batch 2, dispatched 17:14. |
-| S-127 | BACKLOG 94b: same vacuous walk in 3 dashboard tests | tests/dashboard/test_fleet_observability.py, test_fleet_retry.py, test_memory_read_scope_auth.py | MEDIUM | Architect wall check (17:10 report) | building@2026-09-27T17:14Z | Batch 2, dispatched 17:14. |
-| S-128 | BACKLOG 148: moat baseline detection blind to a symlinked pending.txt | tests/moat/run.sh (read_baselines, unreached_release), tests/test-moat-runner.sh | MEDIUM | Architect wall check (17:10 report) | building@2026-09-27T17:14Z | Batch 2, dispatched 17:14. |
-| S-129 | BACKLOG 93: hard-deadline zero-exit leader waits only 0.2s for the PID file | tests/test-hard-deadline-confinement.sh | LOW | Architect wall check (17:10 report) | building@2026-09-27T17:14Z | Batch 2, dispatched 17:14. |
-| S-130 | BACKLOG 117: SettingsPage lists deprecated Gemini and a hardcoded build date | web-app/src/pages/SettingsPage.tsx | LOW | Architect wall check (17:10 report) | building@2026-09-27T17:14Z | Batch 2, dispatched 17:14. |
-| S-131 | BACKLOG 106 (Bun): budget warns when capped and spend is unmeasured | loki-ts/src/runner/budget.ts, loki-ts/tests/runner/budget.test.ts | MEDIUM | Architect wall check (17:10 report) | building@2026-09-27T17:14Z | Batch 2, dispatched 17:14; CEO note: warn-never-pause default. |
+| S-109 | D28: pulse violations HIGH_LOAD (load > 28), ORPHAN_TEST (tests/* process with PPID 1 or etime > 30 min), STRAY_CONTAINER (swarm container older than 1h or with a restart policy), RELEASE_ON_RED (newest VERSION bump whose Tests failed), built on S-104 | scripts/v10-pulse.sh, tests/test-v10-pulse.sh | MEDIUM | fire and no-fire fixture per violation; pulse under 1s from cache | released@2026-09-27T17:53Z | Must resolve the S-76 T30 test-number collision with S-104. First build stopped on the S-104/S-76 T30 collision (as instructed). Re-dispatched 16:48: rebase S-104, then S-109. Cherry-picked (0986ab39) and pushed in cc105687 at 17:05:47Z (ls-remote verified); tests/test-v10-pulse.sh 78/78 on main. In v9.64.0 (Release run 36337270762: publish-npm success). |
+| S-110 | Fix the 3 suites S-93 newly registered that fail on CI (quarantined until 2026-10-03): test-add-dir-reaches-provider.sh (--add-dir never reaches the provider argv; possibly a real product defect), test-static-analysis-tsconfig.sh (tsc -p . fails on a path-aliased import on CI), test-doctor-json-skills.sh | the three suites and the code each exercises | MEDIUM | each passes on Linux CI (or is deleted with a stated reason) and its quarantine entry is removed | released@2026-09-27T18:12Z | Evidence: Tests run 36334599806, jobs 108662926880 and 108662926920. Batch 1 (build then review), dispatched 17:06. Train 4, pushed 08e4a7d4 at 17:48:38Z (ls-remote verified); approved by review (1/1; HIGH for S-116). P2.council-inconclusive-cannot-exit-zero removed from pending.txt (proven). Quarantine list now empty. Released in v9.66.0 (release commit 0a69d19b, pushed 18:03:32Z). |
+| S-111 | Part C item 9 returns: CI python suite runs pytest -n auto again after S-102 | .github/workflows/test.yml, requirements-test.txt | LOW | 10 of 10 capped-container runs of test_build_supervisor.py with -n 4 under load, 0 failures | released@2026-09-27T18:12Z | Train 5 (51ae52fe). Released in v9.66.0 (release commit 0a69d19b, pushed 18:03:32Z). |
+| S-112 | P8 pending: ablation producer writing .loki/quality/ablation.json (load_bearing / not_load_bearing / not_applicable) | autonomy/lib/ablation.py, tests/test-ablation.sh | HIGH | wall check in docs/v10/ARCHITECT-CUTS.md (17:10Z cut) | ready@2026-09-27T17:14Z | RISKY: rewrites the user working tree in place; needs restore-on-signal. Not wired into run.sh (BACKLOG 34). Held. |
+| S-113 | P8 pending: proof-generator copies ablation.json into facts.ablation; never VERIFIED when not_load_bearing | autonomy/lib/proof-generator.py (collector and _compute_headline), tests/test-proof-ablation-headline.sh | HIGH | wall check in docs/v10/ARCHITECT-CUTS.md (17:10Z cut) | released@2026-09-27T17:53Z | Batch 2, dispatched 17:14. In v9.65.0 (release commit 0103adfa, pushed 17:45:33Z; required-ci success). |
+| S-114 | P3 pending: check_author.py context (spec-only inputs) | autonomy/lib/check_author.py, tests/test-check-author-context.sh | HIGH | wall check in docs/v10/ARCHITECT-CUTS.md (17:10Z cut) | ready@2026-09-27T17:14Z | Held: present-but-unwired promotion risk (BACKLOG 34); needs a run.sh wiring slice. |
+| S-115 | P3 pending: checklist-verify.py --freeze (definition digest, hash mismatch on edit) | autonomy/checklist-verify.py, tests/test-checklist-freeze.sh | HIGH | wall check in docs/v10/ARCHITECT-CUTS.md (17:10Z cut) | ready@2026-09-27T17:14Z | Held: unwired (BACKLOG 34). |
+| S-116 | P2 pending: council must not approve inconclusive evidence on the vote alone | autonomy/completion-council.sh (evidence gate, evaluate), tests/test-council-inconclusive-no-approve.sh | HIGH | wall check in docs/v10/ARCHITECT-CUTS.md (17:10Z cut) | released@2026-09-27T18:12Z | Batch 2, dispatched 17:14. Train 4, pushed 08e4a7d4 at 17:48:38Z (ls-remote verified); approved by review (1/1; HIGH for S-116). P2.council-inconclusive-cannot-exit-zero removed from pending.txt (proven). Quarantine list now empty. Released in v9.66.0 (release commit 0a69d19b, pushed 18:03:32Z). |
+| S-117 | P4 corpus 1/5: 20 logic-bug seeded defects | benchmarks/seeded-defects/cases/SD-0001..0020, fragments/logic-bug.json | MEDIUM | wall check in docs/v10/ARCHITECT-CUTS.md (17:10Z cut) | ready@2026-09-27T17:14Z | CEO decision: whether to spend 6 slices on the corpus (S-117..S-122). |
+| S-118 | P4 corpus 2/5: 20 spec-miss seeded defects | benchmarks/seeded-defects/cases/SD-0021..0040, fragments/spec-miss.json | MEDIUM | wall check in docs/v10/ARCHITECT-CUTS.md (17:10Z cut) | ready@2026-09-27T17:14Z | CEO decision (corpus). |
+| S-119 | P4 corpus 3/5: 20 test-fitting seeded defects | benchmarks/seeded-defects/cases/SD-0041..0060, fragments/test-fitting.json | MEDIUM | wall check in docs/v10/ARCHITECT-CUTS.md (17:10Z cut) | ready@2026-09-27T17:14Z | CEO decision (corpus). |
