loki-mode 9.74.0 → 9.75.0

package/docs/v10/BOARD.md

@@ -151,10 +151,10 @@ set is declared to avoid overlap with those and with each other.
 | S-132 | Velocity: skip heavy Tests jobs on a version-bump-only commit whose parent Tests run succeeded (eligibility no looser than release.yml STEP 1) | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | HIGH | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | released@2026-09-27T19:42Z | Batch 4 (build then review), dispatched 18:17. Batch-4 builder was diverted by a relayed message and built nothing; re-dispatched 18:37 in batch 4b (wf_63d4c91e-86d). Review APPROVE (HIGH); cherry-picked 7b328b1f+c50efd15 into train 9, main a39c4995 pushed 19:06:25 (`git ls-remote origin refs/heads/main` = a39c4995). Tagged v9.70.0, awaiting publish-npm (`git ls-remote origin refs/tags/v9.70.0^{}` = 6c459dfa). Published: `npm view loki-mode version` = 9.71.0; npm time lists 9.70.0. |
 | S-133 | Velocity: release.yml required-ci poll 30s to 10s; fix stale publish-npm comment | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | LOW | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | released@2026-09-27T18:55Z | Batch 4 (build then review), dispatched 18:17. Review APPROVE; train 7 pushed aada49d8 (main b7a8dd50 at 18:45:14Z, ls-remote verified). In v9.68.0 (release commit 8d17be2b, pushed 18:54:35Z); released when publish-npm succeeds. |
 | S-134 | Velocity: rebuild shard-durations.tsv from a recent successful run; drift test | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | LOW | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | released@2026-09-27T19:42Z | Batch 4 (build then review), dispatched 18:17. Batch-4 builder was diverted by a relayed message and built nothing; re-dispatched 18:37 in batch 4b (wf_63d4c91e-86d). Review APPROVE; abe6a7ae into train 9 (a39c4995). Tagged v9.70.0, awaiting publish-npm (`git ls-remote origin refs/tags/v9.70.0^{}` = 6c459dfa). Published: `npm view loki-mode version` = 9.71.0; npm time lists 9.70.0. |
-| S-135 | Velocity: parallelize trust-core probe mutations (130s) | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | MEDIUM | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | merged@2026-09-27T20:06Z | Batch 4 (build then review), dispatched 18:17. Blocked as scoped: probe_case mutates the shared repo in place (50 of 91 sites target autonomy/run.sh); reviewer reproduced the race. Re-scope: a private repo copy per worker plus a target override. Batch 5 build, re-scoped to a private repo copy per worker (wf_38d4e17c-211). 4a29e278 (MEDIUM review APPROVE); in train 12, main ec01d54b pushed 20:05:58 (`git ls-remote origin refs/heads/main` = ec01d54b). |
+| S-135 | Velocity: parallelize trust-core probe mutations (130s) | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | MEDIUM | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | released@2026-09-27T20:24Z | Batch 4 (build then review), dispatched 18:17. Blocked as scoped: probe_case mutates the shared repo in place (50 of 91 sites target autonomy/run.sh); reviewer reproduced the race. Re-scope: a private repo copy per worker plus a target override. Batch 5 build, re-scoped to a private repo copy per worker (wf_38d4e17c-211). 4a29e278 (MEDIUM review APPROVE); in train 12, main ec01d54b pushed 20:05:58 (`git ls-remote origin refs/heads/main` = ec01d54b). Published in v9.73.0 (`npm view loki-mode version` = 9.73.0; npm time 2026-09-27T20:24Z). |
 | S-136 | Velocity: tests/test-select-tests.sh under 30s, same 38 cases | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | MEDIUM | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | released@2026-09-27T19:42Z | Batch 4 (build then review), dispatched 18:17. Batch-4 builder was diverted by a relayed message and built nothing; re-dispatched 18:37 in batch 4b (wf_63d4c91e-86d). 7fc63d5b REJECT (mapfile crashes under /bin/bash 3.2); rework dispatched 18:53. cafbf57c re-review APPROVE (38/38 under /bin/bash 3.2, 25.6s); lands after the release 10 bump. Note: two builders converged on the same fix. 7fc63d5b+cafbf57c onto main b61045fd pushed 19:19:39 (`/bin/bash tests/test-select-tests.sh` = 38 passed, 0 failed, 33.6s). Tagged v9.70.0, awaiting publish-npm (`git ls-remote origin refs/tags/v9.70.0^{}` = 6c459dfa). Published: `npm view loki-mode version` = 9.71.0; npm time lists 9.70.0. |
 | S-137 | S-81 follow-up: shard-coverage T4 enumerates the real runner | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | LOW | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | released@2026-09-27T19:42Z | Batch 4 (build then review), dispatched 18:17. Batch-4 builder was diverted by a relayed message and built nothing; re-dispatched 18:37 in batch 4b (wf_63d4c91e-86d). Review APPROVE; 4107e16f into train 9 (a39c4995). Fix-forward 6e48decb: T4 unsharded run inherited LOKI_TEST_SHARD in CI (Tests run 36343130286 shard 7/8: "unsharded real run selected 41 of 564"); `LOKI_TEST_SHARD=6/8 bash tests/test-shard-coverage.sh` 18/1 before, 19/0 after. Tagged v9.70.0, awaiting publish-npm (`git ls-remote origin refs/tags/v9.70.0^{}` = 6c459dfa). Published: `npm view loki-mode version` = 9.71.0; npm time lists 9.70.0. |
-| S-138 | GUARDS 12: lint so test fixtures never write the real ~/.gitconfig | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | LOW | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | merged@2026-09-27T20:06Z | Batch 4 (build then review), dispatched 18:17. 849b655e review REJECT; rework pending. 2f29ad49 re-review REJECT (2nd); rework in batch 5 (wf_38d4e17c-211). 7431f5dd 3rd REJECT; simplified rework (fail closed unless a named isolation helper is sourced) in batch 6 (wf_3510293b-09b). a95eabea (4th round, review APPROVE); in train 12, main ec01d54b pushed 20:05:58 (`git ls-remote origin refs/heads/main` = ec01d54b). |
+| S-138 | GUARDS 12: lint so test fixtures never write the real ~/.gitconfig | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | LOW | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | released@2026-09-27T20:24Z | Batch 4 (build then review), dispatched 18:17. 849b655e review REJECT; rework pending. 2f29ad49 re-review REJECT (2nd); rework in batch 5 (wf_38d4e17c-211). 7431f5dd 3rd REJECT; simplified rework (fail closed unless a named isolation helper is sourced) in batch 6 (wf_3510293b-09b). a95eabea (4th round, review APPROVE); in train 12, main ec01d54b pushed 20:05:58 (`git ls-remote origin refs/heads/main` = ec01d54b). Published in v9.73.0 (`npm view loki-mode version` = 9.73.0; npm time 2026-09-27T20:24Z). |
 | S-139 | GUARDS 13 + BACKLOG 136: RELEASED_AHEAD_OF_NPM; UNKNOWN on tag/npm disagreement | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | MEDIUM | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | released@2026-09-27T19:42Z | Batch 4 (build then review), dispatched 18:17. Batch-4 builder was diverted by a relayed message and built nothing; re-dispatched 18:37 in batch 4b (wf_63d4c91e-86d). Review APPROVE; 28d18393 onto main 06bf5406 pushed 19:08:09. Tagged v9.70.0, awaiting publish-npm (`git ls-remote origin refs/tags/v9.70.0^{}` = 6c459dfa). Published: `npm view loki-mode version` = 9.71.0; npm time lists 9.70.0. |
 | S-140 | BACKLOG 103: jest "Test Suites N failed" / vitest "Test Files N failed" count as failures | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | MEDIUM | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | released@2026-09-27T19:42Z | Batch 4 (build then review), dispatched 18:17. Built 6dbfc1e6; review pending. Review APPROVE; 6dbfc1e6 onto main e952e1ae pushed 19:09:04. Tagged v9.70.0, awaiting publish-npm (`git ls-remote origin refs/tags/v9.70.0^{}` = 6c459dfa). Published: `npm view loki-mode version` = 9.71.0; npm time lists 9.70.0. |
 | S-141 | S-49 follow-up: remaining council readers (~1425, ~1564, ~4232) use -I -S | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | HIGH | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | released@2026-09-27T19:42Z | Batch 4 (build then review), dispatched 18:17. Batch-4 builder was diverted by a relayed message and built nothing; re-dispatched 18:37 in batch 4b (wf_63d4c91e-86d). Review APPROVE (HIGH); 001576f3+958f6548 onto main 06bf5406 pushed 19:08:09. Tagged v9.70.0, awaiting publish-npm (`git ls-remote origin refs/tags/v9.70.0^{}` = 6c459dfa). Published: `npm view loki-mode version` = 9.71.0; npm time lists 9.70.0. |
@@ -162,13 +162,13 @@ set is declared to avoid overlap with those and with each other.
 | S-143 | BACKLOG 117: drop Gemini/Railway/stale gate counts from 6 web-app files | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | LOW | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | released@2026-09-27T19:42Z | Batch 4 (build then review), dispatched 18:17. Batch-4 builder was diverted by a relayed message and built nothing; re-dispatched 18:37 in batch 4b (wf_63d4c91e-86d). Review APPROVE; 6f901f91 into train 9 (a39c4995). Tagged v9.70.0, awaiting publish-npm (`git ls-remote origin refs/tags/v9.70.0^{}` = 6c459dfa). Published: `npm view loki-mode version` = 9.71.0; npm time lists 9.70.0. |
 | S-144 | Footer.tsx version joins release.sh --bump-only | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | LOW | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | released@2026-09-27T18:55Z | Batch 4 (build then review), dispatched 18:17. Review APPROVE; train 7 pushed edb706ed (main b7a8dd50 at 18:45:14Z, ls-remote verified). In v9.68.0 (release commit 8d17be2b, pushed 18:54:35Z); released when publish-npm succeeds. |
 | S-145 | BACKLOG 118: GET /api/checklist/waivers returns 500 on a corrupt file | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | LOW | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | released@2026-09-27T18:55Z | Batch 4 (build then review), dispatched 18:17. Review APPROVE; train 7 pushed 2ef38a2f (main b7a8dd50 at 18:45:14Z, ls-remote verified). In v9.68.0 (release commit 8d17be2b, pushed 18:54:35Z); released when publish-npm succeeds. |
-| S-146 | BACKLOG 118: one id="budget-banner" in the dashboard build | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | LOW | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | merged@2026-09-27T19:56Z | Batch 4 (build then review), dispatched 18:17. Batch-4 builder was diverted by a relayed message and built nothing; re-dispatched 18:37 in batch 4b (wf_63d4c91e-86d). 569e8cf4 review CONCERN; rework in batch 5 (wf_38d4e17c-211). dc2e45a1 review CONCERN (e2e harness still targets budget-banner); rework in batch 6 (wf_3510293b-09b). Review APPROVE on acdbd03c; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). |
+| S-146 | BACKLOG 118: one id="budget-banner" in the dashboard build | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | LOW | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | released@2026-09-27T20:13Z | Batch 4 (build then review), dispatched 18:17. Batch-4 builder was diverted by a relayed message and built nothing; re-dispatched 18:37 in batch 4b (wf_63d4c91e-86d). 569e8cf4 review CONCERN; rework in batch 5 (wf_38d4e17c-211). dc2e45a1 review CONCERN (e2e harness still targets budget-banner); rework in batch 6 (wf_3510293b-09b). Review APPROVE on acdbd03c; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). Published in v9.72.0 (`npm view loki-mode version` = 9.72.0; npm time 20:13Z). |
 | S-147 | BACKLOG 118: loki metrics --json reports null for unmeasured, no invented time_saved | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | MEDIUM | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | released@2026-09-27T19:47Z | Batch 4 (build then review), dispatched 18:17. Batch-4 builder was diverted by a relayed message and built nothing; re-dispatched 18:37 in batch 4b (wf_63d4c91e-86d). f82eeda0 review CONCERN; rework in batch 5 (wf_38d4e17c-211). Re-review APPROVE; f82eeda0+920b1ae8 onto main c6ed3882 pushed 19:30:18 (`bash tests/test-metrics-json-unmeasured.sh` rc=0). Published: `npm view loki-mode version` = 9.71.0; npm time lists 9.71.0. |
 | S-148 | BACKLOG 118: trust.html says "Not enough history yet" when every axis is insufficient | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | LOW | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | released@2026-09-27T19:05Z | Batch 4 (build then review), dispatched 18:17. Built 92c0f9d8; review pending. Review APPROVE; cherry-picked for train 8. Released in v9.69.0 (b2444763, `git ls-remote origin refs/tags/v9.69.0^{}` = b2444763). |
 | S-149 | BACKLOG 118: prompt_optimizer never-ran vs corrupt markers | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | LOW | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | released@2026-09-27T18:55Z | Batch 4 (build then review), dispatched 18:17. Review APPROVE; train 7 pushed 06eea9ea (main b7a8dd50 at 18:45:14Z, ls-remote verified). In v9.68.0 (release commit 8d17be2b, pushed 18:54:35Z); released when publish-npm succeeds. |
 | S-150 | BACKLOG 118: migration progress null (not 0/0) on a corrupt/missing file | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | LOW | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | released@2026-09-27T18:55Z | Batch 4 (build then review), dispatched 18:17. Review APPROVE; train 7 pushed b7a8dd50 (main b7a8dd50 at 18:45:14Z, ls-remote verified). In v9.68.0 (release commit 8d17be2b, pushed 18:54:35Z); released when publish-npm succeeds. |
 | S-151 | BACKLOG 118: analytics heatmap shows no-data before the activity window | files per docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | LOW | wall check in docs/v10/ARCHITECT-CUTS.md (18:05Z cut) | released@2026-09-27T19:42Z | Batch 4 (build then review), dispatched 18:17. Batch-4 builder was diverted by a relayed message and built nothing; re-dispatched 18:37 in batch 4b (wf_63d4c91e-86d). Review APPROVE; 97f8b6c5 into train 9 (a39c4995). Tagged v9.70.0, awaiting publish-npm (`git ls-remote origin refs/tags/v9.70.0^{}` = 6c459dfa). Published: `npm view loki-mode version` = 9.71.0; npm time lists 9.70.0. |
-| S-152 | Incident guard: only the Chief of Staff pushes main. A worktree agent pushed 28926937 at 18:35Z. Block `git push` and any commit on main from inside .claude/worktrees (guard hook or a pre-push check in .githooks/pre-push that refuses unless LOKI_RELEASE_MANAGER=1 is set by the orchestrator) | scripts/v10-guard.sh and/or .githooks/pre-push, tests | HIGH | a push from a worktree path is refused with a clear reason; the orchestrator push with the marker still works; fixture per case | merged@2026-09-27T19:56Z | Evidence: `git log -1 28926937` author asklokesh 14:35:11; `git ls-remote origin refs/heads/main` = 28926937. f02bcbde review CONCERN (no allowed non-main case); rework in batch 5 (wf_38d4e17c-211). c9590985 review CONCERN (shellcheck SC2163); rework in batch 6 (wf_3510293b-09b). Review APPROVE on 3b649b51; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). |
+| S-152 | Incident guard: only the Chief of Staff pushes main. A worktree agent pushed 28926937 at 18:35Z. Block `git push` and any commit on main from inside .claude/worktrees (guard hook or a pre-push check in .githooks/pre-push that refuses unless LOKI_RELEASE_MANAGER=1 is set by the orchestrator) | scripts/v10-guard.sh and/or .githooks/pre-push, tests | HIGH | a push from a worktree path is refused with a clear reason; the orchestrator push with the marker still works; fixture per case | released@2026-09-27T20:13Z | Evidence: `git log -1 28926937` author asklokesh 14:35:11; `git ls-remote origin refs/heads/main` = 28926937. f02bcbde review CONCERN (no allowed non-main case); rework in batch 5 (wf_38d4e17c-211). c9590985 review CONCERN (shellcheck SC2163); rework in batch 6 (wf_3510293b-09b). Review APPROVE on 3b649b51; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). Published in v9.72.0 (`npm view loki-mode version` = 9.72.0; npm time 20:13Z). |
