loki-mode 9.80.1 → 10.0.1

package/docs/v10/DECISIONS.md

@@ -238,3 +238,21 @@ One entry per decision: context, choice, why, how to reverse. Newest last.
 - Deadline: if the gate is not met by 23:00 ET (03:00 UTC), release v10.0.0 with the default still legacy, v10 opt-in, and the measured gap stated plainly.
 - All non-P0 backlog paused at 21:43Z: batch 10 stopped with every builder's commit kept on its branch (list in ~/loki-ci-logs/paused-branches.txt and the BOARD rows); ready rows parked.
 - Orphan: `timeout 240 bash .../worktrees/agent-afe77b46fbe4962fa/autonomy/run.sh` (PID 22960, child 22986, running 1 day 00:17) ignored SIGTERM and was stopped with SIGKILL by PID at 21:42Z (`ps -o pid= -p 22960` and `-p 22986` both empty afterwards). ORPHAN guard slice E-00 in flight.
+
+## D30. 2026-09-28: Loki directive -- any size in one run; accuracy is the lever; 2x gate; modernization program
+
+- Supersedes the D29 gate and keeps everything in it. North star: Loki 10 completes work of any size in one autonomous run, from a one-line issue to a million-line modernization, with no back-and-forth. Moat order holds; nothing weakens the Seal, the Wall, Rule of Two or honest verdicts.
+- Part 1 gate (v10.0.0, small-task engine), against raw `claude -p`, same tasks and model family, all numbers published: at least 2x fewer failures (96.5% or higher vs raw 93.1%; stretch 98.6%); cost per completed task at least 2x lower ($0.118 or less vs $0.2363); time to a correct result at most 1x raw on small tasks and at least 2x faster on medium and large; never worse than raw on any axis in any tier.
+- Eval tiers: small (29 tasks, done), medium (15 multi-file, EV-11), large (10 feature or legacy, EV-12); arms raw, v10, legacy.
+- v10.0.0 ships tonight. The default flips only if v10 beats raw on the measured tiers; otherwise opt-in with the numbers. No public "2-5x" claim until all three tiers are measured.
+- Part 2 (v10.x): `loki modernize <repo> --to "<target>"`; design in docs/v10/MODERNIZE.md (CTO and Architect), Part 2 slices M-01.. cut from it; engineers take them when Part 1 slices stop filling the queue. PROGRESS.md every 30 minutes with Part 1 gate numbers, Part 2 slices done, top blocker; pulse enforces it (E-63 STALE_PROGRESS, over 35 minutes).
+
+## D31. 2026-09-28: small tasks must be leaner than raw
+
+- For tasks sizing.ts rates small: one sonnet implement session with the cached repo map, then impacted tests, then PR. No separate plan or Wall call; the Wall stays for medium and large tasks, or when the repo has no relevant tests. Escalate to opus only on a test failure (E-64).
+- Measured before this rule (EV-8, 5 tasks, raw opus 5/5 $0.2161 per completed, p50 41s): full design 4/5 $0.5954; Wall off 5/5 $0.3976; all-sonnet no plan no Wall 4/5 $0.294 p50 44s (~/loki-ci-logs/ev8r-{A,B,C}/results.jsonl). One sonnet session costing more than raw opus's whole task means the per-session overhead is the cost driver; E-65 measures and cuts it.
+
+## D32. 2026-09-28: augmentiq #52 user report fixed in v10 only
+
+- Built into the v10 engine, no legacy fixes: "already implemented" is a first-class outcome with evidence, receipt and issue comment, no PR (E-66; aiq-52 expected outcome in the eval, EV-13); no pause state, anything unfinishable ends as a draft PR or an issue comment with the reason within the 15-minute cap (E-67); per-call deadline, progress every 30s, every exit code classified including 125 and 143 (E-68); cost shows "not measured", never $0 when unmeasured (E-69); the dashboard shows its version and the CLI's, warns on mismatch, and replaces an older dashboard on its port (E-70).
+- Legacy stays as it is until v10 becomes the default; then legacy is deleted.

