loki-mode 10.6.6 → 10.6.7

package/.github/actions/issue-to-pr/action.yml

@@ -15,7 +15,7 @@ branding:
 # ran the agent; this one does not.
 #
 # Token co-location within THIS job: the fetch step below holds GH_TOKEN and
-# runs no agent; the agent step runs `loki start` on the pre-fetched PRD file
+# runs no agent; the agent step runs Loki 10 (`loki "<task>" --no-pr`) on the pre-fetched PRD text
 # and is given no token (GH_TOKEN/GITHUB_TOKEN/GH_ENTERPRISE_TOKEN/
 # GITHUB_ENTERPRISE_TOKEN all explicitly blanked, overriding anything the
 # caller's `uses:` step set at a level this composite's steps would otherwise
@@ -191,7 +191,8 @@ runs:
       env:
         LOKI_PROVIDER: ${{ inputs.provider }}
         LOKI_BUDGET_LIMIT: ${{ inputs.budget_limit }}
-        LOKI_MAX_ITERATIONS: ${{ inputs.max_iterations }}
+        LOKI_MAX_ITERATIONS: ${{ inputs.max_iterations }}  # not read by engine10
+        LOKI_E10_CAP_S: '2400'
         # The agent step never pushes or opens a PR (Rule of Two).
         LOKI_DELEGATE_PR: '0'
         ISSUE_REF: ${{ steps.ref.outputs.ref }}
@@ -213,29 +214,42 @@ runs:
 
         START_SHA="$(git rev-parse HEAD)"
         RC=0
-        loki start "$PRD_FILE" || RC=$?
+        # Loki 10 engine, routed explicitly: the task is prefixed so it is always
+        # multi-word and never starts with "-" (bin/loki sends a one-word or
+        # flag-first argument to the legacy CLI or a subcommand, and a body like
+        # "status" would otherwise run that subcommand). The task goes first and
+        # --no-pr after it, because a flag-first call also stays on legacy.
+        # --no-pr: engine10 ignores LOKI_DELEGATE_PR; this step holds no token.
+        # The run commits on loki/<runId> in this checkout, so HEAD has the change.
+        TASK="Resolve ${ISSUE_REF}. Task spec follows. $(cat "$PRD_FILE")"
+        loki "$TASK" --no-pr || RC=$?
 
         OUT="$RUNNER_TEMP/loki-out"
         mkdir -p "$OUT"
         git diff --binary "$START_SHA" HEAD -- . ':(exclude).loki' > "$OUT/loki.patch"
+        # PR body: the Loki 10 receipt this run sealed under .loki/runs/e10-*/.
+        # Rendered from the run's own receipt.md; the digest comes from receipt.json.
+        RUN_DIR="$(ls -d .loki/runs/e10-* 2>/dev/null | sort | tail -n 1)"
         {
           echo "Resolves ${ISSUE_REF}."
           echo ""
-          ID="$(cat .loki/state/last-proof-id.txt 2>/dev/null || true)"
-          LIB="$(npm root -g)/loki-mode/autonomy/lib/proof-pr.sh"
-          if [ -n "$ID" ] && [ -f ".loki/proofs/$ID/proof.json" ] && [ -f "$LIB" ]; then
-            # shellcheck source=/dev/null
-            . "$LIB" && render_evidence_receipt_md ".loki/proofs/$ID/proof.json" "" ""
+          if [ -n "$RUN_DIR" ] && [ -f "$RUN_DIR/receipt.md" ]; then
+            head -c 20000 "$RUN_DIR/receipt.md"
+            cp "$RUN_DIR/receipt.json" "$OUT/receipt.json" 2>/dev/null || true
+            SHA="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1])).get("receipt_sha256",""))' "$RUN_DIR/receipt.json" 2>/dev/null || true)"
+            echo ""
+            echo "Receipt digest (sha256): ${SHA:-unavailable}"
+            echo "Check it: download the loki-patch artifact of this run and run \`loki verify receipt.json\`."
           else
-            echo "Evidence Receipt: unavailable for this run."
+            echo "Evidence Receipt: unavailable for this run (no receipt under .loki/runs/)."
           fi
         } > "$OUT/pr-body.md"
         echo "patch=$OUT/loki.patch" >> "$GITHUB_OUTPUT"
         echo "pr_body=$OUT/pr-body.md" >> "$GITHUB_OUTPUT"
 
         echo "::warning::This action does not open the pull request (Rule of Two). Upload outputs.patch and open the PR from a job that holds the write token and runs no agent; see .github/workflows/loki-issue-to-pr.yml in asklokesh/loki-mode."
-        if [ -d .loki/proofs ]; then
-          echo "Evidence receipts under .loki/proofs/"
+        if [ -n "$RUN_DIR" ]; then
+          echo "Loki 10 receipt under $RUN_DIR/"
         fi
 