+| S-120 | P4 corpus 4/5: 20 mock-abuse seeded defects | benchmarks/seeded-defects/cases/SD-0061..0080, fragments/mock-abuse.json | MEDIUM | wall check in docs/v10/ARCHITECT-CUTS.md (17:10Z cut) | ready@2026-09-27T17:14Z | CEO decision (corpus). |
+| S-121 | P4 corpus 5/5: 20 security seeded defects (hermetic) | benchmarks/seeded-defects/cases/SD-0081..0100, fragments/security.json | MEDIUM | wall check in docs/v10/ARCHITECT-CUTS.md (17:10Z cut) | ready@2026-09-27T17:14Z | CEO decision (corpus). |
+| S-122 | P4 corpus assembler build_manifest.py (schema v2, duplicate/category/count checks) | benchmarks/seeded-defects/build_manifest.py, tests/test-seeded-defects-manifest.sh | LOW | wall check in docs/v10/ARCHITECT-CUTS.md (17:10Z cut) | ready@2026-09-27T17:14Z | CEO decision (corpus). |
+| S-123 | BACKLOG 20: JWKS must be https (loopback http only) | autonomy/loki (attestation check), tests/test-jwks-https-only.sh | MEDIUM | wall check in docs/v10/ARCHITECT-CUTS.md (17:10Z cut) | merged@2026-09-27T18:12Z | Batch 2, dispatched 17:14. Review CONCERN/REJECT; rework plus re-review dispatched 17:49 (workflow wf_b1414df6-a66) with the reviewer findings. Rework re-review APPROVE (workflow wf_b1414df6-a66); train 6 pushed 0bd45144 at 18:10:14Z (ls-remote verified). |
+| S-124 | BACKLOG 79: iteration 0 drops a stale static-analysis.pass | autonomy/run.sh (iteration-0 drop block), tests/test-iteration0-drops-static-analysis.sh | LOW | wall check in docs/v10/ARCHITECT-CUTS.md (17:10Z cut) | merged@2026-09-27T18:12Z | Batch 2, dispatched 17:14. Review CONCERN/REJECT; rework plus re-review dispatched 17:49 (workflow wf_b1414df6-a66) with the reviewer findings. Rework re-review APPROVE (workflow wf_b1414df6-a66); train 6 pushed 0bd45144 at 18:10:14Z (ls-remote verified). |
+| S-125 | BACKLOG 76/89: done-recognition tests_axis zero-test and failed_count honesty | autonomy/lib/done-recognition.sh (tests_axis), tests/test-done-recognition-tests-axis.sh | MEDIUM | wall check in docs/v10/ARCHITECT-CUTS.md (17:10Z cut) | merged@2026-09-27T18:12Z | Batch 2, dispatched 17:14. Review CONCERN/REJECT; rework plus re-review dispatched 17:49 (workflow wf_b1414df6-a66) with the reviewer findings. Rework re-review APPROVE (workflow wf_b1414df6-a66); train 6 pushed 0bd45144 at 18:10:14Z (ls-remote verified). |
+| S-126 | BACKLOG 94a: route walk vacuous on FastAPI >=0.141 in test_all_data_gets_scoped | tests/dashboard/test_all_data_gets_scoped.py | MEDIUM | wall check in docs/v10/ARCHITECT-CUTS.md (17:10Z cut) | merged@2026-09-27T18:12Z | Batch 2, dispatched 17:14. Review CONCERN/REJECT; rework plus re-review dispatched 17:49 (workflow wf_b1414df6-a66) with the reviewer findings. Rework re-review APPROVE (workflow wf_b1414df6-a66); train 6 pushed 0bd45144 at 18:10:14Z (ls-remote verified). |
+| S-127 | BACKLOG 94b: same vacuous walk in 3 dashboard tests | tests/dashboard/test_fleet_observability.py, test_fleet_retry.py, test_memory_read_scope_auth.py | MEDIUM | wall check in docs/v10/ARCHITECT-CUTS.md (17:10Z cut) | released@2026-09-27T17:53Z | Batch 2, dispatched 17:14. In v9.65.0 (release commit 0103adfa, pushed 17:45:33Z; required-ci success). |
+| S-128 | BACKLOG 148: moat baseline detection blind to a symlinked pending.txt | tests/moat/run.sh (read_baselines, unreached_release), tests/test-moat-runner.sh | MEDIUM | wall check in docs/v10/ARCHITECT-CUTS.md (17:10Z cut) | released@2026-09-27T18:12Z | Batch 2, dispatched 17:14. Train 4, pushed 08e4a7d4 at 17:48:38Z (ls-remote verified); approved by review (1/1; HIGH for S-116). P2.council-inconclusive-cannot-exit-zero removed from pending.txt (proven). Quarantine list now empty. Released in v9.66.0 (release commit 0a69d19b, pushed 18:03:32Z). |
+| S-129 | BACKLOG 93: hard-deadline zero-exit leader waits only 0.2s for the PID file | tests/test-hard-deadline-confinement.sh | LOW | wall check in docs/v10/ARCHITECT-CUTS.md (17:10Z cut) | released@2026-09-27T18:12Z | Batch 2, dispatched 17:14. Train 4, pushed 08e4a7d4 at 17:48:38Z (ls-remote verified); approved by review (1/1; HIGH for S-116). P2.council-inconclusive-cannot-exit-zero removed from pending.txt (proven). Quarantine list now empty. Released in v9.66.0 (release commit 0a69d19b, pushed 18:03:32Z). |
+| S-130 | BACKLOG 117: SettingsPage lists deprecated Gemini and a hardcoded build date | web-app/src/pages/SettingsPage.tsx | LOW | wall check in docs/v10/ARCHITECT-CUTS.md (17:10Z cut) | released@2026-09-27T18:12Z | Batch 2, dispatched 17:14. Train 5, pushed 51ae52fe at 17:52:16Z (ls-remote verified); approved by review. S-88: P9 4/4 in 43s (was about 90s). S-130: web-app dist rebuilt. S-111: pytest -n auto back on after S-102. Released in v9.66.0 (release commit 0a69d19b, pushed 18:03:32Z). |
+| S-131 | BACKLOG 106 (Bun): budget warns when capped and spend is unmeasured | loki-ts/src/runner/budget.ts, loki-ts/tests/runner/budget.test.ts | MEDIUM | wall check in docs/v10/ARCHITECT-CUTS.md (17:10Z cut) | released@2026-09-27T17:53Z | Batch 2, dispatched 17:14; CEO note: warn-never-pause default. In v9.65.0 (release commit 0103adfa, pushed 17:45:33Z; required-ci success). |
+| S-132 | Velocity: skip heavy Tests jobs on a version-bump-only commit whose parent Tests run succeeded (eligibility no looser than release.yml STEP 1) | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | HIGH | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | building@2026-09-27T18:18Z | Batch 4 (build then review), dispatched 18:17. |
+| S-133 | Velocity: release.yml required-ci poll 30s to 10s; fix stale publish-npm comment | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | LOW | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | building@2026-09-27T18:18Z | Batch 4 (build then review), dispatched 18:17. |
+| S-134 | Velocity: rebuild shard-durations.tsv from a recent successful run; drift test | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | LOW | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | building@2026-09-27T18:18Z | Batch 4 (build then review), dispatched 18:17. |
+| S-135 | Velocity: parallelize trust-core probe mutations (130s) | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | MEDIUM | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | building@2026-09-27T18:18Z | Batch 4 (build then review), dispatched 18:17. |