package/docs/v10/GUARDS.md

@@ -450,3 +450,84 @@ previously mismarked two merged guards (S-16, S-74) as PENDING.
   (S-139) asserts the VIOLATION fires for a `released@` row stamped after
   npm's newest publish; T39b asserts it stays silent for a row stamped
   before it.
+
+## 14. Eval harness orphans survived the arm's process-group KILL (EV-10)
+
+- **Incident:** 00:08Z, pulse ORPHAN_WORKTREE flagged 6 orphaned processes
+  left running after `eval/loki10/harness.py` runs against the legacy arm;
+  all 6 were stopped by PID once found. Each was a detached
+  `/tmp/loki-run-*.sh` loop legacy loki spawns via `setsid`, which had
+  reparented to launchd (ppid 1) once the arm process it came from exited.
+- **Root cause with evidence:** `kill_orphans()` only ever did
+  `os.killpg(timeout_pid, SIGKILL)` -- correct for anything still in the
+  `timeout` process group the arm ran under, but a `setsid`'d child
+  deliberately leaves that group and gets its own pgid, so the group KILL
+  can never reach it once the escape has completed. Reproduced locally: a
+  script that setsid-spawns a sleeper, confirms (by polling its pgid) that
+  the escape finished, then exits still leaves the sleeper running after
+  `capped_run()` returns and `kill_orphans()` has already run.
+- **The guard:** `kill_orphans()` now also reaps by two signals that are
+  never a process name or pattern: any PID recorded in a `*.pid` file under
+  the run's own clone (`<work>/.loki/**/*.pid`, one per line, never through
+  a symlinked `.loki/` or a non-regular/oversized file), and any process
+  anywhere on the box whose cwd (`/proc/<pid>/cwd` where present, else one
+  system-wide `lsof -a -d cwd -Fpn` call, resolved with `os.path.realpath`)
+  is that same clone directory or a path inside it. Both are scoped to
+  `cwd`, the exact per-run clone `capped_run()` was given. Every candidate
+  PID is vetted by `_pid_is_ours()` before it ever reaches `os.kill`: never
+  `<= 1` (kill(2) treats -1/0 as "every process the caller may signal," not
+  a single-PID cleanup), never this process or its parent, and never older
+  than the run's own start (a stale or forged `.pid` entry naming an
+  unrelated, longer-lived process is left alone).
+- **The test that proves it fires:** `eval/loki10/test-harness.sh`, EV-10.
+  Leg Rj: the `setsidorphan` stub-arm mode setsid-spawns a sleeper in its
+  own clone, polls until the sleeper's pgid equals its own pid and only
+  then records an "escaped" marker (ruling out a vacuous pass from a spawn
+  that never actually left the group), then exits; the leg asserts the
+  marker is present and the sleeper is dead once the harness run returns.
+  Leg Rk: the same escape, chdir'd out of the clone first so the cwd path
+  cannot see it, reaped instead from its own PID in a `.loki/*.pid` file; a
+  decoy PID that predates the run, planted in the same file (plus a literal
+  `-1`), is asserted to survive. Leg Rl exercises `_clone_orphan_pids`
+  directly to assert `-1`/`0`/`1` and a pre-run PID are filtered before any
+  kill is attempted, without ever risking a live `kill(-1, SIGKILL)`.
+  Mutation-tested: disabling the cwd path fails only Rj, disabling the
+  pidfile path fails only Rk, and bypassing `_pid_is_ours` (checked offline
+  against a throwaway copy of the module, never run against a live process)
+  lets `-1` through, which Rl's assertion catches.
+## 15. Two releases pushed with unbaselined secret-shaped fixtures never reached npm (E-60)
+
+- **Incident:** Security Audit (the `secret-scan` job in
+  `.github/workflows/security-audit.yml`, a required-ci gate) failed on the
+  release SHAs for v9.79.0 (`9dc0b1d3`, 2026-09-27) and v9.80.0 (`085306ae`,
+  same day). Both pushes landed on main, but `publish-npm` never ran because
+  the required Security Audit conclusion was red, so npm latest stayed at
+  9.78.0 through both releases -- 00:45Z is when the fix (`5190756f`) landed
+  and unblocked v9.80.1.
+- **Root cause with evidence:** `5190756f`'s own commit message names the
+  findings exactly: "a planted AWS-shaped string for the deep-verify
+  secret-scan test and two CANARY/WITHHELD token canaries." Three new Loki 10
+  test fixtures were secret-shaped (matched gitleaks' built-in rules) and
+  landed on main across the two releases without a matching
+  `.gitleaksignore` entry, so gitleaks' full-history scan in CI reported
+  three new, unreviewed findings and blocked exactly as designed -- the gate
+  worked; nothing local had run the same scan before push to catch it there
+  instead of at CI, so two releases went out DOA on the fastest-available
+  feedback channel (CI, not a local gate).
+- **The guard:** E-60 adds a fast-tier gitleaks step to `scripts/local-ci.sh`
+  (`_FAST_KEEP` entry `"gitleaks (secrets, origin/main..HEAD)"`): when a
+  `gitleaks` binary is on PATH, every pre-push run scans just the commits the
+  branch adds on top of `origin/main` against the same reviewed
+  `.gitleaksignore` baseline CI uses, so an unbaselined secret-shaped fixture
+  is caught before push, not after a release SHA is already tagged. Fails
+  closed the other way too: an absent binary prints an explicit SKIP line
+  (never a silent PASS), matching this file's shellcheck-absent posture.
+- **The test that proves it fires:** `tests/test-local-ci-gitleaks.sh`
+  (registered in `tests/run-all-tests.sh` and `tests/shard-durations.tsv`).
+  Static assertions confirm the skip-not-pass path, the `.gitleaksignore`
+  baseline, the `origin/main..HEAD` scope, and `_FAST_KEEP` membership; when
+  a gitleaks binary is present, two live temp-repo scenarios drive the exact
+  command shape `scripts/local-ci.sh` runs: a commit adding a literal
+  AKIA-shaped token fails the step, and a commit adding the identical
+  characters via source-level concatenation (never contiguous in the
+  committed bytes) passes it.