         exit "$RC"

package/.github/workflows/loki-issue-to-pr.yml

@@ -82,8 +82,10 @@ jobs:
           # to fetch the issue and withholds it from the agent session.
           GH_TOKEN: ${{ github.token }}
           ISSUE: ${{ github.event.issue.number || inputs.issue }}
-          LOKI_BUDGET_LIMIT: '10.00'
-          LOKI_MAX_ITERATIONS: '20'
+          # engine10 reads no cost or iteration cap; its only cap is wall time.
+          LOKI_E10_CAP_S: '2400'
+          LOKI_BUDGET_LIMIT: '10.00'      # not read by engine10; kept for the legacy path
+          LOKI_MAX_ITERATIONS: '20'       # not read by engine10; kept for the legacy path
           # Never push or open a PR from here; the publish job does that.
           LOKI_DELEGATE_PR: '0'
         run: |
@@ -97,7 +99,12 @@ jobs:
           git config user.email "${GITHUB_ACTOR:-loki-mode}@users.noreply.github.com"
 
           RC=0
-          loki start "${GITHUB_REPOSITORY}#${ISSUE}" || RC=$?
+          # Loki 10 issue entry. --no-pr is required: engine10 ignores
+          # LOKI_DELEGATE_PR, and this job's read-only token cannot push, open a
+          # PR or comment (supervisor.ts main: noPr drops opts.pr and opts.comment).
+          # The run commits on branch loki/<runId> checked out in this very
+          # checkout (stages/intake.ts ensureBranch), so HEAD carries the change.
+          loki "${GITHUB_REPOSITORY}#${ISSUE}" --no-pr || RC=$?
 
           OUT="$RUNNER_TEMP/loki-out"
           mkdir -p "$OUT"
@@ -105,17 +112,21 @@ jobs:
           # this run started from. .loki/ is run state, never part of the change.
           git diff --binary "$GITHUB_SHA" HEAD -- . ':(exclude).loki' > "$OUT/loki.patch"
 
-          # PR body: the evidence receipt this run wrote, when there is one.
+          # PR body: the Loki 10 receipt this run sealed under .loki/runs/e10-*/.
+          # Rendered from the run's own receipt.md; the digest comes from receipt.json.
+          RUN_DIR="$(ls -d .loki/runs/e10-* 2>/dev/null | sort | tail -n 1)"
           {
             echo "Resolves #${ISSUE}."
             echo ""
-            ID="$(cat .loki/state/last-proof-id.txt 2>/dev/null || true)"
-            LIB="$(npm root -g)/loki-mode/autonomy/lib/proof-pr.sh"
-            if [ -n "$ID" ] && [ -f ".loki/proofs/$ID/proof.json" ] && [ -f "$LIB" ]; then
-              # shellcheck source=/dev/null
-              . "$LIB" && render_evidence_receipt_md ".loki/proofs/$ID/proof.json" "" ""
+            if [ -n "$RUN_DIR" ] && [ -f "$RUN_DIR/receipt.md" ]; then
+              head -c 20000 "$RUN_DIR/receipt.md"
+              cp "$RUN_DIR/receipt.json" "$OUT/receipt.json" 2>/dev/null || true
+              SHA="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1])).get("receipt_sha256",""))' "$RUN_DIR/receipt.json" 2>/dev/null || true)"
+              echo ""
+              echo "Receipt digest (sha256): ${SHA:-unavailable}"
+              echo "Check it: download the loki-patch artifact of this run and run \`loki verify receipt.json\`."
             else
-              echo "Evidence Receipt: unavailable for this run."
+              echo "Evidence Receipt: unavailable for this run (no receipt under .loki/runs/)."
             fi
           } > "$OUT/pr-body.md"
 

package/README.md

@@ -42,12 +42,14 @@ loki doctor                       # checks your setup, names any blocker
 
 Upgrade with `loki self-update`. Long form: [Installation Guide](docs/INSTALLATION.md). `npm install -g loki-mode` installs the `latest` dist-tag; see [Release channels](#release-channels-next-and-latest) for `next`.
 