+| S-136 | Velocity: tests/test-select-tests.sh under 30s, same 38 cases | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | MEDIUM | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | building@2026-09-27T18:18Z | Batch 4 (build then review), dispatched 18:17. |
+| S-137 | S-81 follow-up: shard-coverage T4 enumerates the real runner | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | LOW | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | building@2026-09-27T18:18Z | Batch 4 (build then review), dispatched 18:17. |
+| S-138 | GUARDS 12: lint so test fixtures never write the real ~/.gitconfig | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | LOW | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | building@2026-09-27T18:18Z | Batch 4 (build then review), dispatched 18:17. |
+| S-139 | GUARDS 13 + BACKLOG 136: RELEASED_AHEAD_OF_NPM; UNKNOWN on tag/npm disagreement | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | MEDIUM | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | building@2026-09-27T18:18Z | Batch 4 (build then review), dispatched 18:17. |
+| S-140 | BACKLOG 103: jest "Test Suites N failed" / vitest "Test Files N failed" count as failures | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | MEDIUM | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | building@2026-09-27T18:18Z | Batch 4 (build then review), dispatched 18:17. |
+| S-141 | S-49 follow-up: remaining council readers (~1425, ~1564, ~4232) use -I -S | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | HIGH | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | building@2026-09-27T18:18Z | Batch 4 (build then review), dispatched 18:17. |
+| S-142 | S-48 follow-up: convergence-floor NEGATIVE-C for the runner guard | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | LOW | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | building@2026-09-27T18:18Z | Batch 4 (build then review), dispatched 18:17. |
+| S-143 | BACKLOG 117: drop Gemini/Railway/stale gate counts from 6 web-app files | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | LOW | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | building@2026-09-27T18:18Z | Batch 4 (build then review), dispatched 18:17. |
+| S-144 | Footer.tsx version joins release.sh --bump-only | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | LOW | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | building@2026-09-27T18:18Z | Batch 4 (build then review), dispatched 18:17. |
+| S-145 | BACKLOG 118: GET /api/checklist/waivers returns 500 on a corrupt file | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | LOW | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | building@2026-09-27T18:18Z | Batch 4 (build then review), dispatched 18:17. |
+| S-146 | BACKLOG 118: one id="budget-banner" in the dashboard build | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | LOW | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | building@2026-09-27T18:18Z | Batch 4 (build then review), dispatched 18:17. |
+| S-147 | BACKLOG 118: loki metrics --json reports null for unmeasured, no invented time_saved | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | MEDIUM | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | building@2026-09-27T18:18Z | Batch 4 (build then review), dispatched 18:17. |
+| S-148 | BACKLOG 118: trust.html says "Not enough history yet" when every axis is insufficient | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | LOW | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | building@2026-09-27T18:18Z | Batch 4 (build then review), dispatched 18:17. |
+| S-149 | BACKLOG 118: prompt_optimizer never-ran vs corrupt markers | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | LOW | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | building@2026-09-27T18:18Z | Batch 4 (build then review), dispatched 18:17. |
+| S-150 | BACKLOG 118: migration progress null (not 0/0) on a corrupt/missing file | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | LOW | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | building@2026-09-27T18:18Z | Batch 4 (build then review), dispatched 18:17. |
+| S-151 | BACKLOG 118: analytics heatmap shows no-data before the activity window | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | LOW | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | building@2026-09-27T18:18Z | Batch 4 (build then review), dispatched 18:17. |
 | S-01 | BACKLOG 22: orphaned `sleep 300` resource monitor | autonomy/run.sh (resource-monitor spawn/cleanup only, not kill_provider_child), one new test | MEDIUM | red: `loki start` then interrupt leaves a `sleep 300` orphan (ps shows it after exit); green: it is reaped or never orphaned, by PID recorded at spawn | released@2026-09-27T01:33Z | 027ec085 confirmed ancestor of origin/main; note corrected, was stale. |
 | S-02 | BACKLOG 23: client-route test hardcodes main checkout path | tests/lib-extract-client-paths.mjs, tests/lib-match-client-routes.py, tests/test-verify-client-routes.sh | LOW | released@2026-09-27T15:00Z | 1/1 APPROVE: reviewer reproduced from 2 independent real worktrees, mutation-tested both new WORKTREE GUARD assertions independently, confirmed the disclosed BACKLOG 137 interaction (P7's own sed-workaround breaking) is expected, not a surprise. **Merged to main.** S-39/BACKLOG 137 now unblocked -- but note: this merge makes `tests/moat/run.sh` read a live FAIL on `P7.webapp-client-routes-exist` until S-39 lands (an unlisted-in-pending.txt regression per the ratchet), since P7's own copy-and-sed workaround can no longer find the literal it targets. S-39 should be prioritized promptly to close this gap, or a temporary pending.txt entry considered if S-39 doesn't land quickly. Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
 | S-03 | BACKLOG 25: `loki ci --report` "Argument list too long" on a large diff | autonomy/loki (cmd_ci report path only), one new test | MEDIUM | red: a synthetic diff over the ARG_MAX threshold, exit 126; green: same diff passed via stdin/file, exit 0 | rejected@2026-09-27T01:33Z | Real crash site (export-based ARG_MAX) misdiagnosed and left unfixed; sent back to builder. |
@@ -179,7 +200,7 @@ set is declared to avoid overlap with those and with each other.
