loki-mode 10.5.17 → 10.5.20

package/docs/COMPARISON.md

@@ -132,19 +132,6 @@
 
 ---
 
-## Benchmarks (SWE-bench Verified)
-
-| Agent | Score | Notes |
-|-------|-------|-------|
-| **Google Antigravity** | 76.2% | With Gemini 3 Pro |
-| **Claude Code** | ~75%+ | Claude Sonnet 4.5 |
-| **OpenAI Codex** | ~70%+ | GPT-5.2-Codex |
-| **Devin 2.0** | 67% | PR merge rate doubled |
-| **Amazon Q Developer** | 66% | State-of-the-art claim |
-| **Loki Mode** | Inherits Claude | Framework, not model |
-
----
-
 ## Zencoder/Zenflow Comparison (v2.36.7)
 
 **Comprehensive analysis of Zencoder.ai enterprise AI coding platform, including Zenflow (autonomous workflows), Zen Agents (specialized agents), and Zentester (QA automation).**
@@ -210,7 +197,7 @@
 |---------|--------------|---------|-----------------|------------|-----------------|---------------------|----------------|
 | **Stars** | 594 | 11,903 | 35K+ | 26K+ | 13.7K | N/A | N/A |
 | **npm/wk** | 6.1K | 21.4K | N/A | N/A | N/A | N/A | N/A |
-| **Agents** | 41 roles in 8 domains | 11 agents | Fresh per task | 108 agents | Swarm-based | 32 agents | N/A |
+| **Agents** | Role prompts per domain | 11 agents | Fresh per task | 108 agents | Swarm-based | 32 agents | N/A |
 | **Skills** | Progressive disclosure | 6 slash commands | N/A | 129 skills | N/A | 35 skills | Memory focus |
 | **Multi-Provider** | Yes (Claude/Cline/Codex/Aider/opencode) | 3 CLIs (separate) | No | No | No | No | No |
 | **Memory System** | 3-tier (episodic/semantic/procedural) | None | N/A | N/A | Hybrid | N/A | SQLite+FTS5 |
@@ -265,7 +252,7 @@ Plugin marketplace architecture with unprecedented scale:
 | Pattern | Description | Loki Mode Status |
 |---------|-------------|------------------|
 | **72 Plugins** | Modular, focused plugins instead of monolith | Different approach (progressive disclosure) |
-| **108 Agents** | Specialized agents for specific domains | 41 agent roles in Loki Mode |
+| **108 Agents** | Specialized agents for specific domains | Specialized agent roles in Loki Mode |
 | **129 Skills** | Skills as first-class objects | 10 skills in skills/ |
 | **Four-Tier Model Strategy** | Explicit tier selection with constraints | Similar to Loki Mode tiers |
 
@@ -286,7 +273,7 @@ Tiered agent architecture with explicit escalation:
 
 | Pattern | Description | Loki Mode Status |
 |---------|-------------|------------------|
-| **32 Agents** | Smaller but well-organized agent set | 41 in Loki Mode |
+| **32 Agents** | Smaller but well-organized agent set | Specialized roles in Loki Mode |
 | **35 Skills** | Domain-specific skills | 10 skills in Loki Mode |
 | **Tiered Architecture** | LOW/MEDIUM/HIGH with explicit triggers | **IMPLEMENTED** (model-selection.md lines 180-363) |
 | **Delegation Enforcer** | Middleware auto-injects correct model | Evaluating |
@@ -349,13 +336,13 @@ Tiered agent architecture with explicit escalation:
 