-**Loki needs a model to drive.** An `ANTHROPIC_API_KEY` alone is enough (the Claude Agent SDK ships inside Loki; on the default engine this path needs Bun and `LOKI_SDK_MODE=full`, see Setup details below), or point it at Claude Code, Cline, Codex, Aider or opencode. `loki doctor` tells you exactly what is missing.
+**Loki needs a model to drive.** An `ANTHROPIC_API_KEY` alone is enough (the Claude Agent SDK ships inside Loki; on the legacy engine this path needs Bun and `LOKI_SDK_MODE=full`, see Setup details below), or point it at Claude Code, Cline, Codex, Aider or opencode. `loki doctor` tells you exactly what is missing.
 
 ```bash
 export ANTHROPIC_API_KEY=sk-...
 loki doctor
-loki quick "fix the login bug"   # one small task on the Loki 10 engine
+loki quick "fix the login bug"   # one small task on the Loki 10 engine, no PR
+loki "fix the login redirect loop" --no-pr   # any task, Loki 10 engine
+loki owner/repo#123              # one GitHub, GitLab or Jira issue to a pull request, Loki 10 engine
 ```
 
 <details>
@@ -71,7 +73,7 @@ loki-seal is a Claude Code Stop hook that runs your repo's real test suite when
 
 ## Loki 10 engine
 
-Loki Mode now runs the v10 engine for all commands. <!-- loki10-default -->
+Loki 10 is the default engine for `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"`. <!-- loki10-default -->
 
 Guide, provider table and summary format: [docs/v10/GUIDE.md](docs/v10/GUIDE.md).
 