 | S-153 | Release reuse: add web-app/src/components/Footer.tsx to release.yml required-ci ALLOWLIST with the same version-only compare, so a version-bump commit that now rewrites the Footer (S-144) can still reuse its parent verdict; also rebuild web-app/dist on --bump-only so the shipped footer shows the version | .github/workflows/release.yml (ALLOWLIST), scripts/release.sh, tests/test_release_required_ci.py | HIGH | a bump touching only allowlisted files incl. Footer.tsx is eligible; a Footer change beyond the version string is not; replay of 8d17be2b is eligible | released@2026-09-27T19:47Z | Evidence: v9.68.0 bump 8d17be2b touches Footer.tsx (git show --stat 8d17be2b). Batch 5 build (wf_38d4e17c-211). Review APPROVE (HIGH); e11137ad onto main c6ed3882 pushed 19:30:18. Published: `npm view loki-mode version` = 9.71.0; npm time lists 9.71.0. |
 | S-01 | BACKLOG 22: orphaned `sleep 300` resource monitor | autonomy/run.sh (resource-monitor spawn/cleanup only, not kill_provider_child), one new test | MEDIUM | red: `loki start` then interrupt leaves a `sleep 300` orphan (ps shows it after exit); green: it is reaped or never orphaned, by PID recorded at spawn | released@2026-09-27T01:33Z | 027ec085 confirmed ancestor of origin/main; note corrected, was stale. |
 | S-02 | BACKLOG 23: client-route test hardcodes main checkout path | tests/lib-extract-client-paths.mjs, tests/lib-match-client-routes.py, tests/test-verify-client-routes.sh | LOW | released@2026-09-27T15:00Z | 1/1 APPROVE: reviewer reproduced from 2 independent real worktrees, mutation-tested both new WORKTREE GUARD assertions independently, confirmed the disclosed BACKLOG 137 interaction (P7's own sed-workaround breaking) is expected, not a surprise. **Merged to main.** S-39/BACKLOG 137 now unblocked -- but note: this merge makes `tests/moat/run.sh` read a live FAIL on `P7.webapp-client-routes-exist` until S-39 lands (an unlisted-in-pending.txt regression per the ratchet), since P7's own copy-and-sed workaround can no longer find the literal it targets. S-39 should be prioritized promptly to close this gap, or a temporary pending.txt entry considered if S-39 doesn't land quickly. Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
@@ -213,46 +213,66 @@ set is declared to avoid overlap with those and with each other.
 | S-40 | BACKLOG 141 + 142: GF-3's P9 injection moat case unsets `LOKI_SDK_LOOP`/`LOKI_SDK_MODE`, no Bun-route coverage; found and fixed a real production Rule-of-Two leak in `claude_flags.ts` | tests/moat/p9-rule-of-two.sh, loki-ts/src/providers/claude_flags.ts, loki-ts/dist/loki.js(.map) | MEDIUM | released@2026-09-27T15:00Z | Fixed `ensureClaudeHelpCache()`'s bare `Bun.spawn` (no `env`, so Bun's startup snapshot bypassed the token-withholding delete) -- now passes `env: {...process.env}`. 1/1 APPROVE (reviewer independently rebuilt dist from source via git-archive and byte-diffed to confirm the shipped artifact is genuinely current, independently reproduced the mutation test showing a real injected push succeeding pre-fix, found additional out-of-scope spawn sites in doctor.ts/quality_gates.ts and confirmed they're unreachable from withholdGithubTokens()'s call path). P9 PROVEN on both routes post-merge, verified locally. 2f506f3e. Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
 | S-37 | BACKLOG 3: P9 Rule of Two gaps -- `loki-issue-to-pr.yml` holds issue text, secrets and push in one step; no `author_association` gate on `/loki`; checkout persists credentials; provider env keeps `GH_TOKEN` | .github/workflows/loki-issue-to-pr.yml, tests/moat/p9-rule-of-two.sh | HIGH | parked@2026-09-27T05:18Z | **Duplicate of GF-3** (same BACKLOG 3, same P9 files: .github/workflows/*.yml, tests/moat/p9-rule-of-two.sh). Caught before this was independently dispatched -- parked rather than run in parallel with GF-3 to avoid two agents solving the identical problem on the same files. Un-park only if GF-3 turns out to cover a narrower scope than this row once GF-3's actual diff is reviewed. |
 | S-38 | Founder directive follow-through: wire `.claude/settings.local.json` (local-only, never committed) with SessionStart + UserPromptSubmit hooks running `scripts/v10-pulse.sh`, plus `scripts/v10-drift-audit-counter.sh` for the every-6th-turn drift audit signal | .claude/settings.local.json (gitignored, not a repo file -- no PR/merge, tracked here for visibility only), scripts/v10-drift-audit-counter.sh (new, in-repo, this row's real deliverable) | LOW | released@2026-09-27T15:00Z | Verified hook exit-code semantics with claude-code-guide before wiring (exit 1/2 on UserPromptSubmit do NOT block, only exit 2 does; pass-through with no wrapper is correct). Combined pulse+counter output is 23-24 lines, under the 40-line budget. Confirmed FIRING FOR REAL via an actual UserPromptSubmit invocation (not just a manual test), captured verbatim in PROGRESS.md. Counter tested standalone across 7 simulated turns, correctly signals on turn 6. Committed `scripts/v10-drift-audit-counter.sh` directly (LOW tier, single new file, no production code path); `.claude/settings.local.json` itself is local config, not committed, per its own gitignore rule. Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
-| S-154 | GUARDS 5 + TODO 8: prune-worktrees.sh treats a cherry-picked branch (git cherry, no + lines) as merged; test forbids mtime signals | scripts/prune-worktrees.sh, tests/test-prune-worktrees.sh (new) | MEDIUM | bash tests/test-prune-worktrees.sh exits 0; cherry-picked fixture listed, one-unique-commit, locked and dirty fixtures kept; dropping the git cherry branch fails the case | merged@2026-09-27T19:56Z | Removes worktrees only via git worktree remove. Captain registers the test. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on a41e625f; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). |
-| S-155 | Velocity: reachability scan (95s on CI, 47s local) under 10s via a per-module stem prefilter, identical verdicts | tests/lib/scan-unreachable-shipped.py | LOW | scan wall time under 10s; stdout and rc byte-identical to the pre-change capture; bash tests/test-no-unreachable-shipped.sh 4 passed 0 failed; removing one real require is still reported | merged@2026-09-27T19:56Z | Builder measures regex vs I/O first and records both numbers. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on 3f786ce0; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). |
-| S-156 | BACKLOG 127 remainder: auto-capture shadow_write runs with PROJECT_DIR unset, and float() splices episode importance into python source | autonomy/run.sh (shadow_write auto-capture block about 21380-21396 only), tests/test-autocapture-shadow-write-guard.sh (new) | HIGH | bash tests/test-autocapture-shadow-write-guard.sh exits 0 under /bin/bash and bash 5; no marker from a planted cwd memory package; no file from an injected importance; trust-core suite passes | merged@2026-09-27T19:56Z | Builder names who writes episode_path_file. Only run.sh row in this cut. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on 71d7a246; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). |
-| S-157 | BACKLOG 98/89: council member vote and _council_convergence_evidence_green read pass:true as green whatever failed_count says | autonomy/completion-council.sh (those 2 parsers only), tests/test-council-failed-count-honesty.sh (new) | HIGH | pass:true with failed_count 2 is not green at both sites; failed_count 0 stays green; trust-core and convergence-floor suites pass; reverting either site fails its case | merged@2026-09-27T20:06Z | Mirrors the evidence gate rule (~2014). Only completion-council.sh row in this cut. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. 7a709fde (HIGH review APPROVE); in train 12, main ec01d54b pushed 20:05:58 (`git ls-remote origin refs/heads/main` = ec01d54b). |
-| S-158 | BACKLOG 118: per-run cost_partial dropped by /api/cost/timeline runs[] and /api/proofs; pages show a lower bound as a total | dashboard/server.py (runs.append in _compute_cost_timeline and the /api/proofs row only), dashboard/static/cost.html, dashboard/static/proofs.html, tests/dashboard/test_cost_partial_surfaced.py (new) | MEDIUM | pytest test_cost_partial_surfaced.py passes; fixture cost_partial true surfaces in both endpoints and renders as at least $X; dropping the key fails | merged@2026-09-27T19:56Z | Builder names the consumers checked. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on 931a93b6; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). |
-| S-159 | BACKLOG 114: NLSearch renders No results found when the search request failed | web-app/src/components/NLSearch.tsx, web-app/src/components/NLSearch.state.test.mjs (new) | LOW | node --test NLSearch.state.test.mjs passes incl. the negative assertion; npx tsc -b exits 0 | merged@2026-09-27T19:56Z | Captain rebuilds web-app/dist. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on ea5b4462; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). |
-| S-160 | BACKLOG 114: CommandPalette file-search failure reads as No results found | web-app/src/components/CommandPalette.tsx, web-app/src/components/CommandPalette.state.test.mjs (new) | LOW | node --test CommandPalette.state.test.mjs passes; npx tsc -b exits 0 | merged@2026-09-27T19:56Z | Captain rebuilds web-app/dist. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on 3f9873f3; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). |
-| S-161 | BACKLOG 114: ProjectsPage ignores usePolling error and says No projects yet on a failed fetch | web-app/src/pages/ProjectsPage.tsx, web-app/src/pages/ProjectsPage.state.test.mjs (new) | LOW | node --test ProjectsPage.state.test.mjs passes (error, stale-data and real-empty cases); npx tsc -b exits 0 | merged@2026-09-27T19:56Z | Captain rebuilds web-app/dist. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on d2dd3645; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). |
-| S-162 | BACKLOG 114: SecretsPanel and DocsPanel swallow fetch errors into No secrets / No documentation empty states | web-app/src/components/ProjectWorkspace.tsx (SecretsPanel and DocsPanel fetch and empty branches only), web-app/src/components/ProjectWorkspace.panels.test.mjs (new) | LOW | node --test ProjectWorkspace.panels.test.mjs passes; npx tsc -b exits 0 | merged@2026-09-27T19:56Z | Captain rebuilds web-app/dist. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on 6f6a6207; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). |
-| S-163 | BACKLOG 114: CICDPanel maps neutral/action_required/stale/null conclusions to Failed and unknown statuses to running | web-app/src/components/CICDPanel.tsx (3 normalizers and status map only), web-app/src/components/CICDPanel.status.test.mjs (new) | LOW | node --test CICDPanel.status.test.mjs passes for every conclusion; npx tsc -b exits 0 | merged@2026-09-27T19:56Z | Captain rebuilds web-app/dist. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on 36052758; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). |
-| S-164 | BACKLOG 114: AIChatPanel prints Done. for a non-zero exit with no output | web-app/src/components/AIChatPanel.tsx (the two Done. fallbacks only), web-app/src/components/AIChatPanel.result.test.mjs (new) | LOW | node --test AIChatPanel.result.test.mjs passes; npx tsc -b exits 0 | merged@2026-09-27T19:56Z | Captain rebuilds web-app/dist. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on 8aceef56; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). |
-| S-165 | BACKLOG 117 remainder: TrustedBy asserts Trusted by developers; ChangelogWidget shows March 2026 v6.x as Recent Changes | web-app/src/components/TrustedBy.tsx, web-app/src/components/ChangelogWidget.tsx | LOW | grep for Trusted by developers and 6.71.1 in those files returns rc 1; npx tsc -b exits 0 | merged@2026-09-27T19:56Z | Copy only. Captain rebuilds web-app/dist. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on 97ba623f; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). |
-| S-166 | BACKLOG 114: checkpoint viewer ignores a rejected allSettled fetch and clears the error | dashboard-ui/components/loki-checkpoint-viewer.js (load block only), dashboard-ui/tests/loki-checkpoint-viewer-fetch-error.node.test.mjs (new) | LOW | node --test the new file passes incl. the negative assertion | merged@2026-09-27T19:56Z | Captain rebuilds dashboard/static/index.html. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on 4035d21d; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). |
-| S-167 | BACKLOG 114: council transcripts render a failed hook-events read as zero events | dashboard-ui/components/loki-council-transcripts.js (hook events load only), dashboard-ui/tests/loki-council-transcripts-fetch-error.node.test.mjs (new) | LOW | node --test the new file passes | merged@2026-09-27T19:56Z | Captain rebuilds dashboard/static/index.html. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on 3fea74e8; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). |
-| S-168 | BACKLOG 114: task board hides a server load error whenever local tasks exist | dashboard-ui/components/loki-task-board.js (catch and error render only), dashboard-ui/tests/loki-task-board-fetch-error.node.test.mjs (new) | LOW | node --test the new file passes; loki-task-board-modal-guard test still passes | merged@2026-09-27T19:56Z | Captain rebuilds dashboard/static/index.html. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on aa2a64a4; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). |
-| S-169 | BACKLOG 114: log stream swallows API failures with an empty catch | dashboard-ui/components/loki-log-stream.js (API poll catch and empty render only), dashboard-ui/tests/loki-log-stream-fetch-error.node.test.mjs (new) | LOW | node --test the new file passes; loki-poll-registry test still passes | merged@2026-09-27T20:06Z | Captain rebuilds dashboard/static/index.html. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. a990a9ce review REJECT; rework dispatched 19:57Z. 707283f3 (re-review APPROVE, runner lists 598 = main + 1); in train 12, main ec01d54b pushed 20:05:58 (`git ls-remote origin refs/heads/main` = ec01d54b). |
-| S-170 | BACKLOG 114: API keys panel renders No API keys configured under its own load-error banner | dashboard-ui/components/loki-api-keys.js (table branch only), dashboard-ui/tests/loki-api-keys-fetch-error.node.test.mjs (new) | LOW | node --test the new file passes; error render lacks the empty-state sentence | merged@2026-09-27T19:56Z | Captain rebuilds dashboard/static/index.html. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on ab837a75; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). |
-| S-171 | BACKLOG 124: lint for response fields interpolated into innerHTML without the escape helper | tests/test-no-unescaped-innerhtml.sh (new), tests/lib/scan-unescaped-innerhtml.py (new) | MEDIUM | passes on main with a reasoned in-file allowlist; planted fixture exits 1; empty-reason entry fails; at least 20 files scanned | merged@2026-09-27T20:06Z | Any real XSS found is reported only; repairs go to separate slices. Captain registers. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. db501eba (review APPROVE); in train 12, main ec01d54b pushed 20:05:58 (`git ls-remote origin refs/heads/main` = ec01d54b). |
-| S-172 | BACKLOG 132: shadow-write mutant check is green on bash 5.3 and red on /bin/bash 3.2 | tests/test-council-shadow-write-project-dir.sh | LOW | bash tests/test-council-shadow-write-project-dir.sh exits 0; mutant leg red under both /bin/bash and PATH bash, both versions printed | merged@2026-09-27T19:56Z | Test-only. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on e2114d09; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). |