 | Agent | Killer Feature |
 |-------|---------------|
-| **Loki Mode** | Minimal-human-intervention full SDLC from any spec (PRD, GitHub issue, or YAML), 41 agent roles in 8 domains, Constitutional AI, anti-sycophancy, cross-project learning, code transformation, property-based testing |
+| **Loki Mode** | Minimal-human-intervention full SDLC from any spec (PRD, GitHub issue, or YAML), specialized agent roles, Constitutional AI, anti-sycophancy, cross-project learning, code transformation, property-based testing |
 | **Devin** | Full software engineer persona, Slack integration, 67% PR merge rate |
 | **OpenAI Codex** | Skills marketplace, $skill-creator, GPT-5.2-Codex, secure sandbox |
 | **Cursor** | 8 parallel agents, BugBot, Memories, $10B valuation, Composer model (250 tok/s) |
 | **Kiro** | Spec-driven development (requirements.md/design.md/tasks.md), Property-based testing, Hooks |
-| **Antigravity** | Manager Surface, Artifacts system (video), browser subagents, Gemini 3 (76.2% SWE-bench) |
-| **Amazon Q** | Code transformation (/transform), 66% SWE-bench, deep AWS integration, MCP support |
+| **Antigravity** | Manager Surface, Artifacts system (video), browser subagents, Gemini 3 |
+| **Amazon Q** | Code transformation (/transform), deep AWS integration, MCP support |
 | **OpenCode** | 70.9k stars, multi-provider, LSP integration (25+ languages), plugin system |
 
 ---

package/docs/COMPETITIVE-ANALYSIS.md

@@ -16,7 +16,7 @@ GSD is the closest competitor -- a context engineering system that spawns fresh
 
 | Dimension | Loki Mode | GSD | Winner |
 |-----------|-----------|-----|--------|
-| Feature depth | Deep (memory, council, dashboard, events, 41 agents) | Shallow (6 commands, 11 agents, markdown state) | Loki |
+| Feature depth | Deep (memory, council, dashboard, events, agent roles) | Shallow (6 commands, 11 agents, markdown state) | Loki |
 | Adoption | 594 stars, 6K/wk npm | 11,903 stars, 21K/wk npm | GSD (20x) |
 | Simplicity | Complex (5.4K-line run.sh, 12 Python modules) | Simple (markdown agents + slash commands) | GSD |
 | Full autonomy | Walk away, come back to deployed product | Human checkpoints at discuss/verify/milestone | Loki |
@@ -36,12 +36,11 @@ GSD is the closest competitor -- a context engineering system that spawns fresh
 | Feature | Loki Mode | Claude-Flow | MetaGPT | CrewAI | Cursor Agent | Devin |
 |---------|-----------|-------------|---------|--------|--------------|-------|
 | **GitHub Stars** | 594 | 13,700 | 62,400 | 25,000+ | N/A (Commercial) | N/A (Commercial) |
-| **Agent Count** | 41 types | 64+ agents | 5 roles | Unlimited | 8 parallel | 1 autonomous |
 | **Parallel Execution** | Yes (multi-agent) | Yes (swarms) | Sequential | Yes (crews) | Yes (8 worktrees) | Yes (fleet) |
-| **Published Benchmarks** | 98.78% HumanEval (self-reported, max 3 retries) | None | 85.9-87.7% HumanEval | None | ~250 tok/s | 15% complex tasks |
+| **Published Benchmarks** | None | None | 85.9-87.7% HumanEval | None | ~250 tok/s | 15% complex tasks |
 | **SWE-bench Score** | Not measured (patch generation harness exists; official evaluator not run, so no resolve rate exists) | Unknown | Unknown | Unknown | Unknown | 15% complex |
 | **Full SDLC** | Yes (8 phases) | Yes | Partial | Partial | No | Partial |
-| **Business Ops** | **Yes (8 agents)** | No | No | No | No | No |
+| **Business Ops** | **Yes** | No | No | No | No | No |
 | **Enterprise Security** | `--dangerously-skip-permissions` | MCP sandboxed | Sandboxed | Audit logs, RBAC | Staged autonomy | Sandboxed |
 | **Cross-Project Learning** | No | AgentDB | No | No | No | Limited |
 | **Observability** | Dashboard + STATUS.txt | Real-time tracing | Logs | Full tracing | Built-in | Full |
@@ -175,43 +174,10 @@ GSD is the closest competitor -- a context engineering system that spawns fresh
 