@@ -83,9 +85,9 @@ loki "fix the login redirect loop" --no-pr
 loki owner/repo#123
 ```
 
-The v10 engine accepts a quoted multi-word task, a GitHub, GitLab or Jira issue reference, `status`, `verify`, `dashboard`, and other subcommands. Flags (`loki-ts/src/engine10/cli.ts` USAGE): `--no-pr` builds and verifies without opening a pull request, `--deep` requests the deep verify pass and a longer implement budget, `--provider <name>` picks the coding provider (`--json` and `--verbose` are also parsed by the supervisor, see [Quiet output](#quiet-output)). The engine needs Bun; without it the command exits 1 with a message and installation instructions.
+The v10 engine accepts a quoted multi-word task, a GitHub, GitLab or Jira issue reference, `status`, `verify`, `dashboard`, and other subcommands. Flags (`loki-ts/src/engine10/cli.ts` USAGE): `--no-pr` builds and verifies without opening a pull request, `--deep` requests the deep verify pass and a longer implement budget, `--provider <name>` picks the coding provider, `--max-cost <usd>` sets the per-run cost cap (default $20.00, or `budgets.per_run` in `loki.yaml`; the flag wins; the start line prints it as `cap $20.00 (default)`; reaching it ends the run BUDGET_STOP, exit 3) (`--json` and `--verbose` are also parsed by the supervisor, see [Quiet output](#quiet-output)). The engine needs Bun; without it the command exits 1 with a message and installation instructions.
 
-Migration note: Legacy engine removed in 10.6.0; use `loki "<task>"`, `loki owner/repo#N`, or `loki backlog` instead.
+**Legacy engine (being removed).** The previous engine still ships in 10.6.6 and is reachable with `LOKI_ENGINE=legacy` or `loki legacy <args>`. `loki start owner/repo#N`, `loki start <issue URL>` and `loki start "<multi-word task>"` run on Loki 10, the same as `loki owner/repo#N` and `loki "<task>"`; `loki start ./prd.md`, a flag-first call and a one-word start stay on the legacy engine. For many issues use `loki backlog owner/repo --all|--label X|--issues N,N` (many issues, N in parallel, each on a `loki/backlog-N` worktree branch) instead. Legacy removal is planned and resumes on 2026-10-07; see [docs/v10/LEGACY-REMOVAL.md](docs/v10/LEGACY-REMOVAL.md). Sections below marked "legacy" describe features that run only on that engine.
 
 ### The state machine
 
@@ -115,14 +117,58 @@ flowchart TD
 | implement | A provider session makes the change, under a time budget (480s default, 1800s with `--deep`). |
 | verify and fix | Runs the checks. Failures feed up to 2 fix rounds (`MAX_FIX_ROUNDS`). The same failures three verifies running end the run as STALLED. |
 | commit and seal | Commits the diff, then writes `.loki/runs/<run-id>/receipt.json` and `receipt.md`, signed by default. |
-| pr | Opened by the supervisor, not the worker (the worker never holds a GitHub token). A non-VERIFIED run opens a draft PR. |
+| pr | Opened by the supervisor, not the worker (the worker never holds a GitHub token). A non-VERIFIED run opens a draft PR. The body is written for a 60-second review: what the issue asked, what changed, how it was tested, NOT PROVEN, then the receipt digest and `loki verify`. Data the run did not record prints "not recorded". |
 | deep verify | Detached, started after the PR opens (so not with `--no-pr`): full suite, app-boot probe, council, secret scan. A check that is refused or unavailable is reported as NOT PROVEN, never as red. `--deep` is a separate flag that raises the implement and run budgets. |
 
+PR body sample (`loki-ts/src/e10ext/reviewer_body.ts`):
+
+```
+## What the issue asked
+- handles empty input
+- rejects bad tokens
+
+## What changed and why
+- Why: Fix the parser
+- src/parser.ts
+- tests/parser.test.ts
+
+## How it was tested
+- Verdict: VERIFIED
+- Checks: 2 passed, 0 failed, 0 not run, 0 flaky (4 individual tests counted)
+- Command: `bun test tests/parser.test.ts` -> pass
+- Target tests (written before the fix): parser.test.ts
+- Before the fix: 2 failing, 0 passing on base; after: pass
+
+## NOT PROVEN
+- none
+
+## Receipt
+- Digest: sha256:ab12... (signed)
+- Verify: `loki verify run-1`
+```
+
 The run cap is 900s (2700s with `--deep`, `DEFAULT_CAP_S` and `DEEP_CAP_S` in `types.ts`); commit, seal and pr still run after the cap fires. A run whose cap fired and which did not verify exits BUDGET_STOP.
 
 A finished run prints a short summary (see [Quiet output](#quiet-output), which also shows an example) whose `NOT PROVEN` line is never empty by omission: deep checks deferred to the deep-verify pass are always listed there.
 
-`loki status [run-id]`, `loki verify [run-id]` and `loki dashboard` are built on the v10 path. Slack notifications are not part of the v10 engine surface yet.
+`loki status [run-id]` and `loki verify [run-id]` are built on the v10 path (bare `loki verify` follows the newest run, v10 or legacy). `loki dashboard` and `loki status` reach the v10 commands with `LOKI_ENGINE=v10`. Slack notifications are not part of the v10 engine surface yet.
+
+## Triggers without a cloud
+
+Both run on your own GitHub Actions minutes; there is no hosted service.
+
+- Issue to PR: copy `.github/workflows/loki-issue-to-pr.yml` into your repository. Label an issue `loki`, or comment `/loki` as an owner, member or collaborator, and it runs `loki owner/repo#N` (the Loki 10 engine) and opens a pull request with an evidence receipt. The agent job holds a read-only token; a separate publish job opens the PR. Set `ANTHROPIC_API_KEY` in repository secrets.
+- Nightly backlog: copy `examples/loki-nightly-backlog.yml` into `.github/workflows/`. Its `schedule:` trigger runs `loki backlog owner/repo --label loki`, one Loki 10 run per labeled open issue:
+
+```yaml
+on:
+  schedule:
+    - cron: '17 3 * * *'   # nightly, 03:17 UTC
+# ...
+      - run: loki backlog "${GITHUB_REPOSITORY}" --label loki --concurrency 2
+```
+
+`loki backlog` also takes `--all`, `--issues 1,2,3` and `--dry-run`. The nightly job runs the agent and a write token together, so label only issues you trust.
 
 ## Outcomes and exit codes
 
@@ -134,7 +180,7 @@ A v10 run ends in exactly one outcome. The mapping is `EXIT` in `loki-ts/src/eng
 | 0 | ALREADY_SATISFIED | The work was already done; evidence is recorded. |
 | 1 | FAILED | A check failed, the stage failed, or the event log was modified outside the engine. |
 | 2 | (usage) | No task given, not inside a git repository, or a preflight refusal. Nothing ran. |
-| 3 | BUDGET_STOP | The cost or time cap fired before the work finished. |
+| 3 | BUDGET_STOP | The cost cap (`--max-cost`, `budgets.per_run`, default $20.00) or the time cap fired before the work finished. |
 | 4 | BLOCKED | Spec conflict: the contract cannot be satisfied as written. The summary names the conflict (`spec conflict: <reason>`); the run never guesses and calls it done. |
 | 5 | STALLED | The same failures three verifies in a row. |
 
@@ -189,17 +235,6 @@ The first-run gate runs the README's default entry point for a new user on a thr
 
 Policy (D49): every green release is promoted to `latest` after the automated first-run gate. The promote workflow runs automatically after Post-Release Smoke succeeds; a failed smoke or gate leaves the version on `next`. `workflow_dispatch` remains for manual runs of an exact version.
 
-```mermaid
-flowchart LR
-    S[Slice: one engineer, own tests] --> M[Merge when green]
-    M --> T[Train: batch pushed once]
-    T --> CI[Full CI on the exact SHA]
-    CI --> N[npm next]
-    N --> G[Automated first-run gate on the installed version]
-    G -- pass --> L[npm latest, Docker latest, Homebrew]
-    G -- fail --> X[Stays on next, fix-forward slice]
-```
-
 ## loki doctor
 
 ```bash
@@ -214,6 +249,18 @@ Exit 0 when every required check passes; optional warnings (an absent provider C
 
 Migration: `loki modernize heal <repo> --assess` was a legacy command for read-only analysis. The v10 path `loki modernize <repo> --to <target>` is not yet finished: only `--dry-run` works (inventory, dependency graph, unit clustering, cost, time and risk estimate). A real run stops after the estimate and prints `modernize: oracle capture and execution are not built yet; use --dry-run`. Targets `python3` and `java21` exist; the Java dependency graph is not wired in yet. Design: [docs/v10/MODERNIZE.md](docs/v10/MODERNIZE.md), user summary: [docs/v10/GUIDE-MODERNIZE.md](docs/v10/GUIDE-MODERNIZE.md).
 