-| S-173 | BACKLOG 135: P2.council-readers-not-shadowed does not drive council_managed_should_stop (cwd-shadow class only) | tests/moat/p2-honest-verdict.sh (that case only) | HIGH | p2-honest-verdict.sh prints CASE P2.council-readers-not-shadowed PASS; removing the sys.path filter in a scratch copy prints FAIL | merged@2026-09-27T19:56Z | No .pth leg: that reader is still python3 -E, so a .pth leg would redden a proven case; follows alternate A2. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on 6bc4b5cf; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). |
-| S-174 | Guard: run_test with a missing or empty argument stops run-all-tests.sh with no summary and skips later suites | tests/run-all-tests.sh (run_test guard and missing-script return only), tests/test-run-all-missing-arg.sh (new) | MEDIUM | bash tests/test-run-all-missing-arg.sh exits 0 with Failed: 1 per leg (one-arg, empty-arg, missing-script) and the later stub's PASSED line printed; guard removed in a scratch copy exits 1; bash tests/test-run-all-dispatch.sh and LOKI_TEST_LIST=1 bash tests/test-shard-coverage.sh exit 0 | building@2026-09-27T20:12Z | Source: 19:57Z cut. Batch 7 (wf_a3ea2c8c-560), build then review. |
-| S-175 | BACKLOG 62: a whitelist-rejected LOKI_MONOREPO_TEST_CMD records pass true and touches unit-tests.pass | autonomy/run.sh (enforce_test_coverage monorepo-custom-rejected branch only), tests/test-monorepo-rejected-cmd-inconclusive.sh (new) | HIGH | bash tests/test-monorepo-rejected-cmd-inconclusive.sh exits 0: pass is "inconclusive", status not_run, no unit-tests.pass; reverting the branch exits 1; bash tests/test-trust-core-tests-detect.sh exits 0 | building@2026-09-27T20:12Z | Source: 19:57Z cut. Batch 7 (wf_a3ea2c8c-560), build then review. |
-| S-176 | BACKLOG 98: proof headline reads a stale test-results.json (_collect_tests has no .test-results.iter check) | autonomy/lib/proof-generator.py (_collect_tests only), tests/test_proof_tests_freshness.py (new) | HIGH | python3 -m pytest -q tests/test_proof_tests_freshness.py passes: ITERATION_COUNT=5 with marker 4 gives facts.tests.status not_run and a headline unlike the fresh case; marker 5 keeps the prior status; removing the check fails the stale case | building@2026-09-27T20:12Z | Source: 19:57Z cut. Batch 7 (wf_a3ea2c8c-560), build then review. |
-| S-177 | BACKLOG 98: Bun npm-test fallback reads an exit-0 run that prints failures as passed | loki-ts/src/runner/quality_gates.ts (runTestCoverage npm fallback only), loki-ts/tests/runner/npm_fallback_summary_failures.test.ts (new) | HIGH | cd loki-ts && bun test tests/runner/npm_fallback_summary_failures.test.ts exits 0: jest Tests 1 failed, vitest Test Files 1 failed and pytest 1 passed 1 error all return passed false; Tests 3 passed returns passed true; removing the parse fails the first three | building@2026-09-27T20:12Z | Source: 19:57Z cut. Batch 7 (wf_a3ea2c8c-560), build then review. |
-| S-178 | BACKLOG 112: /api/cost reads tracker tokens without a USD total as a measured $0 and labels the model sonnet | dashboard/server.py (get_cost context-tracker fallback only), tests/dashboard/test_cost_tracker_fallback_unmeasured.py (new) | MEDIUM | python3 -m pytest -q tests/dashboard/test_cost_tracker_fallback_unmeasured.py passes (tokens without total_cost_usd give cost null; recorded 0.0 stays 0.0; no provider gives model unknown); reverting fails case 1; bash tests/moat/p7-no-fabricated-data.sh prints CASE P7.unmeasured-cost-never-zero PASS | building@2026-09-27T20:12Z | Source: 19:57Z cut. Batch 7 (wf_a3ea2c8c-560), build then review. |
-| S-179 | BACKLOG 106: loki cost puts 0.0 in place of unknown spend | autonomy/loki (cmd_cost only), tests/test-loki-cost-unmeasured.sh (new) | MEDIUM | bash tests/test-loki-cost-unmeasured.sh exits 0: cap 10 with no measured records gives --json used null and percent null; measured 2.50 gives 2.5 and 25.0; reverting fails the first leg | building@2026-09-27T20:12Z | Source: 19:57Z cut. Batch 7 (wf_a3ea2c8c-560), build then review. |
-| S-180 | BACKLOG 144: P7 helper-return arm misses class-method helpers | tests/moat/p7-no-fabricated-data.sh (helper-return arm only) | HIGH | bash tests/moat/p7-no-fabricated-data.sh prints PASS for every P7 case and flags the in-script class-method fixture; removing the method-head pattern lets the fixture through; tests/moat/cases.txt unchanged | building@2026-09-27T20:12Z | Source: 19:57Z cut. Batch 7 (wf_a3ea2c8c-560), build then review. |
-| S-181 | GUARDS 11: v10-guard blocks a glob rm whose parent is a shared root (/tmp, TMPDIR, scratchpad) | scripts/v10-guard.sh (Rule 4 region only), tests/test-v10-guard.sh, docs/v10/GUARDS.md (section 11 only) | MEDIUM | bash tests/test-v10-guard.sh exits 0 with rm -f /tmp/*.log and rm -f scratchpad/* blocked and rm -f /tmp/run-1/*.log allowed; dropping the new rule fails the blocked cases | building@2026-09-27T20:12Z | Source: 19:57Z cut. Batch 7 (wf_a3ea2c8c-560), build then review. |
-| S-182 | docs/exit-codes.md omits the pending loki verify codes (verify --fast exits 0 on INCONCLUSIVE until v10.0.0) | docs/exit-codes.md (loki verify section only) | LOW | bash tests/test-exit-codes-documented.sh exits 0; grep -n P2.fast-verify-inconclusive-not-zero docs/exit-codes.md prints one line; the four measured codes appear in the report with their commands | ready@2026-09-27T19:57Z | Source: 19:57Z cut. |
-| S-183 | BACKLOG 114: migration dashboard renders a failed load as No migration data available | dashboard-ui/components/loki-migration-dashboard.js (error render branch only), dashboard-ui/tests/loki-migration-dashboard-fetch-error.node.test.mjs (new) | LOW | node --test dashboard-ui/tests/loki-migration-dashboard-fetch-error.node.test.mjs passes: a rejected fetch renders Could not load and lacks the empty-state sentence; an empty list still renders No migrations found | building@2026-09-27T20:12Z | Source: 19:57Z cut. Batch 7 (wf_a3ea2c8c-560), build then review. |
-| S-184 | BACKLOG 114: managed memory panel ignores a 200 events payload carrying error | dashboard-ui/components/loki-managed-memory-panel.js (events load only), dashboard-ui/tests/loki-managed-memory-events-error.node.test.mjs (new) | LOW | node --test dashboard-ui/tests/loki-managed-memory-events-error.node.test.mjs passes: the error payload renders the error line and not the empty sentence; events [] with no error still renders the empty sentence | building@2026-09-27T20:12Z | Source: 19:57Z cut. Batch 7 (wf_a3ea2c8c-560), build then review. |
-| S-185 | BACKLOG 114: DeployConnections rows read Not connected under their own load error | web-app/src/components/DeployConnections.tsx (row status render only), web-app/src/components/DeployConnections.state.test.mjs (new) | LOW | node --test web-app/src/components/DeployConnections.state.test.mjs passes: no row reads Not connected after a failed fetch; a real connected false still does; cd web-app && npx tsc -b exits 0 | building@2026-09-27T20:12Z | Source: 19:57Z cut. Batch 7 (wf_a3ea2c8c-560), build then review. |
-| S-186 | BACKLOG 116: issue list comment count never shows (gh sends comments as an array) | web-app/src/components/GitHubIssuesPanel.tsx (list comment badge only), web-app/src/types/api.ts (GitHubIssue.comments only), web-app/src/components/GitHubIssuesPanel.comments.test.mjs (new) | LOW | node --test web-app/src/components/GitHubIssuesPanel.comments.test.mjs passes: array of 2 renders 2, number 3 renders 3; cd web-app && npx tsc -b exits 0 | building@2026-09-27T20:12Z | Source: 19:57Z cut. Batch 7 (wf_a3ea2c8c-560), build then review. |
-| S-187 | BACKLOG 118: CostEstimator prices the whole iteration cap as the estimate | web-app/src/components/ProjectWorkspace.tsx (CostEstimator props only), web-app/src/components/CostEstimator.tsx (export only if needed), web-app/src/components/CostEstimator.estimate.test.mjs (new) | LOW | node --test web-app/src/components/CostEstimator.estimate.test.mjs passes; grep -n 'estimatedIterations={buildStatus.maxIterations' web-app/src/components/ProjectWorkspace.tsx exits 1; cd web-app && npx tsc -b exits 0 | building@2026-09-27T20:12Z | Source: 19:57Z cut. Batch 7 (wf_a3ea2c8c-560), build then review. |
-| S-188 | BACKLOG 123: overview proof card wording has no test of its own | dashboard-ui/tests/loki-overview-proof-card.node.test.mjs (new) | LOW | node --test dashboard-ui/tests/loki-overview-proof-card.node.test.mjs passes: no proof reads Not evaluated, a headline carries the recorded-copy prefix, gaps null reads uncertainty not measured; deleting the prefix in a scratch copy fails it | building@2026-09-27T20:12Z | Source: 19:57Z cut. Batch 7 (wf_a3ea2c8c-560), build then review. |
-| S-189 | BACKLOG 114: learning dashboard renders failed metrics and trends reads as no data | dashboard-ui/components/loki-learning-dashboard.js (metrics and trends load plus their two empty branches only), dashboard-ui/tests/loki-learning-dashboard-fetch-error.node.test.mjs (new) | LOW | node --test dashboard-ui/tests/loki-learning-dashboard-fetch-error.node.test.mjs passes: rejected metrics and trends render Could not load; an empty trends response still renders No trend data available | building@2026-09-27T20:12Z | Source: 19:57Z cut. Batch 7 (wf_a3ea2c8c-560), build then review. |
-| S-190 | BACKLOG 112: R3 design doc describes project_total_usd as a plain sum | docs/R3-COST-OBSERVABILITY-DESIGN.md | LOW | grep -n 'sum of per-run proof costs' docs/R3-COST-OBSERVABILITY-DESIGN.md exits 1; grep -n project_total_partial docs/R3-COST-OBSERVABILITY-DESIGN.md prints at least one line | ready@2026-09-27T19:57Z | Source: 19:57Z cut. |
-| S-191 | Velocity: test-review-assurance-tail.sh (116s) under 60s by running independent cases concurrently, budgets unchanged | tests/test-review-assurance-tail.sh | MEDIUM | time LOKI_TEST_SHARD=0/8 bash tests/test-review-assurance-tail.sh exits 0 with real under 60s and the same pass-count line as the pre-change capture; both timings reported | ready@2026-09-27T19:57Z | Source: 19:57Z cut. |
-| S-192 | BACKLOG 112: no test drives the web-app WebSocket status push payload for unmeasured cost | web-app/tests/test_status_push_unmeasured.py (new), web-app/server.py (lift the nested status reader only if needed) | MEDIUM | python3 -m pytest -q web-app/tests/test_status_push_unmeasured.py passes: no tokens gives cost null and max_iterations null, priced tokens give a number; forcing 0.0 in a scratch copy fails case 1 | ready@2026-09-27T19:57Z | Source: 19:57Z cut. |
-| S-193 | Velocity: v10-ops worktree-budget prints how many worktrees a batch may open before dispatch | scripts/v10-ops.sh (new worktree-budget subcommand), tests/test-v10-ops.sh | LOW | bash tests/test-v10-ops.sh exits 0; scripts/v10-ops.sh worktree-budget 15 prints 15 minus the .claude/worktrees entries in git worktree list --porcelain, and at or over the cap prints 0 and exits 1 | ready@2026-09-27T19:57Z | Source: 19:57Z cut. |
+| S-154 | GUARDS 5 + TODO 8: prune-worktrees.sh treats a cherry-picked branch (git cherry, no + lines) as merged; test forbids mtime signals | scripts/prune-worktrees.sh, tests/test-prune-worktrees.sh (new) | MEDIUM | bash tests/test-prune-worktrees.sh exits 0; cherry-picked fixture listed, one-unique-commit, locked and dirty fixtures kept; dropping the git cherry branch fails the case | released@2026-09-27T20:13Z | Removes worktrees only via git worktree remove. Captain registers the test. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on a41e625f; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). Published in v9.72.0 (`npm view loki-mode version` = 9.72.0; npm time 20:13Z). |
+| S-155 | Velocity: reachability scan (95s on CI, 47s local) under 10s via a per-module stem prefilter, identical verdicts | tests/lib/scan-unreachable-shipped.py | LOW | scan wall time under 10s; stdout and rc byte-identical to the pre-change capture; bash tests/test-no-unreachable-shipped.sh 4 passed 0 failed; removing one real require is still reported | released@2026-09-27T20:13Z | Builder measures regex vs I/O first and records both numbers. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on 3f786ce0; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). Published in v9.72.0 (`npm view loki-mode version` = 9.72.0; npm time 20:13Z). |
+| S-156 | BACKLOG 127 remainder: auto-capture shadow_write runs with PROJECT_DIR unset, and float() splices episode importance into python source | autonomy/run.sh (shadow_write auto-capture block about 21380-21396 only), tests/test-autocapture-shadow-write-guard.sh (new) | HIGH | bash tests/test-autocapture-shadow-write-guard.sh exits 0 under /bin/bash and bash 5; no marker from a planted cwd memory package; no file from an injected importance; trust-core suite passes | released@2026-09-27T20:13Z | Builder names who writes episode_path_file. Only run.sh row in this cut. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on 71d7a246; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). Published in v9.72.0 (`npm view loki-mode version` = 9.72.0; npm time 20:13Z). |
+| S-157 | BACKLOG 98/89: council member vote and _council_convergence_evidence_green read pass:true as green whatever failed_count says | autonomy/completion-council.sh (those 2 parsers only), tests/test-council-failed-count-honesty.sh (new) | HIGH | pass:true with failed_count 2 is not green at both sites; failed_count 0 stays green; trust-core and convergence-floor suites pass; reverting either site fails its case | released@2026-09-27T20:24Z | Mirrors the evidence gate rule (~2014). Only completion-council.sh row in this cut. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. 7a709fde (HIGH review APPROVE); in train 12, main ec01d54b pushed 20:05:58 (`git ls-remote origin refs/heads/main` = ec01d54b). Published in v9.73.0 (`npm view loki-mode version` = 9.73.0; npm time 2026-09-27T20:24Z). |
+| S-158 | BACKLOG 118: per-run cost_partial dropped by /api/cost/timeline runs[] and /api/proofs; pages show a lower bound as a total | dashboard/server.py (runs.append in _compute_cost_timeline and the /api/proofs row only), dashboard/static/cost.html, dashboard/static/proofs.html, tests/dashboard/test_cost_partial_surfaced.py (new) | MEDIUM | pytest test_cost_partial_surfaced.py passes; fixture cost_partial true surfaces in both endpoints and renders as at least $X; dropping the key fails | released@2026-09-27T20:13Z | Builder names the consumers checked. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on 931a93b6; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). Published in v9.72.0 (`npm view loki-mode version` = 9.72.0; npm time 20:13Z). |
+| S-159 | BACKLOG 114: NLSearch renders No results found when the search request failed | web-app/src/components/NLSearch.tsx, web-app/src/components/NLSearch.state.test.mjs (new) | LOW | node --test NLSearch.state.test.mjs passes incl. the negative assertion; npx tsc -b exits 0 | released@2026-09-27T20:13Z | Captain rebuilds web-app/dist. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on ea5b4462; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). Published in v9.72.0 (`npm view loki-mode version` = 9.72.0; npm time 20:13Z). |