 ---
 
-## Benchmark Results (Published 2026-01-05)
+## Benchmark Results
 
-### HumanEval Results (Three-Way Comparison)
-
-**Loki Mode Multi-Agent (with RARV):**
-
-| Metric | Value |
-|--------|-------|
-| **Pass@1** | **98.78%** |
-| Passed | 162/164 problems |
-| Failed | 2 problems (HumanEval/32, HumanEval/50) |
-| RARV Recoveries | 2 (HumanEval/38, HumanEval/132) |
-| Avg Attempts | 1.04 |
-| Model | Claude Opus 4.5 |
-| Time | 45.1 minutes |
-
-**Direct Claude (Single Agent Baseline):**
-
-| Metric | Value |
-|--------|-------|
-| **Pass@1** | **98.17%** |
-| Passed | 161/164 problems |
-| Failed | 3 problems |
-| Model | Claude Opus 4.5 |
-| Time | 21.1 minutes |
-
-**Three-Way Comparison:**
-
-| System | HumanEval Pass@1 | Agent Type |
-|--------|------------------|------------|
-| **Loki Mode (multi-agent)** | **98.78%** | Architect->Engineer->QA->Reviewer |
-| Direct Claude | 98.17% | Single agent |
-| MetaGPT | 85.9-87.7% | Multi-agent (5 roles) |
-
-**Key Finding:** RARV cycle recovered 2 problems that failed on first attempt, demonstrating the value of self-verification loops.
-
-**Failed Problems (after RARV):** HumanEval/32, HumanEval/50
+No benchmark result is published. A self-reported HumanEval run from
+2026-01-05 is withdrawn as a headline figure.
 
 ### SWE-bench Lite: Honest Status
 
@@ -233,7 +199,6 @@ resolve rate is not yet measured." Nothing stronger.
 ## Critical Gaps to Address
 
 ### Priority 1: Benchmarks (PARTIAL)
-- **Real:** 98.78% HumanEval Pass@1 with RARV (162/164, reproducible harness; 98.17% single-agent baseline)
 - **NOT real:** SWE-bench. Patch generation ran (299/300 diffs produced); the official
   evaluator never ran, so there is NO resolve rate and no comparable score.
 - **Next:** run a contamination-resistant evaluator end-to-end (or publish nothing for SWE-bench)

package/docs/CRASH-REPORTING-PLAN.md

@@ -494,7 +494,7 @@ Guards that prevent a bad auto-fix from shipping:
 | Backend abuse / spam | Unauthenticated-but-rate-limited (per IP + project_id_hash), body-size cap, whitelist-schema validation, 202-always (no oracle), occurrence counter collapses floods into one issue. |
 | Auto-fix ships a regression | local-ci gate (42/42 + bun-parity) BEFORE PR; unanimous council; NO auto-merge; one PR per fingerprint; human merge gate per CLAUDE.md. |
 | GitHub token exfiltration | Token only on backend (7c/7e); clients carry no write secret; only a public anon ingest key at most. |
-| GDPR / CCPA compliance | Anonymous-by-design (no PII in whitelist; emails/IPs denied); disclosed default-on with friction-free persistent opt-out (LOKI_TELEMETRY=off, loki telemetry off, DO_NOT_TRACK=1); project_id_hash is non-reversible; PRIVACY.md documents data categories, retention, opt-out, and deletion-by-fingerprint on request. Default-on is defensible only WITH the disclosure; covert would not be. |
+| Personal data | Anonymous-by-design (no PII in whitelist; emails/IPs denied); disclosed default-on with friction-free persistent opt-out (LOKI_TELEMETRY=off, loki telemetry off, DO_NOT_TRACK=1); project_id_hash is non-reversible; PRIVACY.md documents data categories, retention, opt-out, and deletion-by-fingerprint on request. Default-on is defensible only WITH the disclosure; covert would not be. |
 | Dual-route parity burden | Single shared Python scrubber called by both routes (5a) eliminates redaction drift; bun-parity matrix entries for `loki crash` (local-ci.sh:250); commands ported in both `autonomy/loki` and `loki-ts/src/commands/`. |
 | Over-reporting normal operation | Conservative capture: only uncaught/ nonzero-exit/provider-failure/explicit friction signals (retry loop, rate-limit loop, gate failure), not routine retries; thresholds before friction fires. |
 | python3 absence breaks capture | Fail closed: local write only if scrub ran, never egress without scrub (5b). |

package/docs/ENTERPRISE-IDENTITY-ROADMAP.md

@@ -155,7 +155,7 @@ effort estimate, and the IdP or test infrastructure required.
 ### SOC2
 
 - Scope: SOC2 is a compliance PROGRAM, not a code feature. It spans durable,
-  tamper-evident audit logging with retention and SIEM export, access reviews,
+  integrity-protected audit logging with retention and SIEM export, access reviews,
   change-management process, vendor management, security policies, and a Type
   II observation window (commonly 6 to 12 months of evidence collected under
   an auditor).