+## Control Plane v0 (preview)
+
+A local control plane and UI for many runs, off by default. Enable it with `LOKI_CONTROL=1`:
+
+```bash
+LOKI_CONTROL=1 loki control serve        # 127.0.0.1, default port 47821 (--port N, --db PATH)
+LOKI_CONTROL=1 loki control backfill .   # ship ./.loki/runs to the control plane
+LOKI_CONTROL=1 loki control status       # reachable? how many runs held?
+```
+
+The URL comes from `LOKI_CONTROL_URL`, else `http://127.0.0.1:${LOKI_CONTROL_PORT:-47821}`. Set `LOKI_CONTROL_URL` on a run to ship it live. See [docs/v10/CONTROL-PLANE.md](docs/v10/CONTROL-PLANE.md).
+
 ## Providers
 
 Loki's autonomy and quality loop are the product; the coding CLI is swappable. With `LOKI_PROVIDER` unset, Loki auto-detects the first installed provider in this order (`providers/loader.sh`): claude, cline, codex, aider, opencode. An explicit choice always wins and is never silently substituted. Gemini CLI is deprecated: `LOKI_PROVIDER=gemini` exits with a migration message.
@@ -284,13 +331,13 @@ completion claim is backed by deterministic evidence and is independently
 re-checkable; it does not claim the generated code is bug-free.
 
 <details>
-<summary><b>Setup details: providers, other models, what loki doctor checks</b></summary>
+<summary><b>Setup details: providers, other models, what loki doctor checks (PRD-file examples use the legacy `loki start`)</b></summary>
 
-Other spec sources work the same way:
+The `loki start <file>` examples below run on the legacy engine (being removed). A `loki start` call with an issue ref, an issue URL or a quoted multi-word task runs on Loki 10; the provider and model variables apply to both engines. Other spec sources on the legacy engine:
 
 ```bash
 loki init my-app --template simple-todo-app    # scaffold a starter PRD
-loki start owner/repo#123                      # a GitHub issue
+loki start owner/repo#123                      # a GitHub issue (Loki 10; same as: loki owner/repo#123)
 loki start ./openapi.yaml                      # an OpenAPI/YAML spec
 loki demo --offline                            # replay a sample receipt, no key, no spend
 ```
@@ -381,7 +428,7 @@ Required:
 
 - An agent provider CLI: [Claude Code](https://docs.claude.com/en/docs/claude-code) (`claude`, Tier 1, recommended and E2E-verified - the provider Loki Mode is built for). Cline, Codex, Aider, and opencode are supported as experimental providers (wiring in place; not yet E2E-verified by us). Loki cannot run a build without one of these installed and authenticated.
 - Python 3.8+ (`python3`) for the dashboard, memory system, and orchestration helpers.
-- Node.js 18+ (`node`) for the npm install path and the bundled runtime.
+- Node.js 20+ (`node`) for the npm install path and the bundled runtime.
 - `jq` for the JSON that the shell flows and the quality gates parse.
 - Git 2.x (`git`) for checkpoints and worktrees.
 - `curl` for installation and network calls.
@@ -414,9 +461,9 @@ See the [Installation Guide](docs/INSTALLATION.md) for the long form.
 ---
 
 <details>
-<summary><strong>Runtime architecture: dual Bash/Bun runtime and the rollback flag</strong></summary>
+<summary><strong>Runtime architecture: dual Bash/Bun runtime</strong></summary>
 
-Loki Mode v10 runs on the Bun runtime by default, which hosts the autonomous build engine. Bash is used for system integration where needed.
+The Loki 10 engine runs on the Bun runtime. The legacy engine is Bash (`autonomy/loki`) and is being removed.
 