 | S-27 | BACKLOG 125 B-1: P7 scanner reassignment-fallback bypass -- `let rows = data; if (!rows.length) rows = [rows]; setRows(rows);` -- `DECL_ARR` only matches the declaration form, never a later bare `x = [` assignment | tests/moat/p7-no-fabricated-data.sh (scanner rule + a new red/green case; never weaken an existing arm) | MEDIUM | released@2026-09-27T15:00Z | New `REASSIGN_ARR` regex + `DECL_KEYWORD` guard catches a fabricated array reassigned after declaration. Unanimous 2/2 APPROVE, both reviewers independently reproduced the bypass with their own fixtures. Non-blocking flag for whoever merges S-28 second: on a destructuring/parameter-default fixture that ALSO flows to a setter (untested by either slice today), whichever arm runs first wins the finding's MESSAGE (correct detection either way, just message-attribution -- "reassigned" vs "parameter default"). Recommend reordering DEFAULT_ARR ahead of REASSIGN_ARR when S-28 merges. 94137535. Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
 | S-28 | BACKLOG 125 B-2: P7 scanner destructuring/parameter-default bypass -- `const { rows = [rows] } = data;` or `function load(rows = [rows]) {}` -- neither is a `name = [` declaration the scanner recognizes | tests/moat/p7-no-fabricated-data.sh (scanner rule + a new red/green case; never weaken an existing arm) | MEDIUM | merged@2026-09-27T16:35Z | Correction: stale building@ with no live agent and no commit of its own (git log --all --grep found none). Re-cut to ready. Dispatched 15:49 (S-29 released). Train 7 (release 9218ea04, v9.62.0, pushed 16:29:17Z, ls-remote and tag ^{} verified), unreviewed (founder "release everything"). The v9.62.0 Release run was cancelled at 16:30 (the tree carries the S-18 P9 regression). |
 | S-29 | BACKLOG 125 B-5: P7 scanner module-level named fallback table -- `const FALLBACK_ROWS = [rows];` at column 0, referenced later via `data.length ? data : FALLBACK_ROWS` -- the column-0 exemption plus identifier-branch ternary both let it through unless the name matches sample/mock/demo/fake/placeholder | tests/moat/p7-no-fabricated-data.sh (scanner rule + a new red/green case; never weaken an existing arm) | MEDIUM | released@2026-09-27T15:00Z | Unanimous review across 6 rounds; round 6 (ab72ba3f) got a thorough final APPROVE that extended the discrimination check to 2 other call sites. Merge was non-trivial (S-29's chain predates S-27/S-32's own merges to this same file); a dedicated merge-pass agent reconciled all three lineages (5 conflict hunks, 2 mid-heredoc splices manually repaired), and a dedicated adversarial reviewer independently verified the reconciliation (read the full ~1364-line diff, confirmed heredoc balance, no duplicate definitions, all 3 lineages' fixtures intact, scanner and moat suite clean, built its own combined 3-lineage fixture confirming no shadowing). VOTE: APPROVE. Merged as 418b8f2f (a real 2-parent merge commit, content taken verbatim from the reviewed merge-pass commit cd0e5124 since main had not moved on this file since the merge-pass agent's own base -- confirmed via `git diff` before applying, avoiding a second unreviewed reconciliation attempt). Disclosed residual gap, not fixed here: an enclosing-paren confusion class (`(x || TABLE) && other` etc.), documented with a `ponytail:` comment for a future AST rewrite. Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| S-30 | BACKLOG 125 B-6: P7 scanner ternary-against-null bypass -- `const r = loading ? null : [rows];` -- `is_literal(null)` is true so the both-branches-literal exemption suppresses it; should only treat an array/object literal, never null/undefined/empty-string, as the "literal other branch" | tests/moat/p7-no-fabricated-data.sh (scanner rule + a new red/green case; never weaken an existing arm) | MEDIUM | building@2026-09-27T17:14Z | 1/1 CONCERN: fix only closes half the bypass class. `is_exempting_sibling()`'s `ABSENT` set (null/undefined/''/"") is correct but incomplete -- reviewer independently confirmed `false`/`0`/`{}`/`true` as the exempting sibling ALSO still produce zero findings, same fabrication shape, still invisible. Reviewer's suggested fix (confirmed to close all cases while preserving legitimate exemptions): require the exempting sibling itself be an array literal (`is_literal(v) and v.strip().startswith('[')`), not merely "not one of 4 named absence values." Also: line 920 (the `[rows] : X` ordering) ships with no fixture exercising `is_exempting_sibling` at all -- its own committed fixtures accidentally test the pre-existing identifier-branch path instead. Rework: switch to the array-literal-allowlist approach, add a `[rows] : null`-shaped fixture for line 920's own coverage. Sequences after S-29 per the shared-file note; S-29's own rework will need to route through whichever final helper S-30 ships (not the current is_exempting_sibling if it's replaced). Correction: stale building@ with no live agent and no commit of its own (git log --all --grep found none). Re-cut to ready. Batch 1 (build then review), dispatched 17:06. |
+| S-30 | BACKLOG 125 B-6: P7 scanner ternary-against-null bypass -- `const r = loading ? null : [rows];` -- `is_literal(null)` is true so the both-branches-literal exemption suppresses it; should only treat an array/object literal, never null/undefined/empty-string, as the "literal other branch" | tests/moat/p7-no-fabricated-data.sh (scanner rule + a new red/green case; never weaken an existing arm) | MEDIUM | merged@2026-09-27T18:12Z | 1/1 CONCERN: fix only closes half the bypass class. `is_exempting_sibling()`'s `ABSENT` set (null/undefined/''/"") is correct but incomplete -- reviewer independently confirmed `false`/`0`/`{}`/`true` as the exempting sibling ALSO still produce zero findings, same fabrication shape, still invisible. Reviewer's suggested fix (confirmed to close all cases while preserving legitimate exemptions): require the exempting sibling itself be an array literal (`is_literal(v) and v.strip().startswith('[')`), not merely "not one of 4 named absence values." Also: line 920 (the `[rows] : X` ordering) ships with no fixture exercising `is_exempting_sibling` at all -- its own committed fixtures accidentally test the pre-existing identifier-branch path instead. Rework: switch to the array-literal-allowlist approach, add a `[rows] : null`-shaped fixture for line 920's own coverage. Sequences after S-29 per the shared-file note; S-29's own rework will need to route through whichever final helper S-30 ships (not the current is_exempting_sibling if it's replaced). Correction: stale building@ with no live agent and no commit of its own (git log --all --grep found none). Re-cut to ready. Batch 1 (build then review), dispatched 17:06. Review CONCERN/REJECT; rework plus re-review dispatched 17:49 (workflow wf_b1414df6-a66) with the reviewer findings. Rework re-review APPROVE (workflow wf_b1414df6-a66); train 6 pushed 0bd45144 at 18:10:14Z (ls-remote verified). |