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v10.5.17
+**Version:** v10.5.20
 
 ---
 

package/docs/PRIVACY.md

@@ -21,7 +21,7 @@ match the code, the code is the bug; please open an issue.
   CONTINUOUS_INTEGRATION), an enterprise/air-gapped marker
   (LOKI_ENTERPRISE=true / LOKI_AIRGAP=true), or a non-interactive session (no
   TTY: scripts, pipes, cron, detached/container runs). In those contexts an
-  untouched install sends us nothing. GDPR / FedRAMP deployments stay clean.
+  untouched install sends us nothing.
 - Disclosure is never covert: the first-run welcome screen states (once) that
   anonymous diagnostics are on and how to turn them off, and this document is the
   canonical reference.

package/docs/R8-SHAREABLE-TEAM-ASSETS-PLAN.md

@@ -17,7 +17,7 @@ was read in full. Findings:
 | `cmd_share` | `autonomy/loki:25147` | Uploads a session REPORT as a GitHub gist. | Not applicable (report, not assets). |
 | `cmd_memory` | `autonomy/loki:14475` | Lists/show cross-project learnings in `~/.loki/learnings/*.jsonl`. No tarball export. | Same source dir reused as an asset category. |
 | `proof_redact.py` | `autonomy/lib/proof_redact.py` | Single redaction chokepoint (R1). `redact_tree(obj)`, `redact_value(s)`, `set_context()`, `RULES_VERSION`. | REUSED as-is. No second redactor written. |
-| agent registry | `agents/types.json` | 41 shipped agent types. `cmd_agent` (`autonomy/loki:19509`) reads it from the install dir. | Bundled as the `agents` category. |
+| agent registry | `agents/types.json` | Shipped agent types. `cmd_agent` (`autonomy/loki:19509`) reads it from the install dir. | Bundled as the `agents` category. |
 | PRD templates | `templates/*.md` | 21 templates; read from `$SKILL_DIR/templates` at runtime (`autonomy/loki:9781`, `8840`). | Bundled as `templates`. |
 | council config | `<project>/.loki/council/*.json` | `config.json` / `state.json` (`autonomy/loki:16688`, `autonomy/run.sh:3643`). | Bundled as `council`. |
 | project memory | `<project>/.loki/memory/{episodic,semantic,skills,...}` (`autonomy/run.sh:3183`) | Per-project episodic/semantic/procedural memory. | Bundled as `memory`. |

package/docs/WANG-PRINCIPLES-PLAN.md

@@ -53,7 +53,7 @@ Measured on this machine, not asserted.
 | **1 Systems Thinking** | STRONG | 8 quality gates, RARV-C loop, council, Evidence Receipt, dual-route parity enforced by test |
 | **2 Speed** | MEASURED, UNOPTIMISED | agent call = **980s = 96%** of iteration; all gates together = 44s |
 | **3 Reliability** | STRONG, newly so | 73 mutation-proven trust invariants; four gates were shipping broken until v8.38.0 |
-| **4 Extensibility** | STRONG | 4 providers, 41 agent types, MCP (36 tools), plugin marketplace |
+| **4 Extensibility** | STRONG | 5 providers, agent type registry, MCP (36 tools), plugin marketplace |
 | **5 Feedback Loops / Evals** | **BROKEN** | `cost_usd == 0` on **3 of 5** efficiency records; no eval score for our own harness |
 
 **Principle 5 is the gap, and it is the one Wang weights highest.** He states the

package/docs/architecture/STATE-MACHINES.md

@@ -12,8 +12,8 @@ triggers and persistence, and source file references (file:line).
 
 **Last verified:** 2026-03-03 against v6.6.1 codebase (council-reviewed, merged via PR #49).
 
-**Current codebase:** v7.5.7 (2026-04-29). This document has NOT been re-verified
-end-to-end against v7.5.x. Treat shape/semantics as authoritative; treat line
+**Last partial review:** v7.5.7 (2026-04-29). This document has NOT been re-verified
+end-to-end since then. Treat shape/semantics as authoritative; treat line
 numbers as approximate. See "Known drift" and "Known additions" sections below
 before relying on any specific `file:line` reference.
 