 - Commands that require Bun: `version`, `--version`, `-v`, `status`, `stats`, `doctor`, `provider`, `memory`, `rollback`, `kpis`, `trust`, `wiki`, `crash`, `internal`, and `report kpis`.
 - If `bun` is not on `PATH`, commands exit 1 with installation instructions.
@@ -427,9 +474,9 @@ See [UPGRADING.md](UPGRADING.md) and [ADR-001: Runtime Migration](docs/architect
 </details>
 
 <details>
-<summary><strong>Supported spec formats</strong></summary>
+<summary><strong>Supported spec formats (legacy engine, being removed)</strong></summary>
 
-A "spec" is whatever you hand `loki start`. Loki auto-detects the format and normalises it before the RARV loop. A Markdown PRD is one form of spec; the table below lists every input the CLI accepts.
+Loki 10 takes a quoted task or an issue reference (GitHub, GitLab or Jira), also through `loki start`. The table below describes the legacy `loki start`, which accepts files too; rows for an issue ref or an issue URL run on Loki 10. A "spec" is whatever you hand `loki start`. Loki auto-detects the format and normalises it before the RARV loop. A Markdown PRD is one form of spec; the table below lists every input the CLI accepts.
 
 | Format | Example | Notes |
 |--------|---------|-------|
@@ -460,31 +507,34 @@ For how Loki compares with other tools, see [docs/COMPARISON.md](docs/COMPARISON
 <details>
 <summary><strong>All commands</strong></summary>
 
+Loki 10 engine:
+
 | Command | Description |
 |---------|-------------|
-| `loki start [PRD]` | Start with optional PRD file (also accepts an issue ref; replaces deprecated `loki run`). Auto-opens the dashboard in the browser for interactive runs and passes native `--effort`/`--max-budget-usd`/`--fallback-model` for resilience (v7.25.0) |
-| `loki stop` | Stop execution |
-| `loki modernize heal <path>` | Legacy system healing (archaeology, stabilize, isolate, modernize, validate -- v6.67.0; was: `loki heal`) |
-| `loki pause` / `resume` | Pause/resume after current session |
-| `loki steer "<note>"` | Nudge a running build with a directive (writes `.loki/HUMAN_INPUT.md`; the loop reads it when `LOKI_PROMPT_INJECTION=1`) (v8.0.0) |
-| `loki status` | Show current status |
-| `loki why` | Explain the last outcome; on a stalled run names the real stall reason (proactive stuck-detector + convergence signal) and suggests `loki steer` (v8.0.0) |
-| `loki cockpit` | Live multi-repo status as an inline terminal image (Kitty/iTerm2/WezTerm/Ghostty); text + dashboard fallback elsewhere (v7.126.0) |
-| `loki dashboard` | Open web dashboard |
-| `loki preview` | Print running app URL and open in browser (Live App Preview, v7.24.0; was: `loki open`) |
-| `loki web` | Launch Purple Lab web UI [DEPRECATED in v7.44.0 -- use `loki start` which auto-opens the dashboard at http://localhost:57374] |
-| `loki doctor` | Check environment and dependencies |
-| `loki plan [PRD]` | Pre-execution analysis: complexity, cost, iterations |
-| `loki review [--staged\|--diff]` | AI-powered code review with severity filtering |
-| `loki test [--file\|--dir\|--changed]` | AI test generation |
-| `loki analyze onboard [path]` | Project analysis and CLAUDE.md generation (was: `loki onboard`) |
-| `loki import` | Import GitHub issues as tasks |
-| `loki ci` | CI/CD quality gate integration |
-| `loki failover` | Cross-provider auto-failover management |
-| `loki memory <cmd>` | Memory system: index, timeline, search, consolidate |
-| `loki enterprise` | Enterprise feature management |
+| `loki "<task>" [--no-pr] [--deep] [--provider NAME] [--max-cost USD]` | Build a task, verify it, seal a signed receipt, open a PR |
+| `loki owner/repo#N` | Same, from a GitHub, GitLab or Jira issue |
+| `loki quick "<task>"` | Small task, lean path, no PR |
+| `loki backlog owner/repo --all\|--label X\|--issues N,N` | Run every matching open issue, N in parallel (`--concurrency N`, `--dry-run`) |
+| `loki status [--json]` | Current status |
+| `loki verify [run-id]` | Re-check a sealed receipt (exit codes above) |
+| `loki doctor [--json] [--airgap]` | Check environment and providers |
+| `LOKI_CONTROL=1 loki control serve\|backfill\|status` | Control Plane v0 preview |
+| `loki modernize <repo> --to <target> --dry-run` | Estimate only |
+| `loki plan [PRD]` | Dry-run analysis: complexity, cost, execution plan |
 | `loki version` | Show version |
 
+Legacy engine, being removed (these run on the previous engine; `loki --help` still lists them):
+
+| Command | Description |
+|---------|-------------|
+| `loki start [PRD\|ISSUE-REF\|"TASK"]` | An issue ref, an issue URL or a quoted multi-word task runs on Loki 10 (same as `loki owner/repo#N`); a PRD file, a flag-first call or a one-word start runs the legacy build |
+| `loki stop`, `pause`, `resume` | Control a legacy run |
+| `loki steer "<note>"` | Nudge a legacy run (needs `LOKI_PROMPT_INJECTION=1`) |
+| `loki why`, `loki next` | Explain or continue a legacy run |
+| `loki dashboard` | Operations UI server (`start\|stop\|status\|url\|open`) |
+| `loki review`, `loki test`, `loki analyze`, `loki memory`, `loki failover`, `loki enterprise`, `loki import`, `loki ci` | Review, test generation, codebase analysis, memory, failover, enterprise, issue import, CI gate |
+| `loki modernize heal <path>` | Legacy system healing |
+
 </details>
 
