This release includes 1 security fix for security teams reviewing exposed deployments.
Published 27d
AI Agents & Assistants
✓ No known CVEs patched
This release patches 1 known CVE
Topics
ai-agents
aider
anthropic
autonomous
ci-cd
claude
+13 more
cline
code-review
devops
gemini
github-action
github-issues
loki-mode
multi-agent
openai-codex
openapi
pull-request-review
sdlc
spec-driven-development
Summary
AI summaryCompletion gates now fail closed if core gate functions cannot be loaded.
Full changelog
Trust moat: completion gates now fail CLOSED
- Fail-closed completion gates (
autonomy/run.sh): each completion gate was
armed astype <gate_fn> && ! <gate_fn>, so if the council library failed to
source, thetypeprobe was false and the gate was silently skipped - a
completion claim could then reach the accept branch UNVERIFIED (a fake-green).
The gate chain now verifies the core gate functions are loadable before running;
if any is missing, the completion claim is refused and the loop keeps iterating
rather than passing ungated. Never fires in a healthy install (functions are
sourced); only triggers on a genuinely broken/partial load, exactly when
failing open is unsafe. Found by the cycle-3 adversarial bug-hunt.
Breaking Changes
- Completion gates now refuse claims when any core gate function is missing (fail-closed behavior).
Security Fixes
- Fail‑closed completion gates prevent unverified claims from being accepted when the council library fails to source.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Loki Mode
Multi-agent autonomous SDLC framework. Spec to deployed app. PRD, GitHub issue, OpenAPI/JSON/YAML, or one-line brief. 5 AI providers, 11 quality gates.
Related context
Related tools
Beta — feedback welcome: [email protected]