@@ -520,25 +520,26 @@ Required provider variables (`loader.sh:65-83`):
 | PROVIDER_HAS_PARALLEL | `"true"` |
 | PROVIDER_DEGRADED | `"false"` |
 
-Supported providers: `claude`, `codex`, `gemini`, `cline`, `aider`
+Supported providers: `claude`, `codex`, `cline`, `aider`, `opencode` (Gemini was removed in v7.5.18)
 
 ### 4.2 Model Tier Selection
 
 Each provider maps the 3 RARV tiers to provider-specific model settings via
 `provider_get_tier_param()`.
 
-Source: `providers/claude.sh:101`, `providers/codex.sh:106`, `providers/gemini.sh:132`,
-`providers/cline.sh:102`, `providers/aider.sh:109`
+Source: `providers/claude.sh`, `providers/codex.sh`, `providers/cline.sh`,
+`providers/aider.sh`, `providers/opencode.sh`
 
 ```
-  RARV Tier     Claude (model)     Codex (effort)   Gemini (thinking)   Cline           Aider
-  ---------     --------------     --------------   -----------------   -----           -----
-  planning      opus               xhigh            high                single model*   single model**
-  development   opus (upgraded)    high             medium              single model*   single model**
-  fast          sonnet (upgraded)  low              low                 single model*   single model**
+  RARV Tier     Claude (model)     Codex (effort)   Cline           Aider            opencode
+  ---------     --------------     --------------   -----           -----            --------
+  planning      opus               xhigh            single model*   single model**   per-tier model***
+  development   opus (upgraded)    high             single model*   single model**   per-tier model***
+  fast          sonnet (upgraded)  low              single model*   single model**   per-tier model***
 
   * Cline: returns LOKI_CLINE_MODEL (default: "default"), single externally-configured model
   ** Aider: returns LOKI_AIDER_MODEL (default: "claude-3.7-sonnet"), single externally-configured model
+  *** opencode: PROVIDER_MODEL_PLANNING / _DEVELOPMENT / _FAST, one model unless overridden per tier
 
   Note: Claude default tier mapping upgrades development->opus and fast->sonnet.
   With LOKI_ALLOW_HAIKU=true: planning=opus, development=sonnet, fast=haiku (original mapping).
@@ -546,8 +547,8 @@ Source: `providers/claude.sh:101`, `providers/codex.sh:106`, `providers/gemini.s
 
 ### 4.3 Degradation States
 
-Source: `providers/claude.sh`, `providers/codex.sh`, `providers/gemini.sh`,
-`providers/cline.sh`, `providers/aider.sh`
+Source: `providers/claude.sh`, `providers/codex.sh`, `providers/cline.sh`,
+`providers/aider.sh`, `providers/opencode.sh`
 
 ```
   Tier 1: Full                Tier 2: Partial             Tier 3: Degraded
@@ -560,15 +561,6 @@ Source: `providers/claude.sh`, `providers/codex.sh`, `providers/gemini.sh`,
   | - -p flag prompt |        | - Single model    |       | - Positional prompt|
   +------------------+        +-------------------+       +-------------------+
 
-                                                          +-------------------+
-                                                          | Gemini            |
-                                                          | (Degraded)        |
-                                                          | - Sequential only |
-                                                          | - No MCP          |
-                                                          | - No subagents    |
-                                                          | - Positional prompt|
-                                                          +-------------------+
-
                                                           +-------------------+
                                                           | Aider             |
                                                           | (Degraded)        |
@@ -586,7 +578,7 @@ Provider capability matrix:
 | Claude   | true      | true     | true| false    |
 | Cline    | true      | false    | true| false    |
 | Codex    | false     | false    | true| true     |
-| Gemini   | false     | false    | false| true    |
+| opencode | false     | false    | true| false    |
 | Aider    | false     | false    | false| true    |
 