 Run `loki --help` for all options. Full reference: [CLI Reference](wiki/CLI-Reference.md) | Config: [config.example.yaml](autonomy/config.example.yaml)
@@ -495,7 +545,7 @@ Pass a config file to `loki start` with `--config <path>` (aliases `--env-file`,
 ---
 
 <details>
-<summary><strong>Configuration env vars (intelligent defaults, opt-out knobs)</strong></summary>
+<summary><strong>Configuration env vars (legacy engine knobs, opt-out)</strong></summary>
 
 Loki Mode's accuracy and autonomy behaviors are default-on. Each is an opt-out escape hatch, not a setting you have to discover. The most relevant knobs from the v7.41.x accuracy/autonomy hardening:
 
@@ -516,7 +566,7 @@ This is a subset. See the [wiki](wiki/Home.md) for the full env-var reference an
 </details>
 
 <details>
-<summary><strong>BMAD Method Integration</strong></summary>
+<summary><strong>BMAD Method Integration (legacy engine, being removed)</strong></summary>
 
 Loki Mode integrates with the [BMAD Method](https://github.com/bmad-code-org/BMAD-METHOD), a structured AI-driven agile methodology. If your project uses BMAD for requirements elicitation, Loki Mode can consume those artifacts directly:
 
@@ -533,7 +583,7 @@ See [BMAD Integration Validation](docs/architecture/bmad-integration-validation.
 <details>
 <summary><strong>Enterprise Features</strong></summary>
 