+| S-160 | BACKLOG 114: CommandPalette file-search failure reads as No results found | web-app/src/components/CommandPalette.tsx, web-app/src/components/CommandPalette.state.test.mjs (new) | LOW | node --test CommandPalette.state.test.mjs passes; npx tsc -b exits 0 | released@2026-09-27T20:13Z | Captain rebuilds web-app/dist. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on 3f9873f3; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). Published in v9.72.0 (`npm view loki-mode version` = 9.72.0; npm time 20:13Z). |
+| S-161 | BACKLOG 114: ProjectsPage ignores usePolling error and says No projects yet on a failed fetch | web-app/src/pages/ProjectsPage.tsx, web-app/src/pages/ProjectsPage.state.test.mjs (new) | LOW | node --test ProjectsPage.state.test.mjs passes (error, stale-data and real-empty cases); npx tsc -b exits 0 | released@2026-09-27T20:13Z | Captain rebuilds web-app/dist. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on d2dd3645; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). Published in v9.72.0 (`npm view loki-mode version` = 9.72.0; npm time 20:13Z). |
+| S-162 | BACKLOG 114: SecretsPanel and DocsPanel swallow fetch errors into No secrets / No documentation empty states | web-app/src/components/ProjectWorkspace.tsx (SecretsPanel and DocsPanel fetch and empty branches only), web-app/src/components/ProjectWorkspace.panels.test.mjs (new) | LOW | node --test ProjectWorkspace.panels.test.mjs passes; npx tsc -b exits 0 | released@2026-09-27T20:13Z | Captain rebuilds web-app/dist. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on 6f6a6207; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). Published in v9.72.0 (`npm view loki-mode version` = 9.72.0; npm time 20:13Z). |
+| S-163 | BACKLOG 114: CICDPanel maps neutral/action_required/stale/null conclusions to Failed and unknown statuses to running | web-app/src/components/CICDPanel.tsx (3 normalizers and status map only), web-app/src/components/CICDPanel.status.test.mjs (new) | LOW | node --test CICDPanel.status.test.mjs passes for every conclusion; npx tsc -b exits 0 | released@2026-09-27T20:13Z | Captain rebuilds web-app/dist. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on 36052758; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). Published in v9.72.0 (`npm view loki-mode version` = 9.72.0; npm time 20:13Z). |
+| S-164 | BACKLOG 114: AIChatPanel prints Done. for a non-zero exit with no output | web-app/src/components/AIChatPanel.tsx (the two Done. fallbacks only), web-app/src/components/AIChatPanel.result.test.mjs (new) | LOW | node --test AIChatPanel.result.test.mjs passes; npx tsc -b exits 0 | released@2026-09-27T20:13Z | Captain rebuilds web-app/dist. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on 8aceef56; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). Published in v9.72.0 (`npm view loki-mode version` = 9.72.0; npm time 20:13Z). |
+| S-165 | BACKLOG 117 remainder: TrustedBy asserts Trusted by developers; ChangelogWidget shows March 2026 v6.x as Recent Changes | web-app/src/components/TrustedBy.tsx, web-app/src/components/ChangelogWidget.tsx | LOW | grep for Trusted by developers and 6.71.1 in those files returns rc 1; npx tsc -b exits 0 | released@2026-09-27T20:13Z | Copy only. Captain rebuilds web-app/dist. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on 97ba623f; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). Published in v9.72.0 (`npm view loki-mode version` = 9.72.0; npm time 20:13Z). |
+| S-166 | BACKLOG 114: checkpoint viewer ignores a rejected allSettled fetch and clears the error | dashboard-ui/components/loki-checkpoint-viewer.js (load block only), dashboard-ui/tests/loki-checkpoint-viewer-fetch-error.node.test.mjs (new) | LOW | node --test the new file passes incl. the negative assertion | released@2026-09-27T20:13Z | Captain rebuilds dashboard/static/index.html. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on 4035d21d; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). Published in v9.72.0 (`npm view loki-mode version` = 9.72.0; npm time 20:13Z). |
+| S-167 | BACKLOG 114: council transcripts render a failed hook-events read as zero events | dashboard-ui/components/loki-council-transcripts.js (hook events load only), dashboard-ui/tests/loki-council-transcripts-fetch-error.node.test.mjs (new) | LOW | node --test the new file passes | released@2026-09-27T20:13Z | Captain rebuilds dashboard/static/index.html. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on 3fea74e8; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). Published in v9.72.0 (`npm view loki-mode version` = 9.72.0; npm time 20:13Z). |
+| S-168 | BACKLOG 114: task board hides a server load error whenever local tasks exist | dashboard-ui/components/loki-task-board.js (catch and error render only), dashboard-ui/tests/loki-task-board-fetch-error.node.test.mjs (new) | LOW | node --test the new file passes; loki-task-board-modal-guard test still passes | released@2026-09-27T20:13Z | Captain rebuilds dashboard/static/index.html. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on aa2a64a4; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). Published in v9.72.0 (`npm view loki-mode version` = 9.72.0; npm time 20:13Z). |
+| S-169 | BACKLOG 114: log stream swallows API failures with an empty catch | dashboard-ui/components/loki-log-stream.js (API poll catch and empty render only), dashboard-ui/tests/loki-log-stream-fetch-error.node.test.mjs (new) | LOW | node --test the new file passes; loki-poll-registry test still passes | released@2026-09-27T20:24Z | Captain rebuilds dashboard/static/index.html. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. a990a9ce review REJECT; rework dispatched 19:57Z. 707283f3 (re-review APPROVE, runner lists 598 = main + 1); in train 12, main ec01d54b pushed 20:05:58 (`git ls-remote origin refs/heads/main` = ec01d54b). Published in v9.73.0 (`npm view loki-mode version` = 9.73.0; npm time 2026-09-27T20:24Z). |
+| S-170 | BACKLOG 114: API keys panel renders No API keys configured under its own load-error banner | dashboard-ui/components/loki-api-keys.js (table branch only), dashboard-ui/tests/loki-api-keys-fetch-error.node.test.mjs (new) | LOW | node --test the new file passes; error render lacks the empty-state sentence | released@2026-09-27T20:13Z | Captain rebuilds dashboard/static/index.html. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on ab837a75; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). Published in v9.72.0 (`npm view loki-mode version` = 9.72.0; npm time 20:13Z). |
+| S-171 | BACKLOG 124: lint for response fields interpolated into innerHTML without the escape helper | tests/test-no-unescaped-innerhtml.sh (new), tests/lib/scan-unescaped-innerhtml.py (new) | MEDIUM | passes on main with a reasoned in-file allowlist; planted fixture exits 1; empty-reason entry fails; at least 20 files scanned | released@2026-09-27T20:24Z | Any real XSS found is reported only; repairs go to separate slices. Captain registers. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. db501eba (review APPROVE); in train 12, main ec01d54b pushed 20:05:58 (`git ls-remote origin refs/heads/main` = ec01d54b). Published in v9.73.0 (`npm view loki-mode version` = 9.73.0; npm time 2026-09-27T20:24Z). |
+| S-172 | BACKLOG 132: shadow-write mutant check is green on bash 5.3 and red on /bin/bash 3.2 | tests/test-council-shadow-write-project-dir.sh | LOW | bash tests/test-council-shadow-write-project-dir.sh exits 0; mutant leg red under both /bin/bash and PATH bash, both versions printed | released@2026-09-27T20:13Z | Test-only. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on e2114d09; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). Published in v9.72.0 (`npm view loki-mode version` = 9.72.0; npm time 20:13Z). |
+| S-173 | BACKLOG 135: P2.council-readers-not-shadowed does not drive council_managed_should_stop (cwd-shadow class only) | tests/moat/p2-honest-verdict.sh (that case only) | HIGH | p2-honest-verdict.sh prints CASE P2.council-readers-not-shadowed PASS; removing the sys.path filter in a scratch copy prints FAIL | released@2026-09-27T20:13Z | No .pth leg: that reader is still python3 -E, so a .pth leg would redden a proven case; follows alternate A2. Source: 19:10Z cut. Batch 6 (wf_3510293b-09b), build then review. Review APPROVE on 6bc4b5cf; in train 11, main 2a024770 pushed 19:56:04 (`git ls-remote origin refs/heads/main` = 2a024770). Published in v9.72.0 (`npm view loki-mode version` = 9.72.0; npm time 20:13Z). |
+| S-174 | Guard: run_test with a missing or empty argument stops run-all-tests.sh with no summary and skips later suites | tests/run-all-tests.sh (run_test guard and missing-script return only), tests/test-run-all-missing-arg.sh (new) | MEDIUM | bash tests/test-run-all-missing-arg.sh exits 0 with Failed: 1 per leg (one-arg, empty-arg, missing-script) and the later stub's PASSED line printed; guard removed in a scratch copy exits 1; bash tests/test-run-all-dispatch.sh and LOKI_TEST_LIST=1 bash tests/test-shard-coverage.sh exit 0 | merged@2026-09-27T20:35Z | Source: 19:57Z cut. Batch 7 (wf_a3ea2c8c-560), build then review. Review APPROVE on a9793dd4; in train 13, main 28e62e44 pushed 20:35:00 (`git ls-remote origin refs/heads/main` = 28e62e44). |
+| S-175 | BACKLOG 62: a whitelist-rejected LOKI_MONOREPO_TEST_CMD records pass true and touches unit-tests.pass | autonomy/run.sh (enforce_test_coverage monorepo-custom-rejected branch only), tests/test-monorepo-rejected-cmd-inconclusive.sh (new) | HIGH | bash tests/test-monorepo-rejected-cmd-inconclusive.sh exits 0: pass is "inconclusive", status not_run, no unit-tests.pass; reverting the branch exits 1; bash tests/test-trust-core-tests-detect.sh exits 0 | merged@2026-09-27T20:35Z | Source: 19:57Z cut. Batch 7 (wf_a3ea2c8c-560), build then review. Review APPROVE on 1fe8b6a3; in train 13, main 28e62e44 pushed 20:35:00 (`git ls-remote origin refs/heads/main` = 28e62e44). |
+| S-176 | BACKLOG 98: proof headline reads a stale test-results.json (_collect_tests has no .test-results.iter check) | autonomy/lib/proof-generator.py (_collect_tests only), tests/test_proof_tests_freshness.py (new) | HIGH | python3 -m pytest -q tests/test_proof_tests_freshness.py passes: ITERATION_COUNT=5 with marker 4 gives facts.tests.status not_run and a headline unlike the fresh case; marker 5 keeps the prior status; removing the check fails the stale case | merged@2026-09-27T20:35Z | Source: 19:57Z cut. Batch 7 (wf_a3ea2c8c-560), build then review. Review APPROVE on 4890459d; in train 13, main 28e62e44 pushed 20:35:00 (`git ls-remote origin refs/heads/main` = 28e62e44). |
+| S-177 | BACKLOG 98: Bun npm-test fallback reads an exit-0 run that prints failures as passed | loki-ts/src/runner/quality_gates.ts (runTestCoverage npm fallback only), loki-ts/tests/runner/npm_fallback_summary_failures.test.ts (new) | HIGH | cd loki-ts && bun test tests/runner/npm_fallback_summary_failures.test.ts exits 0: jest Tests 1 failed, vitest Test Files 1 failed and pytest 1 passed 1 error all return passed false; Tests 3 passed returns passed true; removing the parse fails the first three | merged@2026-09-27T20:35Z | Source: 19:57Z cut. Batch 7 (wf_a3ea2c8c-560), build then review. Review APPROVE on 19174010; in train 13, main 28e62e44 pushed 20:35:00 (`git ls-remote origin refs/heads/main` = 28e62e44). |
+| S-178 | BACKLOG 112: /api/cost reads tracker tokens without a USD total as a measured $0 and labels the model sonnet | dashboard/server.py (get_cost context-tracker fallback only), tests/dashboard/test_cost_tracker_fallback_unmeasured.py (new) | MEDIUM | python3 -m pytest -q tests/dashboard/test_cost_tracker_fallback_unmeasured.py passes (tokens without total_cost_usd give cost null; recorded 0.0 stays 0.0; no provider gives model unknown); reverting fails case 1; bash tests/moat/p7-no-fabricated-data.sh prints CASE P7.unmeasured-cost-never-zero PASS | merged@2026-09-27T20:35Z | Source: 19:57Z cut. Batch 7 (wf_a3ea2c8c-560), build then review. Review APPROVE on e80a0a5c; in train 13, main 28e62e44 pushed 20:35:00 (`git ls-remote origin refs/heads/main` = 28e62e44). |
+| S-179 | BACKLOG 106: loki cost puts 0.0 in place of unknown spend | autonomy/loki (cmd_cost only), tests/test-loki-cost-unmeasured.sh (new) | MEDIUM | bash tests/test-loki-cost-unmeasured.sh exits 0: cap 10 with no measured records gives --json used null and percent null; measured 2.50 gives 2.5 and 25.0; reverting fails the first leg | merged@2026-09-27T20:35Z | Source: 19:57Z cut. Batch 7 (wf_a3ea2c8c-560), build then review. Review APPROVE on 3f0dff83; in train 13, main 28e62e44 pushed 20:35:00 (`git ls-remote origin refs/heads/main` = 28e62e44). |
+| S-180 | BACKLOG 144: P7 helper-return arm misses class-method helpers | tests/moat/p7-no-fabricated-data.sh (helper-return arm only) | HIGH | bash tests/moat/p7-no-fabricated-data.sh prints PASS for every P7 case and flags the in-script class-method fixture; removing the method-head pattern lets the fixture through; tests/moat/cases.txt unchanged | merged@2026-09-27T20:35Z | Source: 19:57Z cut. Batch 7 (wf_a3ea2c8c-560), build then review. Review APPROVE on e8d30a0b; in train 13, main 28e62e44 pushed 20:35:00 (`git ls-remote origin refs/heads/main` = 28e62e44). |
+| S-181 | GUARDS 11: v10-guard blocks a glob rm whose parent is a shared root (/tmp, TMPDIR, scratchpad) | scripts/v10-guard.sh (Rule 4 region only), tests/test-v10-guard.sh, docs/v10/GUARDS.md (section 11 only) | MEDIUM | bash tests/test-v10-guard.sh exits 0 with rm -f /tmp/*.log and rm -f scratchpad/* blocked and rm -f /tmp/run-1/*.log allowed; dropping the new rule fails the blocked cases | building@2026-09-27T20:36Z | Source: 19:57Z cut. Batch 7 (wf_a3ea2c8c-560), build then review. 692ec781 review CONCERN (relative glob in scratchpad root); rework 310d2fed, re-review in batch 8 (wf_ff8d537c-40e). |
+| S-182 | docs/exit-codes.md omits the pending loki verify codes (verify --fast exits 0 on INCONCLUSIVE until v10.0.0) | docs/exit-codes.md (loki verify section only) | LOW | bash tests/test-exit-codes-documented.sh exits 0; grep -n P2.fast-verify-inconclusive-not-zero docs/exit-codes.md prints one line; the four measured codes appear in the report with their commands | building@2026-09-27T20:36Z | Source: 19:57Z cut. Batch 8 (wf_ff8d537c-40e), build then review. |
+| S-183 | BACKLOG 114: migration dashboard renders a failed load as No migration data available | dashboard-ui/components/loki-migration-dashboard.js (error render branch only), dashboard-ui/tests/loki-migration-dashboard-fetch-error.node.test.mjs (new) | LOW | node --test dashboard-ui/tests/loki-migration-dashboard-fetch-error.node.test.mjs passes: a rejected fetch renders Could not load and lacks the empty-state sentence; an empty list still renders No migrations found | merged@2026-09-27T20:35Z | Source: 19:57Z cut. Batch 7 (wf_a3ea2c8c-560), build then review. Review APPROVE on 1f0dd435; in train 13, main 28e62e44 pushed 20:35:00 (`git ls-remote origin refs/heads/main` = 28e62e44). |
+| S-184 | BACKLOG 114: managed memory panel ignores a 200 events payload carrying error | dashboard-ui/components/loki-managed-memory-panel.js (events load only), dashboard-ui/tests/loki-managed-memory-events-error.node.test.mjs (new) | LOW | node --test dashboard-ui/tests/loki-managed-memory-events-error.node.test.mjs passes: the error payload renders the error line and not the empty sentence; events [] with no error still renders the empty sentence | merged@2026-09-27T20:35Z | Source: 19:57Z cut. Batch 7 (wf_a3ea2c8c-560), build then review. Review APPROVE on 13a33840; in train 13, main 28e62e44 pushed 20:35:00 (`git ls-remote origin refs/heads/main` = 28e62e44). |