 When `PROVIDER_DEGRADED=true`:
@@ -1211,7 +1203,7 @@ Written atomically every 2 seconds by `run.sh` to `.loki/dashboard-state.json`.
   "iteration": 0,
   "complexity": "simple|standard|complex",
   "mode": "autonomous|interactive",
-  "provider": "claude|codex|gemini|cline|aider",
+  "provider": "claude|codex|cline|aider|opencode",
   "current_task": "...",
   "budget": {"limit": 0.0, "used": 0.0, "remaining": 0.0},
   "qualityGates": {"gate_name": {"status": "passed|failed"}}
@@ -1514,7 +1506,7 @@ Source: `autonomy/context-tracker.py`
          v
   Find session file
   Claude: ~/.claude/projects/<slug>/*.jsonl
-  Codex/Gemini: --tokens-input/--tokens-output args
+  Codex: --tokens-input/--tokens-output args
          |
          v
   Parse new entries from last_offset
@@ -1545,9 +1537,8 @@ Provider pricing (USD per million tokens):
 |----------|-------|--------|------------|----------------|
 | Claude | $3.00 | $15.00 | $0.30 | $3.75 |
 | Codex | $2.00 | $8.00 | -- | -- |
-| Gemini | $1.25 | $5.00 | -- | -- |
 
-Context window sizes: Claude=200K, Codex=200K, Gemini=1M
+Context window sizes: Claude=200K, Codex=200K
 
 Persistence: `.loki/context/tracking.json` (atomic write via temp+rename)
 
@@ -1797,7 +1788,7 @@ Override: `COMPLEXITY_TIER` environment variable (bypasses auto-detection)
   loki CLI ──exec──> run.sh ──source──> completion-council.sh
      |                  |                       |
      |                  +──source──> providers/loader.sh
-     |                  |               +──source──> claude.sh|codex.sh|gemini.sh|cline.sh|aider.sh
+     |                  |               +──source──> claude.sh|codex.sh|cline.sh|aider.sh|opencode.sh
      |                  |
      |                  +──python3──> memory/{engine,storage,retrieval,consolidation}.py
      |                  |

package/docs/architecture/bmad-integration-validation.md

@@ -90,7 +90,7 @@ With an adapter that also feeds architecture.md into the analyzer, score would b
 
 ## 3. Agent Overlap Analysis
 
-### BMAD Agents (8) vs Loki Agent Types (41)
+### BMAD Agents vs Loki Agent Types
 
 | BMAD Agent | Role | Loki Equivalent(s) | Relationship |
 |---|---|---|---|
@@ -98,7 +98,7 @@ With an adapter that also feeds architecture.md into the analyzer, score would b
 | John (PM) | PRD creation, validation | `prod-pm`, `orch-planner` | Overlapping -- Loki PM focuses on execution planning |
 | Winston (Architect) | Architecture design | `eng-infra`, `orch-planner` | Complementary -- BMAD architect is pre-code |
 | Sally (UX Designer) | UX specification | `prod-design` | Complementary -- BMAD UX is spec, Loki is implementation |
-| Amelia (Developer) | Code implementation | `eng-*` (8 agents) | Superseded -- Loki has specialized dev agents |
+| Amelia (Developer) | Code implementation | `eng-*` | Superseded -- Loki has specialized dev agents |
 | Bob (Scrum Master) | Sprint planning | `orch-coordinator` | Overlapping -- different abstraction level |
 | Quinn (QA) | E2E test generation | `eng-qa` | Overlapping -- both generate tests |
 | Barry (Quick Flow) | Solo rapid dev | No equivalent | Unique to BMAD |

package/docs/audit-logging.md

@@ -1,10 +1,10 @@
 # Audit Logging
 
-Compliance-ready audit trails for Loki Mode operations.
+Audit trails for Loki Mode operations.
 
 ## Overview
 
-Audit logging captures all significant events for compliance requirements (SOC2, HIPAA), security monitoring, debugging, and usage analytics. Audit logging is **enabled by default** as of v5.37.0.
+Audit logging captures significant events for security monitoring, debugging, and usage analytics. Audit logging is **enabled by default** as of v5.37.0.
 