 | S-31 | BACKLOG 125 B-7: P7 scanner fabricated-return-from-helper bypass -- `function getRows(d) { if (!d) return [rows]; return d; } setRows(getRows(d))` -- no scanner arm follows a function's return value back to a fabricated literal | tests/moat/p7-no-fabricated-data.sh (scanner rule + a new red/green case; never weaken an existing arm) | MEDIUM | merged@2026-09-27T16:35Z | Unanimous 2/2 APPROVE (mechanism + corrected comment, independently verified across two review rounds). Merge-base (10e09a98) is behind S-29's still-in-flight, much larger rework chain on this SAME file -- holding merge until S-29 lands to avoid a bad conflict, per the established shared-file sequencing convention. Will need a rebase pass onto post-S-29 main before merge, not a blind cherry-pick. Rebase onto post-S-29 main dispatched 15:49. Train 7 (release 9218ea04, v9.62.0, pushed 16:29:17Z, ls-remote and tag ^{} verified), unreviewed (founder "release everything"). The v9.62.0 Release run was cancelled at 16:30 (the tree carries the S-18 P9 regression). |
 | S-32 | BACKLOG 125 B-8: P7 scanner `Array.from` generator bypass -- `Array.from({ length: 3 }, (_, i) => ({ id: i, action: 'Deployed', user: 'Admin' }))` invents field values inside a generator callback; the existing `Array.from` arm only checks a literal first argument | tests/moat/p7-no-fabricated-data.sh (scanner rule + a new red/green case; never weaken an existing arm) | MEDIUM | released@2026-09-27T15:00Z | New arm fires on `{length: N}` + concise-object-returning arrow, substitutes arrow params with 0 before reusing `is_literal`, requires >=1 literal string field post-substitution. Unanimous 2/2 APPROVE, both reviewers independently reproduced with distinct fixtures; reviewer 2 verified the 3-way merge onto current main via `git merge-file` before I merged it (zero conflicts, purely additive) and found a new non-blocking gap (nested Array.from generators losing an outer scope's loop variable through substitution) filed as BACKLOG 145. d49b26d7. Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
 | S-33 | BACKLOG 128: stale docs assert a `{"runner":"none","pass":true}` writer shape that doesn't exist (D20 corrected this; the real writer, `enforce_test_coverage` at run.sh:13250, writes `pass:"inconclusive"`, a string, never boolean true) | references/core-workflow.md, docs/VERIFIED-COMPLETION-PLAN.md, tests/test-council-devils-advocate.sh, tests/test-da-veto.sh, tests/test-council-convergence-floor.sh (fixture shapes only; do not touch any assertion logic) | LOW | released@2026-09-27T15:00Z | Not behaviorally load-bearing (harmless today since runner=='none' is unconditional at every reading site), but honesty/documentation-drift cleanup. Found and fixed a 4th documentation occurrence beyond the original bug report's scope. Confirmed a genuinely interesting residual coverage gap in test-council-convergence-floor.sh's NEGATIVE-B (correctly disclosed, not fixed -- out of this fixture-only slice's scope). 1/1 APPROVE. **Merged to main (90e26308).** Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |

package/docs/v10/METRICS.md

@@ -156,3 +156,60 @@ rather than something job-setup variance or GitHub's own queueing missed, and
 that `test-ci-json-argmax.sh` actually lands near 60s once its BACKLOG 25
 fixture fix ships (until then this table's 60s row is an assumption, not a
 measurement, as stated in `tests/shard-durations.tsv`'s own header).
+
+## Tier A selector: last 10 non-docs commits (S-96, S-91 remainder)
+
+`scripts/select-tests.sh --base <SHA>^ --head <SHA>` (selection only, no
+`--run`), against the last 10 non-merge commits on main whose diff touches
+something outside `docs/v10` (`git log --no-merges -- . ':!docs/v10'`).
+Selector time is real wall clock (`/usr/bin/time -p`) for the selection step
+alone, measured in this worktree, one commit at a time. "Selected tests" for
+an R0 row is the whole `tests/run-all-tests.sh` suite (R0 means "run
+everything"), not a count of individual suites.
+
+| SHA | Rule(s) fired | Selected tests | Selector time |
+|---|---|---|---|
+| cc105687 | R1, R3 | 7 | 6.62s |
+| a4eb09d7 | R1, R3 | 7 | 6.24s |
+| a1ca3c7b | R0 | ALL (full suite, matched VERSION) | 0.04s |
+| 8009b193 | R3 | 2 | 6.98s |
+| 878f79e7 | R1, R3, R6 | 25 | 14.34s |
+| a537bb22 | R1, R3 | 7 | 7.24s |
+| 298f027e | R1, R6 | 3 | 0.04s |
+| 11c302bf | R0 | ALL (full suite, matched loki-ts/dist/loki.js) | 0.05s |
+| 03d5b515 | R0 | ALL (full suite, matched loki-ts/package.json) | 0.04s |
+| ea8ecf1c | R3 | 2 | 7.02s |
+
+All 10 land under 120s (the 3 R0 rows are the declared exception to the
+2-minute Tier A target and are labeled ALL rather than timed against it, per
+the green criterion in BOARD.md S-96).
+
+### tier-a.yml install caches (S-96)
+
+Added `pip` (setup-python `cache: pip`) and `npm` (new `setup-node@v4`,
+`cache: npm`) install caches to the `select-and-run` job; `oven-sh/setup-bun`
+was already caching bun installs by default (no `no-cache: true` set).
+`tests/moat/p9-rule-of-two.sh`'s cache-channel rule
+(P9.issue-workflows-separate-untrusted-from-push) bans an Actions cache only
+on a unit holding write permissions or secrets; `select-and-run` holds
+neither (`permissions: contents: read` at the workflow level, no
+job-level override, no `secrets.*` reference), so this is a negative-control
+case, verified both ways:
+
+| Check | Result |
+|---|---|
+| P9 green before the change | `bash tests/moat/p9-rule-of-two.sh` -> all 4 cases PASS, exit 0 |
+| P9 green after adding the 3 caches | `bash tests/moat/p9-rule-of-two.sh` -> all 4 cases PASS, exit 0; `SITE tier-a.yml:select-and-run ... verdict=ok` |
+| Mutation (`contents: read` -> `contents: write`) | `bash tests/moat/p9-rule-of-two.sh` -> `CASE P9.issue-workflows-separate-untrusted-from-push FAIL ... holds write permissions and restores actions/setup-python cache: pip, oven-sh/setup-bun ..., actions/setup-node cache: npm` (the guard names exactly the 3 caches added here) |
+| Mutation reverted | `bash tests/moat/p9-rule-of-two.sh` -> all 4 cases PASS, exit 0 again |
+
+Rework (post-review): an earlier draft of this commit added an explicit
+`timeout-minutes: 20` on the "Run selected suites" step (where the R0
+full-suite path executes). Review found this false-budgeted: this repo's own
+measured data (test.yml, scripts/local-ci.sh, CLAUDE.md) converges on
+~24-27 minutes for `tests/run-all-tests.sh` run serially, so a 20-minute step
+cap was tighter than even the existing 25-minute job-level ceiling, not a
+looser purpose-built budget as the commit claimed, and was never checked
+against a real R0 `--run`. Removed; the job-level `timeout-minutes: 25`
+remains the only cap on this step. Guarded by
+`tests/test-tier-a-r0-timeout-budget.sh` (S-96 rework).