+| S-185 | BACKLOG 114: DeployConnections rows read Not connected under their own load error | web-app/src/components/DeployConnections.tsx (row status render only), web-app/src/components/DeployConnections.state.test.mjs (new) | LOW | node --test web-app/src/components/DeployConnections.state.test.mjs passes: no row reads Not connected after a failed fetch; a real connected false still does; cd web-app && npx tsc -b exits 0 | merged@2026-09-27T20:35Z | Source: 19:57Z cut. Batch 7 (wf_a3ea2c8c-560), build then review. Review APPROVE on d88c64ac; in train 13, main 28e62e44 pushed 20:35:00 (`git ls-remote origin refs/heads/main` = 28e62e44). |
+| S-186 | BACKLOG 116: issue list comment count never shows (gh sends comments as an array) | web-app/src/components/GitHubIssuesPanel.tsx (list comment badge only), web-app/src/types/api.ts (GitHubIssue.comments only), web-app/src/components/GitHubIssuesPanel.comments.test.mjs (new) | LOW | node --test web-app/src/components/GitHubIssuesPanel.comments.test.mjs passes: array of 2 renders 2, number 3 renders 3; cd web-app && npx tsc -b exits 0 | merged@2026-09-27T20:35Z | Source: 19:57Z cut. Batch 7 (wf_a3ea2c8c-560), build then review. Review APPROVE on 3817c6f3; in train 13, main 28e62e44 pushed 20:35:00 (`git ls-remote origin refs/heads/main` = 28e62e44). |
+| S-187 | BACKLOG 118: CostEstimator prices the whole iteration cap as the estimate | web-app/src/components/ProjectWorkspace.tsx (CostEstimator props only), web-app/src/components/CostEstimator.tsx (export only if needed), web-app/src/components/CostEstimator.estimate.test.mjs (new) | LOW | node --test web-app/src/components/CostEstimator.estimate.test.mjs passes; grep -n 'estimatedIterations={buildStatus.maxIterations' web-app/src/components/ProjectWorkspace.tsx exits 1; cd web-app && npx tsc -b exits 0 | merged@2026-09-27T20:35Z | Source: 19:57Z cut. Batch 7 (wf_a3ea2c8c-560), build then review. Review APPROVE on d03a237e; in train 13, main 28e62e44 pushed 20:35:00 (`git ls-remote origin refs/heads/main` = 28e62e44). |
+| S-188 | BACKLOG 123: overview proof card wording has no test of its own | dashboard-ui/tests/loki-overview-proof-card.node.test.mjs (new) | LOW | node --test dashboard-ui/tests/loki-overview-proof-card.node.test.mjs passes: no proof reads Not evaluated, a headline carries the recorded-copy prefix, gaps null reads uncertainty not measured; deleting the prefix in a scratch copy fails it | merged@2026-09-27T20:35Z | Source: 19:57Z cut. Batch 7 (wf_a3ea2c8c-560), build then review. Review APPROVE on 6d965cca; in train 13, main 28e62e44 pushed 20:35:00 (`git ls-remote origin refs/heads/main` = 28e62e44). |
+| S-189 | BACKLOG 114: learning dashboard renders failed metrics and trends reads as no data | dashboard-ui/components/loki-learning-dashboard.js (metrics and trends load plus their two empty branches only), dashboard-ui/tests/loki-learning-dashboard-fetch-error.node.test.mjs (new) | LOW | node --test dashboard-ui/tests/loki-learning-dashboard-fetch-error.node.test.mjs passes: rejected metrics and trends render Could not load; an empty trends response still renders No trend data available | merged@2026-09-27T20:35Z | Source: 19:57Z cut. Batch 7 (wf_a3ea2c8c-560), build then review. Review APPROVE on a746655f; in train 13, main 28e62e44 pushed 20:35:00 (`git ls-remote origin refs/heads/main` = 28e62e44). |
+| S-190 | BACKLOG 112: R3 design doc describes project_total_usd as a plain sum | docs/R3-COST-OBSERVABILITY-DESIGN.md | LOW | grep -n 'sum of per-run proof costs' docs/R3-COST-OBSERVABILITY-DESIGN.md exits 1; grep -n project_total_partial docs/R3-COST-OBSERVABILITY-DESIGN.md prints at least one line | building@2026-09-27T20:36Z | Source: 19:57Z cut. Batch 8 (wf_ff8d537c-40e), build then review. |
+| S-191 | Velocity: test-review-assurance-tail.sh (116s) under 60s by running independent cases concurrently, budgets unchanged | tests/test-review-assurance-tail.sh | MEDIUM | time LOKI_TEST_SHARD=0/8 bash tests/test-review-assurance-tail.sh exits 0 with real under 60s and the same pass-count line as the pre-change capture; both timings reported | building@2026-09-27T20:36Z | Source: 19:57Z cut. Batch 8 (wf_ff8d537c-40e), build then review. |
+| S-192 | BACKLOG 112: no test drives the web-app WebSocket status push payload for unmeasured cost | web-app/tests/test_status_push_unmeasured.py (new), web-app/server.py (lift the nested status reader only if needed) | MEDIUM | python3 -m pytest -q web-app/tests/test_status_push_unmeasured.py passes: no tokens gives cost null and max_iterations null, priced tokens give a number; forcing 0.0 in a scratch copy fails case 1 | building@2026-09-27T20:36Z | Source: 19:57Z cut. Batch 8 (wf_ff8d537c-40e), build then review. |
+| S-193 | Velocity: v10-ops worktree-budget prints how many worktrees a batch may open before dispatch | scripts/v10-ops.sh (new worktree-budget subcommand), tests/test-v10-ops.sh | LOW | bash tests/test-v10-ops.sh exits 0; scripts/v10-ops.sh worktree-budget 15 prints 15 minus the .claude/worktrees entries in git worktree list --porcelain, and at or over the cap prints 0 and exits 1 | building@2026-09-27T20:36Z | Source: 19:57Z cut. Batch 8 (wf_ff8d537c-40e), build then review. |
+| S-194 | BACKLOG 108: LOKI_AUTO_PR pushes a branch whose history still holds user files | autonomy/run.sh (create_session_pr only; does not overlap S-175 or S-195), tests/test-auto-pr-agent-committed-refuse.sh (new) | HIGH | bash tests/test-auto-pr-agent-committed-refuse.sh exits 0: auto path with a record makes no push, returns 1 and prints git reset --soft; advisory path prints the cleanup before git push -u; empty record pushes; removing the record read in a scratch copy fails leg 1; bash tests/test-trusted-push-agent-config.sh exits 0 | building@2026-09-27T20:36Z | Source: 20:12Z cut. Batch 8 (wf_ff8d537c-40e), build then review. |
+| S-195 | BACKLOG 17: /api/focus POST fires with the dashboard disabled | autonomy/run.sh (dashboard focus notify block only; does not overlap S-175 or S-194), tests/test-focus-post-dashboard-off.sh (new) | MEDIUM | bash tests/test-focus-post-dashboard-off.sh exits 0: ENABLE_DASHBOARD=false leaves the curl shim log empty, true records one POST; removing the guard in a scratch copy fails the false leg | building@2026-09-27T20:36Z | Source: 20:12Z cut. Batch 8 (wf_ff8d537c-40e), build then review. |
+| S-196 | council_managed_should_stop diffs Loki's install tree and runs -E readers | autonomy/completion-council.sh (council_managed_should_stop only), tests/moat/p2-honest-verdict.sh (case_council_readers_no_user_site_pth plus the ~858 comment), tests/test-council-managed-diff-target.sh (new) | HIGH | bash tests/moat/p2-honest-verdict.sh prints CASE P2.council-readers-no-user-site-pth PASS and CASE P2.council-readers-not-shadowed PASS; bash tests/test-council-managed-diff-target.sh exits 0 with the target-only file in _CC_DIFF; reverting the readers to -E makes the pth case FAIL; bash tests/moat/run.sh reports no rule failed | building@2026-09-27T20:36Z | Source: 20:12Z cut. Batch 8 (wf_ff8d537c-40e), build then review. |
+| S-197 | BACKLOG 51: NOT CHECKED text should name PYTHONPATH and PYTHONUSERBASE | autonomy/loki (loki_remote_verify_receipt attestation NOT CHECKED branch and cmd_proof --jwks NOT CHECKED echo only; does not overlap S-179), tests/test-proof-verify-jwks.sh (case 4 only) | LOW | bash tests/test-proof-verify-jwks.sh exits 0 with case 4 asserting PYTHONUSERBASE in the NOT CHECKED output; grep -c PYTHONUSERBASE autonomy/loki prints 2 or more; bash tests/test-remote-attestation-verdict.sh exits 0 | building@2026-09-27T20:36Z | Source: 20:12Z cut. Batch 8 (wf_ff8d537c-40e), build then review. |
+| S-198 | BACKLOG 145: P7 Array.from arm loses an outer generator's index when generators nest | tests/moat/p7-no-fabricated-data.sh (Array.from generator arm ~1934-1994 and one fixture beside the B-8 fixture ~3301 only; does not overlap S-180) | HIGH | bash tests/moat/p7-no-fabricated-data.sh prints PASS for every P7 case and flags the nested fixture; removing the outer substitution lets it through; tests/moat/cases.txt unchanged | ready@2026-09-27T20:12Z | Source: 20:12Z cut. |
+| S-199 | py-tool identity test covers every guarded _loki_snapshot_py_tool copy under autonomy/ | tests/test-council-py-tool-identity.sh | LOW | bash tests/test-council-py-tool-identity.sh exits 0 and prints the number of copies compared (at least 1 besides run.sh); a one-byte change to completion-council.sh's copy in a scratch tree exits 1 | building@2026-09-27T20:36Z | Source: 20:12Z cut. Batch 8 (wf_ff8d537c-40e), build then review. |
+| S-200 | BACKLOG 54: done-recognition readers load user-site .pth (-E only) | autonomy/lib/done-recognition.sh (python3 sites plus guarded helper copy), tests/test-done-recognition-no-user-site-pth.sh (new) | HIGH | bash tests/test-done-recognition-no-user-site-pth.sh exits 0 and reverting one site to -E in a scratch copy fails it; bash tests/test-done-recognition-tests-axis.sh and bash tests/test-reuse-done-recognition.sh exit 0 | building@2026-09-27T20:36Z | Source: 20:12Z cut. Batch 8 (wf_ff8d537c-40e), build then review. |
+| S-201 | BACKLOG 54: council-v2 readers load .pth; a crashed sycophancy check skips the devil's advocate | autonomy/council-v2.sh (python3 sites, Step 4 and 5 fallbacks, guarded helper copy), tests/test-council-v2-no-user-site-pth.sh (new) | MEDIUM | bash tests/test-council-v2-no-user-site-pth.sh exits 0 (pth leg and detector-failure leg run the devil's advocate on a unanimous approve); reverting either change fails its leg; bash tests/test-council-v2-quorum.sh exits 0 | building@2026-09-27T20:36Z | Source: 20:12Z cut. Batch 8 (wf_ff8d537c-40e), build then review. |
+| S-202 | BACKLOG 54: voter-agents readers load user-site .pth (-E only) | autonomy/lib/voter-agents.sh (3 python3 sites plus guarded helper copy), tests/test-voter-agents-no-user-site-pth.sh (new) | HIGH | bash tests/test-voter-agents-no-user-site-pth.sh exits 0 and reverting fails it; bash tests/test-voter-agents-json.sh and bash tests/test-sdk-voter-agents.sh exit 0 | ready@2026-09-27T20:12Z | Source: 20:12Z cut. |
+| S-203 | BACKLOG 54: proof-check readers load user-site .pth (-E only) | autonomy/lib/proof-check.sh (3 heredoc readers plus guarded helper copy), tests/test-proof-check-no-user-site-pth.sh (new) | MEDIUM | bash tests/test-proof-check-no-user-site-pth.sh exits 0 and reverting fails it; bash tests/test-proven-pr-check.sh exits 0 | ready@2026-09-27T20:12Z | Source: 20:12Z cut. |
+| S-204 | BACKLOG 53: checklist verification loads user-site .pth (-E only) | autonomy/prd-checklist.sh (python3 sites incl. checklist-verify.py call and oracle heredoc, plus guarded helper copy), tests/test-prd-checklist-no-user-site-pth.sh (new) | HIGH | bash tests/test-prd-checklist-no-user-site-pth.sh exits 0 and reverting fails it; bash tests/moat/p2-honest-verdict.sh prints CASE P2.checklist-verify-not-shadowed PASS; bash tests/test-prd-checklist-interval-w4.sh exits 0 | ready@2026-09-27T20:12Z | Source: 20:12Z cut. |
+| S-205 | Bun loki proof verify runs a PATH python3 -E (user-site .pth reaches the verdict) | loki-ts/src/commands/proof.ts (verifier spawn only), loki-ts/src/util/python.ts (extend existing helper only if used), loki-ts/tests/commands/proof_verify_interpreter.test.ts (new) | HIGH | cd loki-ts && bun test tests/commands/proof_verify_interpreter.test.ts tests/commands/proof_verify_parity.test.ts exits 0; reverting to python3 -E fails the new test; no resolvable interpreter exits 2 | ready@2026-09-27T20:12Z | Source: 20:12Z cut. |
+| S-206 | BACKLOG 114: cockpit actions say working tree is clean and no run in progress after a failed fetch | web-app/src/cockpit/FinalActions.tsx (disabled reasons only), web-app/src/cockpit/FinalActions.reasons.test.mjs (new) | LOW | node --test web-app/src/cockpit/FinalActions.reasons.test.mjs passes: git null lacks The working tree is clean and Nothing to push, status null lacks No run in progress, real data keeps both; cd web-app && npx tsc -b exits 0 | building@2026-09-27T20:36Z | Source: 20:12Z cut. Batch 8 (wf_ff8d537c-40e), build then review. |
+| S-207 | BACKLOG 114: cockpit evidence says No gate results recorded when the checklist request failed | web-app/src/cockpit/useCockpitState.ts (getChecklist via settle only), web-app/src/cockpit/EvidencePanel.tsx (empty branch only), web-app/src/cockpit/ExecutionCockpit.tsx (EvidencePanel props only), web-app/src/cockpit/EvidencePanel.state.test.mjs (new) | LOW | node --test web-app/src/cockpit/EvidencePanel.state.test.mjs passes: an error renders Could not load gate results, items [] keeps No gate results recorded; node web-app/src/cockpit/run-derive-view-test.mjs exits 0; cd web-app && npx tsc -b exits 0 | ready@2026-09-27T20:12Z | Source: 20:12Z cut. |
+| S-208 | BACKLOG 118: trust trajectory reads any non-pass council verdict as a failure | autonomy/lib/trust_trajectory.py (_verdict_is_pass only), tests/test_trust_trajectory_unknown_verdict.py (new) | MEDIUM | python3 -m pytest -q tests/test_trust_trajectory_unknown_verdict.py tests/test_trust_trajectory.py tests/dashboard/test_trust_trajectory_endpoint.py passes: an unknown verdict adds no data point, REJECTED stays 0.0; reverting fails case 1 | building@2026-09-27T20:36Z | Source: 20:12Z cut. Batch 8 (wf_ff8d537c-40e), build then review. |
+| S-209 | BACKLOG 99 (Bun): codex, cline and aider get the prompt without the commit-hygiene line | loki-ts/src/runner/providers.ts (codex, cline, aider invokers only), loki-ts/tests/runner/provider_commit_hygiene.test.ts (new), loki-ts/tests/runner/providers.test.ts (argv asserts only if moved) | MEDIUM | cd loki-ts && bun test tests/runner/provider_commit_hygiene.test.ts tests/runner/providers.test.ts exits 0: all three argvs carry the providers/codex.sh literal, claude not double-prefixed; removing the prefix fails the three legs | ready@2026-09-27T20:12Z | Source: 20:12Z cut. |
+| S-210 | Velocity: help-discoverability (29s) and completion-coverage (30s) probe loops under 10s each | tests/test-help-discoverability.sh, tests/test-completion-coverage.sh (probe loops only) | LOW | time bash tests/test-help-discoverability.sh and time bash tests/test-completion-coverage.sh each exit 0 with real under 10s; real_count and pass counts match the pre-change capture; both timings reported | ready@2026-09-27T20:12Z | Source: 20:12Z cut. |
+| S-211 | BACKLOG 75: register the four suites no runner executes (Captain, after S-174 merges) | tests/run-all-tests.sh (four run_test lines only, after S-174 merges), tests/shard-durations.tsv (four lines) | LOW | grep -c -e test_managed_completion_flag -e test_managed_review_flag -e test-evidence-gate-no-tests -e test-voter-agents-json tests/run-all-tests.sh prints 8; bash tests/test-shard-coverage.sh exits 0; each suite ran 3 of 3 from a scratch cwd with no .loki/state/provider left | ready@2026-09-27T20:12Z | Source: 20:12Z cut. |
+| S-212 | GUARDS 5, 12 and 13 still read PENDING after S-138, S-139 and S-154 landed (after S-181 merges) | docs/v10/GUARDS.md (sections 5, 12, 13 only; does not overlap S-181 section 11) | LOW | awk '/^## 12\./,0' docs/v10/GUARDS.md piped to grep -c 'PENDING, no slice cut' prints 0; bash tests/test-no-ambient-gitconfig-writes.sh and bash tests/test-v10-pulse.sh exit 0 | ready@2026-09-27T20:12Z | Source: 20:12Z cut. |
+| S-213 | BACKLOG 123: cost.html and proofs.html council-vote labels have no test of their own | dashboard-ui/tests/static-council-vote-label.node.test.mjs (new) | LOW | node --test dashboard-ui/tests/static-council-vote-label.node.test.mjs passes (proofs.html council prefix and title, cost.html Council vote header); renaming the header or dropping the title in a scratch copy fails it | ready@2026-09-27T20:12Z | Source: 20:12Z cut. |
 