 ## Configuration
 
@@ -189,17 +189,8 @@ Events by Actor:
 ### Tail Recent Entries
 
 ```bash
-# Last 20 entries
+# Last 20 entries of the newest log file (takes no flags)
 loki enterprise audit tail
-
-# Follow new entries in real-time
-loki enterprise audit tail --follow
-
-# Filter by event type
-loki enterprise audit tail --event session.start
-
-# Filter by level
-loki enterprise audit tail --level error
 ```
 
 ### Search and export logs
@@ -210,19 +201,20 @@ documented both, with filter flags that do not exist). The log is newline
 -delimited JSON on disk, so query and export it with ordinary tools:
 
 ```bash
-AUDIT=~/.loki/dashboard/audit/audit.jsonl
+# One file per day: ~/.loki/dashboard/audit/audit-YYYY-MM-DD.jsonl
+AUDIT=~/.loki/dashboard/audit
 
-# Search by event type
-jq -c 'select(.event == "auth.fail")' "$AUDIT"
+# Search by action
+cat "$AUDIT"/audit-*.jsonl | jq -c 'select(.action == "delete")'
 
 # Search by date range
-jq -c 'select(.timestamp >= "2026-02-01" and .timestamp <= "2026-02-15")' "$AUDIT"
+cat "$AUDIT"/audit-*.jsonl | jq -c 'select(.timestamp >= "2026-02-01" and .timestamp <= "2026-02-15")'
 
-# Search by actor
-jq -c 'select(.actor == "ci-bot")' "$AUDIT"
+# Search by user
+cat "$AUDIT"/audit-*.jsonl | jq -c 'select(.user_id == "ci-bot")'
 
-# Export a filtered slice
-jq -s 'map(select(.event == "task.fail"))' "$AUDIT" > errors.json
+# Export failed actions
+cat "$AUDIT"/audit-*.jsonl | jq -s 'map(select(.success == false))' > errors.json
 ```
 
 The built-in views:
@@ -442,68 +434,6 @@ loki audit scan --preset default
 this page showed `--action git_commit`, which is not implemented. Filter with
 `grep` or `jq` over `.loki/audit.jsonl` instead.
 
-## Compliance
-
-### SOC2
-
-Audit logging supports SOC2 requirements:
-
-- **CC6.1** - Logical access security (auth events)
-- **CC7.2** - System monitoring (session and task events)
-- **CC7.3** - Incident response (error events)
-
-Configuration:
-
-```yaml
-enterprise:
-  audit:
-    enabled: true
-    retention_days: 365  # 1 year minimum for SOC2
-    integrity_check: true
-    syslog_enabled: true
-```
-
-### HIPAA
-
-For healthcare applications:
-
-- Enable all authentication events
-- Set retention to minimum 6 years
-- Enable log encryption
-- Forward to SIEM for monitoring
-
-Configuration:
-
-```yaml
-enterprise:
-  audit:
-    enabled: true
-    retention_days: 2190  # 6 years
-    encrypt: true
-    integrity_check: true
-    syslog_enabled: true
-```
-
-### GDPR
-
-For European deployments:
-
-- Log access to personal data
-- Provide data export capability
-- Support right to deletion
-- Enable audit trail for data access
-
-Configuration:
-
-```yaml
-enterprise:
-  audit:
-    enabled: true
-    retention_days: 365
-    gdpr_compliance: true
-    log_data_access: true
-```
-
 ## Troubleshooting
 
 ### Logs Not Being Created
@@ -566,9 +496,6 @@ nc -zv syslog.example.com 514
 echo $LOKI_AUDIT_SYSLOG_HOST
 echo $LOKI_AUDIT_SYSLOG_PORT
 
-# View syslog errors in audit log
-loki enterprise audit tail --event syslog.error
-
 # Test manual syslog send
 logger -n syslog.example.com -P 514 "Test from Loki Mode"
 ```
@@ -591,7 +518,6 @@ logger -n syslog.example.com -P 514 "Test from Loki Mode"
 2. Rotate logs daily
 3. Compress rotated logs
 4. Set reasonable retention period
-5. Exclude high-volume low-value events (e.g., api.request)
 
 ### Compliance
 

package/docs/authentication.md

@@ -30,7 +30,7 @@ loki enterprise token generate my-token
 loki enterprise token generate ci-bot --scopes "read,write" --expires 30
 
 # With role
-loki enterprise token generate admin-bot --role admin --expires 90
+loki enterprise token generate admin-bot --scopes '*' --expires 90
 ```
 
 Output:
@@ -109,7 +109,7 @@ Predefined roles map to common access patterns:
 Generate token with role:
 
 ```bash
-loki enterprise token generate viewer-bot --role viewer
+loki enterprise token generate viewer-bot --scopes read
 ```
 