package/docs/v10/PROGRESS.md

@@ -1217,3 +1217,12 @@ sample.
 | 16:26 | Trains 3 and 4 Tests: the build_supervisor flake again (3.10; 3.13); failed jobs rerun at 16:26:04Z. P0 S-102 in progress | |
 | 16:39 | v9.57.0 published: Release run 36331009098 publish-npm success (after the Release Manager tag push and a full rerun). v9.59.0 published: Release run 36332036567 publish-npm success, update-homebrew success (S-83), native Docker builds running (S-85). npm dist-tags still read 9.56.0 at 16:39 (processing lag) | gh run view |
 | 16:39 | Never published: v9.58.0 (superseded by v9.59.0, which contains it); v9.60.0 (1cde81a7), v9.61.0 (64676dce), v9.62.0 (9218ea04) carry the S-18 P9 regression; their Release runs were cancelled or failed. Tags exist from the 16:25/16:29 workaround | |
+
+## 2026-09-27T18:12Z: pulse violations cleared before train 6's bump
+- WORKTREE_COUNT: 108 to 8. 41 removed at 17:49 (branch fully on main per `git cherry main <branch>` with 0 "+" lines, clean, not in use), 35 at 18:04 and 11 at 18:11 (same test, plus the read-only triage report), and 12 at 18:12 from the triage's SUPERSEDED/duplicate list. Every branch is kept; every uncommitted diff is saved under ~/loki-ci-logs/worktree-patches/<name>.patch before `git worktree remove --force`. The pulse now shows "Worktrees under .claude/worktrees: 8 (max 15)". The 8 left are worktrees locked by this session's own agents.
+- UNEVIDENCED_CLAIM: the check flagged lines added in old commits even after they were corrected (S-105 and S-106 already cited run and job IDs; the S-113 row now cites release commit 0103adfa). It now flags only lines still present verbatim on main (068d032f, test T30e; tests/test-v10-pulse.sh 81/81; a mutant that drops the fix fails T30e). The pulse now shows "0 flagged line(s)".
+
+## Turn 300 drift audit (2026-09-27T18:23Z)
+- Drift: founder messages sent mid-turn were relayed into running batch-4 builders. At least 5 (S-133, S-136, S-142, S-144, S-145) stopped to investigate the pulse request, and S-144 dropped its slice entirely ("the relayed user request explicitly took priority"). None removed a worktree (each reported the worktree-isolation refusal). Correction: every future brief states that swarm-level requests (pulse, worktrees, BOARD) are Chief-of-Staff scope and builders stay on their slice; S-144 is re-dispatched in the next batch.
+- Pulse clean at 18:22Z: "Worktrees under .claude/worktrees: 14 (max 15)", "0 flagged line(s)", no VIOLATION lines. The remaining worktrees belong to running batch-4 builders.
+- Releases this hour: v9.63.0 (17:05:02Z), v9.64.0 (17:31:39Z), v9.65.0 (17:45:33Z), v9.66.0 (18:03:32Z). npm latest was 9.65.0 at 18:03 (curl registry.npmjs.org/loki-mode dist-tags).

package/loki-ts/dist/loki.js

@@ -1,5 +1,5 @@
 // @bun
-var at=Object.create;var{getPrototypeOf:ot,defineProperty:OG,getOwnPropertyNames:st}=Object;var nt=Object.prototype.hasOwnProperty;function rt($){return this[$]}var tt,et,$e=($,X,Q)=>{var z=$!=null&&typeof $==="object";if(z){var Z=X?tt??=new WeakMap:et??=new WeakMap,K=Z.get($);if(K)return K}Q=$!=null?at(ot($)):{};let J=X||!$||!$.__esModule?OG(Q,"default",{value:$,enumerable:!0}):Q;for(let q of st($))if(!nt.call(J,q))OG(J,q,{get:rt.bind($,q),enumerable:!0});if(z)Z.set($,J);return J};var Zq=($,X)=>()=>(X||$((X={exports:{}}).exports,X),X.exports);var Xe=($)=>$;function Qe($,X){this[$]=Xe.bind(null,X)}var B1=($,X)=>{for(var Q in X)OG($,Q,{get:X[Q],enumerable:!0,configurable:!0,set:Qe.bind(X,Q)})};var s=($,X)=>()=>($&&(X=$($=0)),X);var w5=import.meta.require;var WR={};B1(WR,{lokiDir:()=>h0,homeLokiDir:()=>GQ,findRepoRootForVersion:()=>LG,REPO_ROOT:()=>O1});import{resolve as h2,dirname as jG}from"path";import{fileURLToPath as ze}from"url";import{existsSync as Kq}from"fs";import{homedir as Ze}from"os";function Ke(){let $=HR;for(let X=0;X<6;X++){if(Kq(h2($,"VERSION"))&&Kq(h2($,"autonomy/run.sh")))return $;let Q=jG($);if(Q===$)break;$=Q}return h2(HR,"..","..","..")}function LG($){let X=$;for(let Q=0;Q<6;Q++){if(Kq(h2(X,"VERSION"))&&Kq(h2(X,"autonomy/run.sh")))return X;let z=jG(X);if(z===X)break;X=z}return h2($,"..","..","..")}function h0(){return process.env.LOKI_DIR??h2(process.cwd(),".loki")}function GQ(){return h2(Ze(),".loki")}var HR,O1;var k1=s(()=>{HR=jG(ze(import.meta.url));O1=Ke()});import{readFileSync as Je}from"fs";import{resolve as qe,dirname as Ve}from"path";import{fileURLToPath as Ye}from"url";function L9(){if(t3!==null)return t3;let $="9.66.0";if(typeof $==="string"&&$.length>0)return t3=$,t3;try{let X=Ve(Ye(import.meta.url)),Q=LG(X);t3=Je(qe(Q,"VERSION"),"utf-8").trim()}catch{t3="unknown"}return t3}var t3=null;var Jq=s(()=>{k1()});var LR={};B1(LR,{runOrThrow:()=>Re,run:()=>X1,readStreamCapped:()=>qq,commandVersion:()=>we,commandExists:()=>g5,ShellError:()=>CG,MAX_STDOUT_BYTES:()=>jR});async function qq($,X=jR){let Q=$.getReader(),z=new TextDecoder,Z="",K=0;try{while(K<X){let{done:J,value:q}=await Q.read();if(J)break;if(!q)continue;if(K+=q.byteLength,K>X){let V=q.byteLength-(K-X);Z+=z.decode(q.subarray(0,V),{stream:!0});break}Z+=z.decode(q,{stream:!0})}Z+=z.decode()}finally{try{await Q.cancel()}catch{}Q.releaseLock()}return Z}async function X1($,X={}){let Q=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:X.env?