 Every slice above: implement with red-then-green tests, run diff-scoped tests
 plus `bash tests/moat/run.sh` in your own worktree, never touch `main`,

package/docs/v10/GUARDS.md

@@ -376,13 +376,19 @@ previously mismarked two merged guards (S-16, S-74) as PENDING.
   and Resource Cleanup") exists precisely to close this class for `/tmp`;
   the scratchpad root had no equivalent discipline applied at the time of
   this incident.
-- **The guard:** none yet. No slice has been cut to extend the
-  `loki_run_tmp_create`/`loki_run_tmp_cleanup` discipline (or an equivalent
-  per-agent-subdirectory convention) to the shared scratchpad root, and no
-  mechanical guard (for example, a `scripts/v10-guard.sh` PreToolUse rule
-  blocking an unscoped `rm -f`/`rm -rf` with a glob directly under a shared
-  root) exists today. **PENDING, no slice cut.**
-- **The test that proves it fires:** none. **PENDING, no slice cut.**
+- **The guard:** `scripts/v10-guard.sh` Rule 4, `rule4_glob_in_shared_root`
+  (S-181). Any `rm` (with or without `-rf`) whose glob target has a literal
+  prefix (the path before its first globbed component) that is exactly
+  `/tmp`, `/private/tmp`, `$TMPDIR`, or a directory named `scratchpad` is
+  blocked with exit 2, including `/tmp/loki-*/` and `/tmp/*/x.log`. A glob
+  under a literal subdirectory of such a root (`/tmp/run-1/*.log`) is
+  allowed. Known limit: a parent that is an
+  unexpanded variable (`"$TMPDIR"/*`) is allowed, since the hook cannot see
+  its value.
+- **The test that proves it fires:** `bash tests/test-v10-guard.sh`, section
+  "Rule 4: glob rm directly in a shared root": `rm -f /tmp/*.log` and
+  `rm -f <scratchpad>/*` blocked, `rm -f /tmp/run-1/*.log` allowed. Removing
+  the `rule4_glob_in_shared_root` call fails the 7 blocked cases.
 