 Generate token with custom scopes:
@@ -302,8 +302,8 @@ curl https://accounts.google.com/.well-known/openid-configuration
 # Check client ID is correct
 echo $LOKI_OIDC_CLIENT_ID
 
-# View authentication logs
-loki enterprise audit tail --event auth.fail
+# View recent audit entries
+loki enterprise audit tail
 
 # Check redirect URI is whitelisted in identity provider
 # Should be: http://localhost:57374/auth/oidc/callback

package/docs/authorization.md

@@ -121,8 +121,8 @@ carry scopes directly.
 # Generate token with scopes
 loki enterprise token generate dev-1 --scopes control,read,write --expires 30
 loki enterprise token generate viewer-1 --scopes read --expires 90
-loki enterprise token generate auditor-1 --role auditor --expires 180
-loki enterprise token generate admin-1 --role admin --expires 365
+loki enterprise token generate auditor-1 --scopes read,audit --expires 180
+loki enterprise token generate admin-1 --scopes '*' --expires 365
 ```
 
 ### Configuration File
@@ -201,37 +201,6 @@ Scopes are additive:
 | `DELETE /api/enterprise/tokens/:id` | `*` | Admin only |
 | `POST /api/config` | `*` | Admin only |
 
-## Custom Roles
-
-Define custom roles for specific use cases:
-
-```yaml
-# .loki/config.yaml
-enterprise:
-  rbac:
-    custom_roles:
-      # Read-only with metrics access
-      metrics_viewer:
-        scopes: ["read"]
-        description: "View metrics and dashboard only"
-
-      # Task management only
-      task_manager:
-        scopes: ["read", "write"]
-        description: "Create and update tasks, no session control"
-
-      # Security analyst
-      security_analyst:
-        scopes: ["read", "audit"]
-        description: "View audit logs and security events"
-```
-
-Generate token with custom role:
-
-```bash
-loki enterprise token generate metrics-bot --role metrics_viewer
-```
-
 ## Permission Checks
 
 ### CLI
@@ -327,19 +296,19 @@ enterprise:
 ```bash
 # CI/CD pipeline token
 loki enterprise token generate github-actions \
-  --role operator \
+  --scopes control,read,write \
   --scopes "control,read,write" \
   --expires 365
 
 # Monitoring system token
 loki enterprise token generate datadog \
-  --role viewer \
+  --scopes read \
   --scopes "read" \
   --expires 9999
 
 # Security scanner token
 loki enterprise token generate security-scanner \
-  --role auditor \
+  --scopes read,audit \
   --scopes "read,audit" \
   --expires 180
 ```
@@ -350,9 +319,8 @@ loki enterprise token generate security-scanner \
 
 1. Start with minimal permissions (viewer role)
 2. Grant additional scopes only as needed
-3. Use custom roles for specific use cases
-4. Review and audit role assignments quarterly
-5. Remove unused tokens immediately
+3. Review and audit role assignments quarterly
+4. Remove unused tokens immediately
 
 ### Role Assignment
 
@@ -382,12 +350,12 @@ loki enterprise token list
 # Read the route's required scope from dashboard/server.py, then compare
 # against the scopes on your token from the listing above
 
-# Check audit log for denial reason
-loki enterprise audit tail --event permission.denied
+# Check recent audit entries for the denial
+loki enterprise audit tail
 
 # Generate new token with correct role
 loki enterprise token revoke <old-token>
-loki enterprise token generate <name> --role operator
+loki enterprise token generate <name> --scopes control,read,write
 ```
 
 ### OIDC Role Mapping Not Working
@@ -397,13 +365,13 @@ loki enterprise token generate <name> --role operator
 # Check identity provider configuration
 
 # Test with explicit token role first
-loki enterprise token generate test-admin --role admin
+loki enterprise token generate test-admin --scopes '*'
 
-# Check RBAC configuration
-cat .loki/config.yaml | grep -A 10 rbac
+# Check which claim carries the roles
+echo "$LOKI_OIDC_ROLES_CLAIM"
 
-# View OIDC claims in audit log
-loki enterprise audit tail --event auth.oidc.success
+# View recent audit entries
+loki enterprise audit tail
 ```
 
 ### Scope Confusion