{...process.env,...X.env}:process.env,cwd:X.cwd}),z,Z;if(X.timeoutMs&&X.timeoutMs>0)z=setTimeout(()=>{try{Q.kill("SIGTERM")}catch{}Z=setTimeout(()=>{try{Q.kill("SIGKILL")}catch{}},2000)},X.timeoutMs);try{let[K,J,q]=await Promise.all([qq(Q.stdout),new Response(Q.stderr).text(),Q.exited]);return{stdout:K,stderr:J,exitCode:q}}finally{if(z)clearTimeout(z);if(Z)clearTimeout(Z)}}async function Re($,X={}){let Q=await X1($,X);if(Q.exitCode!==0)throw new CG(`command failed (${Q.exitCode}): ${$.join(" ")}`,Q.exitCode,Q.stdout,Q.stderr);return Q}async function g5($){let X=Ie($),Q=await X1(["sh","-c",`command -v ${X}`],{timeoutMs:5000});if(Q.exitCode===0)return Q.stdout.trim()||null;return null}function Ie($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function we($,X="--version"){if(!await g5($))return null;let z=await X1([$,X],{timeoutMs:5000});if(z.exitCode!==0)return null;return((z.stdout||z.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var jR=16777216,CG;var y8=s(()=>{CG=class CG extends Error{message;exitCode;stdout;stderr;constructor($,X,Q,z){super($);this.message=$;this.exitCode=X;this.stdout=Q;this.stderr=z;this.name="ShellError"}}});function g2($){return Pe?"":$}var Pe,p0,$5,Z1,l61,A1,f1,m5,n;var e7=s(()=>{Pe=(process.env.NO_COLOR??"").length>0;p0=g2("\x1B[0;31m"),$5=g2("\x1B[0;32m"),Z1=g2("\x1B[1;33m"),l61=g2("\x1B[0;34m"),A1=g2("\x1B[0;36m"),f1=g2("\x1B[1m"),m5=g2("\x1B[2m"),n=g2("\x1B[0m")});import{existsSync as he}from"fs";async function Z2(){if(BQ!==void 0)return BQ;let $="/opt/homebrew/bin/python3.12";if(he($))return BQ=$,$;let X=await g5("python3.12");if(X)return BQ=X,X;let Q=await g5("python3");return BQ=Q,Q}async function I4($,X={}){let Q=await Z2();if(!Q)return{stdout:"",stderr:"python3 not found",exitCode:127};return X1([Q,"-c",$],X)}var BQ;var m2=s(()=>{y8()});var gR={};B1(gR,{runStatus:()=>Y00});import{existsSync as u5,readFileSync as T9,readdirSync as kR,statSync as SR}from"fs";import{resolve as A5,basename as $00}from"path";import{homedir as X00}from"os";function yR($){let X=Math.trunc($);if(X>=1e6)return`${(Math.trunc(X/1e6*10)/10).toFixed(1)}M`;if(X>=1000)return`${(Math.trunc(X/1000*10)/10).toFixed(1)}K`;return String(X)}function bR($,X,Q){if(X===0)return null;let z=Math.trunc($*100/X),Z=Math.trunc($*Yq/X);if(Z>Yq)Z=Yq;let K=Yq-Z,J=$5;if(z>=80)J=p0;else if(z>=50)J=Z1;let q="=".repeat(Math.max(0,Z))+" ".repeat(Math.max(0,K)),V=yR($),Y=yR(X);return`  ${f1}${Q}${n} ${J}[${q}]${n} ${z}% (${V} / ${Y})`}async function z00(){if(await g5("jq"))return!0;return process.stdout.write(`${p0}Error: jq is required but not installed.${n}
+var at=Object.create;var{getPrototypeOf:ot,defineProperty:OG,getOwnPropertyNames:st}=Object;var nt=Object.prototype.hasOwnProperty;function rt($){return this[$]}var tt,et,$e=($,X,Q)=>{var z=$!=null&&typeof $==="object";if(z){var Z=X?tt??=new WeakMap:et??=new WeakMap,K=Z.get($);if(K)return K}Q=$!=null?at(ot($)):{};let J=X||!$||!$.__esModule?OG(Q,"default",{value:$,enumerable:!0}):Q;for(let q of st($))if(!nt.call(J,q))OG(J,q,{get:rt.bind($,q),enumerable:!0});if(z)Z.set($,J);return J};var Zq=($,X)=>()=>(X||$((X={exports:{}}).exports,X),X.exports);var Xe=($)=>$;function Qe($,X){this[$]=Xe.bind(null,X)}var B1=($,X)=>{for(var Q in X)OG($,Q,{get:X[Q],enumerable:!0,configurable:!0,set:Qe.bind(X,Q)})};var s=($,X)=>()=>($&&(X=$($=0)),X);var w5=import.meta.require;var WR={};B1(WR,{lokiDir:()=>h0,homeLokiDir:()=>GQ,findRepoRootForVersion:()=>LG,REPO_ROOT:()=>O1});import{resolve as h2,dirname as jG}from"path";import{fileURLToPath as ze}from"url";import{existsSync as Kq}from"fs";import{homedir as Ze}from"os";function Ke(){let $=HR;for(let X=0;X<6;X++){if(Kq(h2($,"VERSION"))&&Kq(h2($,"autonomy/run.sh")))return $;let Q=jG($);if(Q===$)break;$=Q}return h2(HR,"..","..","..")}function LG($){let X=$;for(let Q=0;Q<6;Q++){if(Kq(h2(X,"VERSION"))&&Kq(h2(X,"autonomy/run.sh")))return X;let z=jG(X);if(z===X)break;X=z}return h2($,"..","..","..")}function h0(){return process.env.LOKI_DIR??h2(process.cwd(),".loki")}function GQ(){return h2(Ze(),".loki")}var HR,O1;var k1=s(()=>{HR=jG(ze(import.meta.url));O1=Ke()});import{readFileSync as Je}from"fs";import{resolve as qe,dirname as Ve}from"path";import{fileURLToPath as Ye}from"url";function L9(){if(t3!