 ## 12. A test fixture wrote synthetic `insteadOf` lines to the real `~/.gitconfig` (S-18)
 

package/loki-ts/dist/loki.js

@@ -1,5 +1,5 @@
 // @bun
-var ot=Object.create;var{getPrototypeOf:st,defineProperty:OG,getOwnPropertyNames:nt}=Object;var rt=Object.prototype.hasOwnProperty;function tt($){return this[$]}var et,$e,Xe=($,X,Q)=>{var z=$!=null&&typeof $==="object";if(z){var Z=X?et??=new WeakMap:$e??=new WeakMap,K=Z.get($);if(K)return K}Q=$!=null?ot(st($)):{};let J=X||!$||!$.__esModule?OG(Q,"default",{value:$,enumerable:!0}):Q;for(let q of nt($))if(!rt.call(J,q))OG(J,q,{get:tt.bind($,q),enumerable:!0});if(z)Z.set($,J);return J};var Zq=($,X)=>()=>(X||$((X={exports:{}}).exports,X),X.exports);var Qe=($)=>$;function ze($,X){this[$]=Qe.bind(null,X)}var B1=($,X)=>{for(var Q in X)OG($,Q,{get:X[Q],enumerable:!0,configurable:!0,set:ze.bind(X,Q)})};var s=($,X)=>()=>($&&(X=$($=0)),X);var w5=import.meta.require;var WR={};B1(WR,{lokiDir:()=>h0,homeLokiDir:()=>GQ,findRepoRootForVersion:()=>LG,REPO_ROOT:()=>O1});import{resolve as h2,dirname as jG}from"path";import{fileURLToPath as Ze}from"url";import{existsSync as Kq}from"fs";import{homedir as Ke}from"os";function Je(){let $=HR;for(let X=0;X<6;X++){if(Kq(h2($,"VERSION"))&&Kq(h2($,"autonomy/run.sh")))return $;let Q=jG($);if(Q===$)break;$=Q}return h2(HR,"..","..","..")}function LG($){let X=$;for(let Q=0;Q<6;Q++){if(Kq(h2(X,"VERSION"))&&Kq(h2(X,"autonomy/run.sh")))return X;let z=jG(X);if(z===X)break;X=z}return h2($,"..","..","..")}function h0(){return process.env.LOKI_DIR??h2(process.cwd(),".loki")}function GQ(){return h2(Ke(),".loki")}var HR,O1;var k1=s(()=>{HR=jG(Ze(import.meta.url));O1=Je()});import{readFileSync as qe}from"fs";import{resolve as Ve,dirname as Ye}from"path";import{fileURLToPath as Ue}from"url";function L9(){if(t3!==null)return t3;let $="9.74.0";if(typeof $==="string"&&$.length>0)return t3=$,t3;try{let X=Ye(Ue(import.meta.url)),Q=LG(X);t3=qe(Ve(Q,"VERSION"),"utf-8").trim()}catch{t3="unknown"}return t3}var t3=null;var Jq=s(()=>{k1()});var LR={};B1(LR,{runOrThrow:()=>Ie,run:()=>X1,readStreamCapped:()=>qq,commandVersion:()=>Pe,commandExists:()=>g5,ShellError:()=>CG,MAX_STDOUT_BYTES:()=>jR});async function qq($,X=jR){let Q=$.getReader(),z=new TextDecoder,Z="",K=0;try{while(K<X){let{done:J,value:q}=await Q.read();if(J)break;if(!q)continue;if(K+=q.byteLength,K>X){let V=q.byteLength-(K-X);Z+=z.decode(q.subarray(0,V),{stream:!0});break}Z+=z.decode(q,{stream:!0})}Z+=z.decode()}finally{try{await Q.cancel()}catch{}Q.releaseLock()}return Z}async function X1($,X={}){let Q=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:X.env?{...process.env,...X.env}:process.env,cwd:X.cwd}),z,Z;if(X.timeoutMs&&X.timeoutMs>0)z=setTimeout(()=>{try{Q.kill("SIGTERM")}catch{}Z=setTimeout(()=>{try{Q.kill("SIGKILL")}catch{}},2000)},X.timeoutMs);try{let[K,J,q]=await Promise.all([qq(Q.stdout),new Response(Q.stderr).text(),Q.exited]);return{stdout:K,stderr:J,exitCode:q}}finally{if(z)clearTimeout(z);if(Z)clearTimeout(Z)}}async function Ie($,X={}){let Q=await X1($,X);if(Q.exitCode!==0)throw new CG(`command failed (${Q.exitCode}): ${$.join(" ")}`,Q.exitCode,Q.stdout,Q.stderr);return Q}async function g5($){let X=we($),Q=await X1(["sh","-c",`command -v ${X}`],{timeoutMs:5000});if(Q.exitCode===0)return Q.stdout.trim()||null;return null}function we($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function Pe($,X="--version"){if(!await g5($))return null;let z=await X1([$,X],{timeoutMs:5000});if(z.exitCode!==0)return null;return((z.stdout||z.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var jR=16777216,CG;var y8=s(()=>{CG=class CG extends Error{message;exitCode;stdout;stderr;constructor($,X,Q,z){super($);this.message=$;this.exitCode=X;this.stdout=Q;this.stderr=z;this.name="ShellError"}}});function g2($){return Ee?"":$}var Ee,p0,$5,Z1,i61,A1,f1,m5,n;var e7=s(()=>{Ee=(process.env.NO_COLOR??"").length>0;p0=g2("\x1B[0;31m"),$5=g2("\x1B[0;32m"),Z1=g2("\x1B[1;33m"),i61=g2("\x1B[0;34m"),A1=g2("\x1B[0;36m"),f1=g2("\x1B[1m"),m5=g2("\x1B[2m"),n=g2("\x1B[0m")});import{existsSync as ge}from"fs";async function Z2(){if(BQ!==void 0)return BQ;let $="/opt/homebrew/bin/python3.12";if(ge($))return BQ=$,$;let X=await g5("python3.12");if(X)return BQ=X,X;let Q=await g5("python3");return BQ=Q,Q}async function I4($,X={}){let Q=await Z2();if(!Q)return{stdout:"",stderr:"python3 not found",exitCode:127};return X1([Q,"-c",$],X)}var BQ;var m2=s(()=>{y8()});var gR={};B1(gR,{runStatus:()=>U00});import{existsSync as u5,readFileSync as T9,readdirSync as kR,statSync as SR}from"fs";import{resolve as A5,basename as X00}from"path";import{homedir as Q00}from"os";function yR($){let X=Math.trunc($);if(X>=1e6)return`${(Math.trunc(X/1e6*10)/10).toFixed(1)}M`;if(X>=1000)return`${(Math.trunc(X/1000*10)/10).toFixed(1)}K`;return String(X)}function bR($,X,Q){if(X===0)return null;let z=Math.trunc($*100/X),Z=Math.trunc($*Yq/X);if(Z>Yq)Z=Yq;let K=Yq-Z,J=$5;if(z>=80)J=p0;else if(z>=50)J=Z1;let q="=".repeat(Math.max(0,Z))+" ".repeat(Math.max(0,K)),V=yR($),Y=yR(X);return`  ${f1}${Q}${n} ${J}[${q}]${n} ${z}% (${V} / ${Y})`}async function Z00(){if(await g5("jq"))return!0;return process.stdout.write(`${p0}Error: jq is required but not installed.${n}
+var ot=Object.create;var{getPrototypeOf:st,defineProperty:OG,getOwnPropertyNames:nt}=Object;var rt=Object.prototype.hasOwnProperty;function tt($){return this[$]}var et,$e,Xe=($,X,Q)=>{var z=$!=null&&typeof $==="object";if(z){var Z=X?et??=new WeakMap:$e??=new WeakMap,K=Z.get($);if(K)return K}Q=$!=null?ot(st($)):{};let J=X||!$||!$.__esModule?OG(Q,"default",{value:$,enumerable:!0}):Q;for(let q of nt($))if(!rt.call(J,q))OG(J,q,{get:tt.bind($,q),enumerable:!0});if(z)Z.set($,J);return J};var Zq=($,X)=>()=>(X||$((X={exports:{}}).exports,X),X.exports);var Qe=($)=>$;function ze($,X){this[$]=Qe.bind(null,X)}var B1=($,X)=>{for(var Q in X)OG($,Q,{get:X[Q],enumerable:!0,configurable:!0,set:ze.bind(X,Q)})};var s=($,X)=>()=>($&&(X=$($=0)),X);var w5=import.meta.require;var WR={};B1(WR,{lokiDir:()=>h0,homeLokiDir:()=>GQ,findRepoRootForVersion:()=>LG,REPO_ROOT:()=>O1});import{resolve as h2,dirname as jG}from"path";import{fileURLToPath as Ze}from"url";import{existsSync as Kq}from"fs";import{homedir as Ke}from"os";function Je(){let $=HR;for(let X=0;X<6;X++){if(Kq(h2($,"VERSION"))&&Kq(h2($,"autonomy/run.sh")))return $;let Q=jG($);if(Q===$)break;$=Q}return h2(HR,"..","..","..")}function LG($){let X=$;for(let Q=0;Q<6;Q++){if(Kq(h2(X,"VERSION"))&&Kq(h2(X,"autonomy/run.sh")))return X;let z=jG(X);if(z===X)break;X=z}return h2($,"..","..","..")}function h0(){return process.env.LOKI_DIR??h2(process.cwd(),".loki")}function GQ(){return h2(Ke(),".loki")}var HR,O1;var k1=s(()=>{HR=jG(Ze(import.meta.url));O1=Je()});import{readFileSync as qe}from"fs";import{resolve as Ve,dirname as Ye}from"path";import{fileURLToPath as Ue}from"url";function L9(){if(t3!==null)return t3;let $="9.75.0";if(typeof $==="string"&&$.length>0)return t3=$,t3;try{let X=Ye(Ue(import.meta.url)),Q=LG(X);t3=qe(Ve(Q,"VERSION"),"utf-8").trim()}catch{t3="unknown"}return t3}var t3=null;var Jq=s(()=>{k1()});var LR={};B1(LR,{runOrThrow:()=>Ie,run:()=>X1,readStreamCapped:()=>qq,commandVersion:()=>Pe,commandExists:()=>g5,ShellError:()=>CG,MAX_STDOUT_BYTES:()=>jR});async function qq($,X=jR){let Q=$.getReader(),z=new TextDecoder,Z="",K=0;try{while(K<X){let{done:J,value:q}=await Q.read();if(J)break;if(!q)continue;if(K+=q.byteLength,K>X){let V=q.byteLength-(K-X);Z+=z.decode(q.subarray(0,V),{stream:!0});break}Z+=z.decode(q,{stream:!0})}Z+=z.decode()}finally{try{await Q.cancel()}catch{}Q.releaseLock()}return Z}async function X1($,X={}){let Q=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:X.env?{...process.env,...X.env}:process.env,cwd:X.cwd}),z,Z;if(X.timeoutMs&&X.timeoutMs>0)z=setTimeout(()=>{try{Q.kill("SIGTERM")}catch{}Z=setTimeout(()=>{try{Q.kill("SIGKILL")}catch{}},2000)},X.timeoutMs);try{let[K,J,q]=await Promise.all([qq(Q.stdout),new Response(Q.stderr).text(),Q.exited]);return{stdout:K,stderr:J,exitCode:q}}finally{if(z)clearTimeout(z);if(Z)clearTimeout(Z)}}async function Ie($,X={}){let Q=await X1($,X);if(Q.exitCode!==0)throw new CG(`command failed (${Q.exitCode}): ${$.join(" ")}`,Q.exitCode,Q.stdout,Q.stderr);return Q}async function g5($){let X=we($),Q=await X1(["sh","-c",`command -v ${X}`],{timeoutMs:5000});if(Q.exitCode===0)return Q.stdout.trim()||null;return null}function we($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function Pe($,X="--version"){if(!await g5($))return null;let z=await X1([$,X],{timeoutMs:5000});if(z.exitCode!==0)return null;return((z.stdout||z.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var jR=16777216,CG;var y8=s(()=>{CG=class CG extends Error{message;exitCode;stdout;stderr;constructor($,X,Q,z){super($);this.message=$;this.exitCode=X;this.stdout=Q;this.stderr=z;this.name="ShellError"}}});function g2($){return Ee?"":$}var Ee,p0,$5,Z1,i61,A1,f1,m5,n;var e7=s(()=>{Ee=(process.env.NO_COLOR??"").length>0;p0=g2("\x1B[0;31m"),$5=g2("\x1B[0;32m"),Z1=g2("\x1B[1;33m"),i61=g2("\x1B[0;34m"),A1=g2("\x1B[0;36m"),f1=g2("\x1B[1m"),m5=g2("\x1B[2m"),n=g2("\x1B[0m")});import{existsSync as ge}from"fs";async function Z2(){if(BQ!==void 0)return BQ;let $="/opt/homebrew/bin/python3.12";if(ge($))return BQ=$,$;let X=await g5("python3.12");if(X)return BQ=X,X;let Q=await g5("python3");return BQ=Q,Q}async function I4($,X={}){let Q=await Z2();if(!Q)return{stdout:"",stderr:"python3 not found",exitCode:127};return X1([Q,"-c",$],X)}var BQ;var m2=s(()=>{y8()});var gR={};B1(gR,{runStatus:()=>U00});import{existsSync as u5,readFileSync as T9,readdirSync as kR,statSync as SR}from"fs";import{resolve as A5,basename as X00}from"path";import{homedir as Q00}from"os";function yR($){let X=Math.trunc($);if(X>=1e6)return`${(Math.trunc(X/1e6*10)/10).toFixed(1)}M`;if(X>=1000)return`${(Math.trunc(X/1000*10)/10).toFixed(1)}K`;return String(X)}function bR($,X,Q){if(X===0)return null;let z=Math.trunc($*100/X),Z=Math.trunc($*Yq/X);if(Z>Yq)Z=Yq;let K=Yq-Z,J=$5;if(z>=80)J=p0;else if(z>=50)J=Z1;let q="=".repeat(Math.max(0,Z))+" ".repeat(Math.max(0,K)),V=yR($),Y=yR(X);return`  ${f1}${Q}${n} ${J}[${q}]${n} ${z}% (${V} / ${Y})`}async function Z00(){if(await g5("jq"))return!0;return process.stdout.write(`${p0}Error: jq is required but not installed.${n}
 `),process.stdout.write(`Install with:
 `),process.stdout.write(`  brew install jq    (macOS)
 `),process.stdout.write(`  apt install jq     (Debian/Ubuntu)
@@ -1350,4 +1350,4 @@ Set LOKI_LEGACY_BASH=1 to force the bash CLI for every command.
 `),2}case"start":{let{runStart:z}=await Promise.resolve().then(() => (lt(),ct));return z(Q)}default:return process.stderr.write(`Unknown command: ${X}
 `),process.stderr.write(it),2}}ER();process.on("SIGINT",()=>process.exit(130));process.on("SIGTERM",()=>process.exit(143));var P61=await w61(Bun.argv.slice(2));process.exit(P61);
 