package/docs/v10/GUIDE.md

@@ -0,0 +1,154 @@
+# Loki 10 engine guide
+
+Opt-in: set LOKI_ENGINE=v10 <!-- loki10-default -->
+
+Loki 10 is the rewritten engine (docs/v10/ENGINE.md). It is not the default
+yet. Every command below only runs when LOKI_ENGINE=v10 is set; leave it
+unset and `loki` keeps using the current (legacy) engine exactly as before.
+
+Some pieces named in this guide are still being built. Each one below says
+so plainly instead of describing a finished feature.
+
+## Quickstart
+
+Put the task first, as a quoted multi-word string, so bin/loki's router
+sends it to the v10 engine instead of the legacy one. A one-word argument
+that is not an issue ref, or any first argument starting with `-`, stays
+on the legacy engine.
+
+```
+LOKI_ENGINE=v10 loki "fix the login redirect loop" --no-pr
+```
+
+Issue refs work the same way:
+
+```
+LOKI_ENGINE=v10 loki owner/repo#123
+LOKI_ENGINE=v10 loki https://github.com/owner/repo/issues/123
+```
+
+bin/loki routes GitHub, GitLab (`.../-/issues/N`) and Jira
+(`.../browse/KEY`) issue URLs to the v10 engine, and the issue-fetch step
+(autonomy/issue-providers.sh) fetches title/body/labels from all three.
+Only the extra already-done check (an issue's `state` and whether it was
+closed by a merged PR) is GitHub-only; a GitLab or Jira issue still runs,
+just without that extra signal.
+
+Flags, from the engine's own `--help`:
+
+- `--no-pr`: build and verify, but skip opening a pull request.
+- `--deep`: request the deep verify pass; the implement time budget goes
+  from 480s to 1800s (`loki-ts/src/engine10/types.ts`).
+- `--provider <name>`: pick the coding provider for this run. See the
+  provider table below.
+- `--resume <run-id>`: continue a run that was interrupted.
+
+`--no-pr`, `--deep` and `--provider` are parsed by the supervisor
+(`loki-ts/src/engine10/supervisor.ts`) and take effect on a real run.
+`--resume` is not wired yet: passing it prints `engine10: --resume is not
+wired yet` and exits 2. Its shape is documented here because it is already
+fixed in `--help`.
+
+`loki status`, `loki verify` and `loki dashboard` are all built on main
+(status.ts, verify_cmd.ts, dashboard/server.ts) and route through cli.ts's
+table like any other subcommand.
+
+The free-text and issue-ref run itself (the supervisor that plans, builds
+and verifies) is wired into the CLI on main: `loki "<task>"` and `loki
+<issue-ref>` run the full worker flow (intake, plan, wall, implement,
+verify, seal) and then, in the supervisor, the pr stage, ending in the
+5-line summary below.
+
+Slack is not part of the v10 engine surface (no command, no notification
+hook) and is in progress, tracked with the other wave 3 items.
+
+## The 5-line summary
+
+A finished run prints five lines, one label each:
+
+```
+PR:         https://github.com/owner/repo/pull/1
+Verdict:    VERIFIED
+NOT PROVEN: full suite, app boot, council, security scan
+Cost:       $0.42 (claude, 212k tokens)
+Time:       4m12s (intake 11s, plan 20s, implement 3m10s, verify 31s)
+```
+
+- **PR**: the opened pull request URL, or `none` when the run used
+  `--no-pr` or never got that far. A draft PR adds the draft reason in
+  parentheses.
+- **Verdict**: one of VERIFIED, PARTIAL, ALREADY_SATISFIED, SPEC_CONFLICT or
+  FAILED.
+- **NOT PROVEN**: everything the run did not check, comma-joined. Never
+  empty by omission: a check that was skipped or deferred is always listed
+  here, not silently dropped. A flaky test found during verify appears as a