==null)return t3;let $="9.67.0";if(typeof $==="string"&&$.length>0)return t3=$,t3;try{let X=Ve(Ye(import.meta.url)),Q=LG(X);t3=Je(qe(Q,"VERSION"),"utf-8").trim()}catch{t3="unknown"}return t3}var t3=null;var Jq=s(()=>{k1()});var LR={};B1(LR,{runOrThrow:()=>Re,run:()=>X1,readStreamCapped:()=>qq,commandVersion:()=>we,commandExists:()=>g5,ShellError:()=>CG,MAX_STDOUT_BYTES:()=>jR});async function qq($,X=jR){let Q=$.getReader(),z=new TextDecoder,Z="",K=0;try{while(K<X){let{done:J,value:q}=await Q.read();if(J)break;if(!q)continue;if(K+=q.byteLength,K>X){let V=q.byteLength-(K-X);Z+=z.decode(q.subarray(0,V),{stream:!0});break}Z+=z.decode(q,{stream:!0})}Z+=z.decode()}finally{try{await Q.cancel()}catch{}Q.releaseLock()}return Z}async function X1($,X={}){let Q=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:X.env?{...process.env,...X.env}:process.env,cwd:X.cwd}),z,Z;if(X.timeoutMs&&X.timeoutMs>0)z=setTimeout(()=>{try{Q.kill("SIGTERM")}catch{}Z=setTimeout(()=>{try{Q.kill("SIGKILL")}catch{}},2000)},X.timeoutMs);try{let[K,J,q]=await Promise.all([qq(Q.stdout),new Response(Q.stderr).text(),Q.exited]);return{stdout:K,stderr:J,exitCode:q}}finally{if(z)clearTimeout(z);if(Z)clearTimeout(Z)}}async function Re($,X={}){let Q=await X1($,X);if(Q.exitCode!==0)throw new CG(`command failed (${Q.exitCode}): ${$.join(" ")}`,Q.exitCode,Q.stdout,Q.stderr);return Q}async function g5($){let X=Ie($),Q=await X1(["sh","-c",`command -v ${X}`],{timeoutMs:5000});if(Q.exitCode===0)return Q.stdout.trim()||null;return null}function Ie($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function we($,X="--version"){if(!await g5($))return null;let z=await X1([$,X],{timeoutMs:5000});if(z.exitCode!==0)return null;return((z.stdout||z.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var jR=16777216,CG;var y8=s(()=>{CG=class CG extends Error{message;exitCode;stdout;stderr;constructor($,X,Q,z){super($);this.message=$;this.exitCode=X;this.stdout=Q;this.stderr=z;this.name="ShellError"}}});function g2($){return Pe?"":$}var Pe,p0,$5,Z1,l61,A1,f1,m5,n;var e7=s(()=>{Pe=(process.env.NO_COLOR??"").length>0;p0=g2("\x1B[0;31m"),$5=g2("\x1B[0;32m"),Z1=g2("\x1B[1;33m"),l61=g2("\x1B[0;34m"),A1=g2("\x1B[0;36m"),f1=g2("\x1B[1m"),m5=g2("\x1B[2m"),n=g2("\x1B[0m")});import{existsSync as he}from"fs";async function Z2(){if(BQ!==void 0)return BQ;let $="/opt/homebrew/bin/python3.12";if(he($))return BQ=$,$;let X=await g5("python3.12");if(X)return BQ=X,X;let Q=await g5("python3");return BQ=Q,Q}async function I4($,X={}){let Q=await Z2();if(!Q)return{stdout:"",stderr:"python3 not found",exitCode:127};return X1([Q,"-c",$],X)}var BQ;var m2=s(()=>{y8()});var gR={};B1(gR,{runStatus:()=>Y00});import{existsSync as u5,readFileSync as T9,readdirSync as kR,statSync as SR}from"fs";import{resolve as A5,basename as $00}from"path";import{homedir as X00}from"os";function yR($){let X=Math.trunc($);if(X>=1e6)return`${(Math.trunc(X/1e6*10)/10).toFixed(1)}M`;if(X>=1000)return`${(Math.trunc(X/1000*10)/10).toFixed(1)}K`;return String(X)}function bR($,X,Q){if(X===0)return null;let z=Math.trunc($*100/X),Z=Math.trunc($*Yq/X);if(Z>Yq)Z=Yq;let K=Yq-Z,J=$5;if(z>=80)J=p0;else if(z>=50)J=Z1;let q="=".repeat(Math.max(0,Z))+" ".repeat(Math.max(0,K)),V=yR($),Y=yR(X);return`  ${f1}${Q}${n} ${J}[${q}]${n} ${z}% (${V} / ${Y})`}async function z00(){if(await g5("jq"))return!0;return process.stdout.write(`${p0}Error: jq is required but not installed.${n}
 `),process.stdout.write(`Install with:
 `),process.stdout.write(`  brew install jq    (macOS)
 `),process.stdout.write(`  apt install jq     (Debian/Ubuntu)
@@ -1349,4 +1349,4 @@ Set LOKI_LEGACY_BASH=1 to force the bash CLI for every command.
 `),2}case"start":{let{runStart:z}=await Promise.resolve().then(() => (ct(),pt));return z(Q)}default:return process.stderr.write(`Unknown command: ${X}
 `),process.stderr.write(lt),2}}ER();process.on("SIGINT",()=>process.exit(130));process.on("SIGTERM",()=>process.exit(143));var w61=await I61(Bun.argv.slice(2));process.exit(w61);
 
-//# debugId=67516866E923C8653244CAA0A32811D4
+//# debugId=FD68752494AD3AAE4780B7DCF7A891A7

package/mcp/__init__.py

@@ -75,4 +75,4 @@ try:
 except ImportError:
     __all__ = ['mcp']
 
-__version__ = '9.66.0'
+__version__ = '9.67.0'

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "loki-mode",
   "mcpName": "io.github.asklokesh/loki-mode",
-  "version": "9.66.0",
+  "version": "9.67.0",
   "description": "Loki Mode by Autonomi. Autonomous spec-to-product system: takes a PRD, GitHub issue, OpenAPI/JSON/YAML, or one-line brief to a deployed app via the RARV-C closure loop with 8 quality gates. Provider-agnostic (Claude Code, OpenAI Codex, Cline, Aider, opencode).",
   "keywords": [
     "agent",

package/plugins/loki-mode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "loki-mode",
   "displayName": "Loki Mode",
-  "version": "9.66.0",
+  "version": "9.67.0",
   "description": "Autonomous spec-to-product build system with a built-in trust layer (RARV-C closure loop, 8 quality gates, completion council). Ships Loki's spec-hardening, drift-detection, and deterministic PR verification commands plus the Loki MCP server.",
   "author": {
     "name": "Autonomi",