-//# debugId=205E3CD76AD45C089B80FFCE4085E72C
+//# debugId=88CE7D2F62A3A40C201972F9CE03FA11

package/mcp/__init__.py

@@ -75,4 +75,4 @@ try:
 except ImportError:
     __all__ = ['mcp']
 
-__version__ = '9.74.0'
+__version__ = '9.75.0'

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "loki-mode",
   "mcpName": "io.github.asklokesh/loki-mode",
-  "version": "9.74.0",
+  "version": "9.75.0",
   "description": "Loki Mode by Autonomi. Autonomous spec-to-product system: takes a PRD, GitHub issue, OpenAPI/JSON/YAML, or one-line brief to a deployed app via the RARV-C closure loop with 8 quality gates. Provider-agnostic (Claude Code, OpenAI Codex, Cline, Aider, opencode).",
   "keywords": [
     "agent",

package/plugins/loki-mode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "loki-mode",
   "displayName": "Loki Mode",
-  "version": "9.74.0",
+  "version": "9.75.0",
   "description": "Autonomous spec-to-product build system with a built-in trust layer (RARV-C closure loop, 8 quality gates, completion council). Ships Loki's spec-hardening, drift-detection, and deterministic PR verification commands plus the Loki MCP server.",
   "author": {
     "name": "Autonomi",

package/web-app/dist/assets/{AdminPage-DaeYgQSE.js → AdminPage-CMGkmNnt.js}

@@ -1,4 +1,4 @@
-import{c as L,r as x,j as e,w as re,Z as ne,m as le,h as ie,p as P,F as ye,U as I,X as ce,L as de,x as oe,M as Ae,T as Z,S as we,l as xe,k as me,y as Ce,E as Fe,a0 as Se,a as U,a2 as he}from"./index-mQOnSYoW.js";import{B as C}from"./Button-BEf4Nher.js";import{T as $e}from"./trending-up-B0dpgKi-.js";import{C as z}from"./clock-BOZHdPVS.js";import{A as Be,U as ue,M as De}from"./Avatar-CgwQi58_.js";import{A as J}from"./activity-DM2TKaBi.js";import{R as pe}from"./refresh-cw-CWaauzqX.js";import{G as ze}from"./globe-Dzla77iL.js";import{C as Le}from"./chevron-left-ehNW1Do7.js";import{C as je}from"./check-CU128nw_.js";import{D as Y}from"./dollar-sign-CHE3T_rh.js";import{U as Te}from"./user-kRNvOpun.js";import{D as Me}from"./database-DrR1xHzS.js";import{L as Ue}from"./lock-C8v_bXNl.js";import{S as Re}from"./scroll-text-Dx-V_BpP.js";import{S as Ie}from"./shield-alert-OlmWv7sU.js";/**
+import{c as L,r as x,j as e,w as re,Z as ne,m as le,h as ie,p as P,F as ye,U as I,X as ce,L as de,x as oe,M as Ae,T as Z,S as we,l as xe,k as me,y as Ce,E as Fe,a0 as Se,a as U,a2 as he}from"./index-uGGZ1Ij3.js";import{B as C}from"./Button-B1v4CSkD.js";import{T as $e}from"./trending-up-BqfBp13A.js";import{C as z}from"./clock-dqQis2Q6.js";import{A as Be,U as ue,M as De}from"./Avatar-9mn8sJ-2.js";import{A as J}from"./activity-DK6KBQKA.js";import{R as pe}from"./refresh-cw-B4Gu8e2m.js";import{G as ze}from"./globe-Cnq8h4Gt.js";import{C as Le}from"./chevron-left-qyvpFqze.js";import{C as je}from"./check-B5eUl1j9.js";import{D as Y}from"./dollar-sign-9bVcHIkD.js";import{U as Te}from"./user-C_u9mNZM.js";import{D as Me}from"./database-BIj38v85.js";import{L as Ue}from"./lock-DvQNG5RI.js";import{S as Re}from"./scroll-text-GA8EtlY4.js";import{S as Ie}from"./shield-alert-BEaqZEhO.js";/**
  * @license lucide-react v0.577.0 - ISC
  *
  * This source code is licensed under the ISC license.

package/web-app/dist/assets/{Avatar-CgwQi58_.js → Avatar-9mn8sJ-2.js}

@@ -1,4 +1,4 @@
-import{c as l,j as s}from"./index-mQOnSYoW.js";/**
+import{c as l,j as s}from"./index-uGGZ1Ij3.js";/**
  * @license lucide-react v0.577.0 - ISC
  *
  * This source code is licensed under the ISC license.

package/web-app/dist/assets/{Badge-Bwq-lpRh.js → Badge-mSFLvvRX.js}

@@ -1 +1 @@
-import{j as e}from"./index-mQOnSYoW.js";import{C as r}from"./clock-BOZHdPVS.js";import{C as a}from"./circle-alert-Cpw2gtOC.js";import{C as l}from"./check-CU128nw_.js";const i={completed:"bg-[#1FC5A8]/10 text-[#1FC5A8]",running:"bg-[#553DE9]/10 text-[#553DE9]",failed:"bg-[#C45B5B]/10 text-[#C45B5B]",started:"bg-[#D4A03C]/10 text-[#D4A03C]",empty:"bg-[#F8F4F0] text-[#6B6960]",version:"bg-[#553DE9]/10 text-[#553DE9]"};function o({status:t}){switch(t){case"completed":return e.jsx(l,{size:12});case"running":return e.jsxs("span",{className:"relative flex h-2 w-2",children:[e.jsx("span",{className:"animate-ping motion-reduce:animate-none absolute inline-flex h-full w-full rounded-full bg-current opacity-75"}),e.jsx("span",{className:"relative inline-flex rounded-full h-2 w-2 bg-current"})]});case"failed":return e.jsx(a,{size:12});case"started":return e.jsx(r,{size:12});default:return null}}function f({status:t,children:n,className:s=""}){return e.jsxs("span",{className:["inline-flex items-center gap-1 rounded-btn px-2.5 py-0.5 text-xs font-semibold",i[t],s].filter(Boolean).join(" "),children:[e.jsx(o,{status:t}),n]})}export{f as B};
+import{j as e}from"./index-uGGZ1Ij3.js";import{C as r}from"./clock-dqQis2Q6.js";import{C as a}from"./circle-alert-DXtjVPDB.js";import{C as l}from"./check-B5eUl1j9.js";const i={completed:"bg-[#1FC5A8]/10 text-[#1FC5A8]",running:"bg-[#553DE9]/10 text-[#553DE9]",failed:"bg-[#C45B5B]/10 text-[#C45B5B]",started:"bg-[#D4A03C]/10 text-[#D4A03C]",empty:"bg-[#F8F4F0] text-[#6B6960]",version:"bg-[#553DE9]/10 text-[#553DE9]"};function o({status:t}){switch(t){case"completed":return e.jsx(l,{size:12});case"running":return e.jsxs("span",{className:"relative flex h-2 w-2",children:[e.jsx("span",{className:"animate-ping motion-reduce:animate-none absolute inline-flex h-full w-full rounded-full bg-current opacity-75"}),e.jsx("span",{className:"relative inline-flex rounded-full h-2 w-2 bg-current"})]});case"failed":return e.jsx(a,{size:12});case"started":return e.jsx(r,{size:12});default:return null}}function f({status:t,children:n,className:s=""}){return e.jsxs("span",{className:["inline-flex items-center gap-1 rounded-btn px-2.5 py-0.5 text-xs font-semibold",i[t],s].filter(Boolean).join(" "),children:[e.jsx(o,{status:t}),n]})}export{f as B};

package/web-app/dist/assets/{Button-BEf4Nher.js → Button-B1v4CSkD.js}

@@ -1 +1 @@
-import{r as p,j as t}from"./index-mQOnSYoW.js";const m={primary:"bg-[#553DE9] text-white hover:bg-[#4432c4] shadow-button rounded-btn",secondary:"border border-[#553DE9] text-[#553DE9] hover:bg-[#E8E4FD] bg-transparent rounded-btn",ghost:"text-[#36342E] hover:bg-[#F8F4F0] rounded-btn",danger:"bg-[#C45B5B]/10 text-[#C45B5B] border border-[#C45B5B]/20 hover:bg-[#C45B5B]/20 rounded-btn"},b={sm:"px-3 py-1.5 text-xs",md:"px-4 py-2 text-sm",lg:"px-6 py-3 text-base"},u={sm:14,md:16,lg:18};function h({size:e}){return t.jsxs("svg",{className:"animate-spin",width:e,height:e,viewBox:"0 0 24 24",fill:"none",children:[t.jsx("circle",{className:"opacity-25",cx:"12",cy:"12",r:"10",stroke:"currentColor",strokeWidth:"4"}),t.jsx("path",{className:"opacity-75",fill:"currentColor",d:"M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4z"})]})}const B=p.forwardRef(({variant:e="primary",size:o="md",icon:n,iconRight:i,loading:r=!1,disabled:a,className:c="",children:l,...x},d)=>{const s=u[o];return t.jsxs("button",{ref:d,disabled:a||r,className:["inline-flex items-center justify-center gap-2 font-medium transition-colors",m[e],b[o],(a||r)&&"opacity-60 cursor-not-allowed",c].filter(Boolean).join(" "),...x,children:[r?t.jsx(h,{size:s}):n?t.jsx(n,{size:s}):null,l,i&&!r&&t.jsx(i,{size:s})]})});B.displayName="Button";export{B};
+import{r as p,j as t}from"./index-uGGZ1Ij3.js";const m={primary:"bg-[#553DE9] text-white hover:bg-[#4432c4] shadow-button rounded-btn",secondary:"border border-[#553DE9] text-[#553DE9] hover:bg-[#E8E4FD] bg-transparent rounded-btn",ghost:"text-[#36342E] hover:bg-[#F8F4F0] rounded-btn",danger:"bg-[#C45B5B]/10 text-[#C45B5B] border border-[#C45B5B]/20 hover:bg-[#C45B5B]/20 rounded-btn"},b={sm:"px-3 py-1.5 text-xs",md:"px-4 py-2 text-sm",lg:"px-6 py-3 text-base"},u={sm:14,md:16,lg:18};function h({size:e}){return t.jsxs("svg",{className:"animate-spin",width:e,height:e,viewBox:"0 0 24 24",fill:"none",children:[t.jsx("circle",{className:"opacity-25",cx:"12",cy:"12",r:"10",stroke:"currentColor",strokeWidth:"4"}),t.jsx("path",{className:"opacity-75",fill:"currentColor",d:"M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4z"})]})}const B=p.forwardRef(({variant:e="primary",size:o="md",icon:n,iconRight:i,loading:r=!1,disabled:a,className:c="",children:l,...x},d)=>{const s=u[o];return t.jsxs("button",{ref:d,disabled:a||r,className:["inline-flex items-center justify-center gap-2 font-medium transition-colors",m[e],b[o],(a||r)&&"opacity-60 cursor-not-allowed",c].filter(Boolean).join(" "),...x,children:[r?t.jsx(h,{size:s}):n?t.jsx(n,{size:s}):null,l,i&&!r&&t.jsx(i,{size:s})]})});B.displayName="Button";export{B};