+  separate `; flaky ...` clause on the same line.
+- **Cost**: the provider-reported dollar figure and token count. When the
+  provider does not report cost, this line reads `not measured` instead of
+  `$0.00`; a missing cost is never rendered as free.
+- **Time**: total wall time, then each stage's own duration in parentheses.
+
+This formatter (`loki-ts/src/engine10/output.ts`, `formatSummary`) is
+called by the supervisor at the end of every run, so a real `loki "<task>"`
+or `loki <issue-ref>` run prints this block on completion. The block above
+is that function's real output, not a mockup.
+
+## NOT PROVEN
+
+NOT PROVEN lists what a run did not verify, so a passing run is never read
+as more thorough than it was. One entry is unconditional, written by Seal
+every time:
+
+- **The deep checks**: `full suite, app boot, council, security scan`.
+  They are deferred to a separate deep-verify pass, so Seal always lists
+  all four at seal time.
+
+Seal also adds an entry whenever it applies, for example: `cost not
+measured (no iteration ids recorded)`, `kill blocking not enforced` for
+any provider other than claude, `worker killed by the supervisor backstop
+(cap plus grace)`, `event log modified outside the engine`, a flaky test,
+a reverted test edit, a model override a non-claude provider could not
+honor, a task source the intake step did not record, an uncomputable
+diff, an individual check that did not run, or a failed receipt signature.
+The Cost line above separately reads `not measured` (never `$0.00`)
+whenever the provider reported no dollar figure.
+
+## Receipts
+
+A run writes `.loki/runs/<run-id>/receipt.json` and a matching
+`receipt.md`. The JSON receipt's `receipt_sha256` hashes the canonical JSON
+without the `verification` block, so verifying a receipt never has to trust
+its own signature field to compute the hash it is checking.
+
+`loki verify [run-id]` re-hashes the receipt and checks its signature. A
+receipt with no signing key configured (or a key that failed to load) reads
+`UNSIGNED` and is never presented as attested; a signed receipt reads
+`SIGNED (kid ...)`.
+
+## Provider table
+
+| Provider | Cost measured | Kill blocking enforced |
+|----------|----------------|--------------------------|
+| claude   | yes            | yes                      |
+| codex    | no             | no                       |
+| cline    | no             | no                       |
+| aider    | no             | no                       |
+| opencode | not supported  | n/a                      |
+
+For codex, cline and aider, a run's Cost line reads `not measured` and the
+NOT PROVEN line adds the literal entry `kill blocking not enforced`
+(`loki-ts/src/engine10/stages/seal.ts`). opencode is not one of engine10's
+provider names (`claude`, `codex`, `cline`, `aider`); it is not supported.
+
+## After the flip
+
+Once v10 becomes the default (docs/v10/DECISIONS.md, D29), `loki`, `loki
+status`, `loki verify` and `loki dashboard` with no `LOKI_ENGINE` set will
+mean the v10 commands described above. The previous engine stays fully
+reachable: `loki legacy <args>` and `LOKI_ENGINE=legacy` both route to it,
+unchanged. Nothing is removed at the flip.
+
+That flip has not happened on main as of this guide. The opt-in line near
+the top of this file and of README.md's section is the one place that
+records which state we are in; it changes in the same commit as the flip
+itself.

package/docs/v10/METRICS.md

@@ -243,3 +243,20 @@ Misses: pub-click-3059 (hidden tests failed: wrong metavar bracketing), pub-huma
 ## Loki 10 engine: first real run (E-14 smoke, not the gate)
 
 pub-more-itertools-1192 through the E-14 glue entry, real claude, --no-pr: 30s wall (intake 0s, plan 16s, implement 12s, verify 3s, commit and seal under 1s), hidden test passes, $0.4486 over 2 sessions (plan $0.2264, implement $0.2223), verdict PARTIAL only because ruff is not installed. Raw claude on the same task: 15s, $0.1290. The planner session costs as much as the implement session.
+
+## Loki 10 gate report, small tier (2026-09-28, D30; v10.0.0 decision)
+
+All arms on claude-opus-5-5, 29 small tasks with hidden tests, fresh clone per run, provider-sourced cost only. D30 targets vs raw: completion 96.5% or higher, cost per completed task $0.118 or lower, time to a correct result at most raw.
+
+| arm | completed | cost per completed | p50 / p90 time to PR | source |
+|---|---|---|---|---|
+| raw `claude -p` | 27/29 (93.1%) | $0.2363 | 39s / 68s | ~/loki-ci-logs/eval-raw-claude-20260927T231653Z/results.jsonl |
+| legacy (global loki v9.78.0) | 15/29 (51.7%); hidden tests pass 26/29, no PR opened | not measured (0/29 provider-sourced) | 190s / 441s | ~/loki-ci-logs/ev5-legacy/results.jsonl |
+| v10 default knobs (main 8b76fd9a: E-45 cost path, E-65 lean sessions) | 26/29 (89.7%) | $0.3946 (2 runs unmeasured) | 85.5s / 133s | ~/loki-ci-logs/ev9-v10-small/results.jsonl |
+| v10 lean configuration, not the default (same build, LOKI_E10_PLAN=0 LOKI_E10_WALL=0) | 27/29 (93.1%) | $0.1616 (1 run unmeasured) | 40s / 67s | ~/loki-ci-logs/ev9-v10-small-lean/results.jsonl |
+
+- v10 misses: aiq-52-searchbar (the feature already exists; the no-change outcome is E-66/EV-13, in rework), pub-click-3059, pub-humanize-174 (raw missed the same two pub tasks).
+- Gate: NOT MET on any axis for the default configuration. Default stays legacy; v10 ships opt-in (LOKI_ENGINE=v10).
+- Lean configuration misses: aiq-52-searchbar, pub-humanize-174. It matches raw on completion and time and is 32% cheaper; it does not meet the 2x targets and is not the default until E-64 lands and is re-measured.
+- Lean-session evidence, 5 tasks (EV-8 D/E, not the full arm): opus lean 4/5 at $0.1571 per completed, p50 28s; sonnet lean 4/5 at $0.1519, p50 27.5s; raw opus on the same 5: 5/5, $0.2161, p50 41s (~/loki-ci-logs/ev8r-{D,E}/results.jsonl). The lean small path is not the default yet (E-64 in rework).
+- Medium and large tiers: not built (EV-11 3 of 15 verified, EV-12 in rework). No "2-5x" claim.