-Enterprise features are included but require env var activation.
+Enterprise features are free, included, and need no license key. They are activated with env vars. (Legacy engine surface, being removed with it.)
 
 ```bash
 export LOKI_ENTERPRISE_AUTH=true                 # token auth (dashboard/auth.py)
@@ -561,7 +611,7 @@ loki enterprise status
 | **Testing** | 8 automated quality gates | Test quality depends on AI assertions |
 | **Providers** | Claude, Cline, Codex, Aider and opencode | Non-Claude providers are experimental and mostly sequential |
 | **Dashboard** | Real-time single-machine monitoring | No multi-node clustering |
-| **Loki 10** | The v10 run, `status`, `verify`, `dashboard` | Not the default yet; `loki modernize <repo> --to` runs `--dry-run` only; Slack is not wired in |
+| **Loki 10** | The v10 run (`loki "<task>"`, `loki owner/repo#N`, `loki quick`), `status`, `verify`, `backlog` | `loki start <issue ref|issue URL|"task">` runs Loki 10, `loki start <file>` stays legacy; `loki modernize <repo> --to` runs `--dry-run` only; Slack is not wired in; Control Plane v0 is a preview |
 
 > **What "autonomous" means:** the system runs RARV cycles without prompting. It does NOT access your cloud accounts, payment systems or external services unless you provide credentials. Human oversight is expected for deployment, API keys and critical decisions.
 
@@ -603,7 +653,7 @@ See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.
 
 ## License
 
-[Business Source License 1.1](LICENSE) -- Free for personal, internal, academic, and non-commercial use. Converts to Apache 2.0 on March 19, 2030. Contact founder@autonomi.dev for commercial licensing.
+[Business Source License 1.1](LICENSE) -- Free for personal, internal, academic, and non-commercial use. Converts to Apache 2.0 on March 19, 2030. Contact founder@autonomi.dev for other licensing arrangements.
 
 ---
 

package/SKILL.md

@@ -3,7 +3,9 @@ name: loki-mode
 description: An autonomous software factory that knows what it is supposed to deliver, and proves it did. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v10.6.6
+# Loki Mode v10.6.7
+
+**Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the legacy engine, which still ships and is being removed (`loki start owner/repo#N` still routes to it; prefer `loki owner/repo#N`).
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -11,7 +13,7 @@ description: An autonomous software factory that knows what it is supposed to de
 
 **Evidence Receipt (verify it yourself).** Every run writes a receipt to `.loki/proofs/<run_id>/` (opt out with `LOKI_PROOF=0`) that separates deterministic FACTS (git diff with base/head SHAs and a `diff_sha256`, the test command + exit code, the build command + exit code, each gate verdict) from AI ASSESSMENTS (the council verdict, labeled judgment not proof). The headline is computed only from the facts: VERIFIED (tests ran a real command and exited 0, diff non-empty, nothing skipped), VERIFIED WITH GAPS (each gap listed by name), or NOT VERIFIED (a check ran and failed). Inspect and re-check with `loki proof list|show <id>|verify <id>` (aliased `loki receipt`); `loki proof verify` re-hashes the receipt (tamper) and re-derives the diff from the recorded base SHA against the live repo (drift), exiting 0 clean / 1 tamper-or-drift / 2 could not check (64 usage, 66 unknown id; see `docs/exit-codes.md`). This is honesty-of-done, not a claim that the code is bug-free.
 
-**Provider-agnostic (stable since v5.0.0):** runs on Claude/Codex/Cline/Aider with abstract model tiers and degraded mode for non-Claude providers; no vendor lock-in. Gemini deprecated v7.5.18. See `skills/providers.md`. **Current track (v8.0.0):** the Anthropic Agent SDK route (see below), spec-mode expansion for OpenAPI/GraphQL/Postman contracts, the runtime-boot and secret-leak evidence axes, and `loki steer` / `loki why` for mid-run control. Earlier tracks: LSP grounding as a first-class agent tool (v7.7.x) and Phase 1 RARV-C closure (real provider judges, gate-failure flock, synthetic PRD e2e, status `--json`).
+**Provider-agnostic (stable since v5.0.0):** runs on Claude/Codex/Cline/Aider with abstract model tiers and degraded mode for non-Claude providers; no vendor lock-in. Gemini deprecated v7.5.18. See `skills/providers.md`. **Legacy track (v8.0.0):** the Anthropic Agent SDK route (see below), spec-mode expansion for OpenAPI/GraphQL/Postman contracts, the runtime-boot and secret-leak evidence axes, and `loki steer` / `loki why` for mid-run control. Earlier tracks: LSP grounding as a first-class agent tool (v7.7.x) and Phase 1 RARV-C closure (real provider judges, gate-failure flock, synthetic PRD e2e, status `--json`).
 
 **Runtime migration:** Bash-to-Bun migration. Read-only commands (`version`, `status`, `stats`, `doctor`, `provider show/list`, `memory list/index`) flow through Bun runtime via `bin/loki` since v7.3.0. Every other command remains on the Bash runtime (`autonomy/loki`). Rollback: `LOKI_LEGACY_BASH=1`. See `UPGRADING.md` and `docs/architecture/ADR-001-runtime-migration.md`.
 
@@ -105,13 +107,13 @@ These rules guide autonomous operation. Test results and code quality always tak
 | Integration tests, E2E, deployment | **development** | opus | sonnet | effort=high |
 | Unit tests, linting, docs, simple fixes | **fast** | sonnet | haiku | effort=low |
 
-**Parallelization rule (Claude only):** Launch up to 10 agents simultaneously for independent tasks.
+**Parallelization rule (Claude only):** Launch independent tasks in parallel.
 
 **Degraded mode (Codex/Cline/Aider):** No parallel agents or Task tool. Codex has MCP support. Runs RARV cycle sequentially. See `skills/model-selection.md`.
 
 **Git worktree parallelism:** For true parallel feature development, use `--parallel` flag with run.sh. See `skills/parallel-workflows.md`.
 
-**Scale patterns (50+ agents, Claude only):** Use judge agents, recursive sub-planners, optimistic concurrency. See `references/cursor-learnings.md`.
+**Scale patterns (Claude only):** Use judge agents, recursive sub-planners, optimistic concurrency. See `references/cursor-learnings.md`.
 
 ---
 
@@ -195,7 +197,7 @@ This protocol governs **skill module** loading -- task-scoped instruction files
 
 ## Invocation
 
-**Unified entry point (v6.84.0):** `loki start [SPEC|ISSUE-REF]` auto-detects whether the input is a PRD file, an issue URL, an issue number, or another spec format (e.g. OpenAPI). No need to pick between `loki start` and `loki run` -- the single command handles all cases.
+**Legacy entry point (v6.84.0, being removed; for Loki 10 use `loki "<task>"` or `loki owner/repo#N`):** `loki start [SPEC|ISSUE-REF]` auto-detects whether the input is a PRD file, an issue URL, an issue number, or another spec format (e.g. OpenAPI). No need to pick between `loki start` and `loki run` -- the single command handles all cases.
 
 ```bash
 # Standard mode (Claude - full features)
@@ -459,15 +461,16 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 | Bun runtime (Phase 2+) | TBD | Migrate write-path commands; tracked on `feat/bun-migration` |
 | Managed Agents multiagent path | TBD | `LOKI_EXPERIMENTAL_MANAGED_*` flags -- RESEARCH PREVIEW, not on live API |
 | Benchmarks | TBD | Runner scripts and datasets exist in `benchmarks/`; no published results |
-| `loki run` removal | next major | Currently a deprecated alias for `loki start` |
+| `loki run` removal | with legacy removal | Currently a deprecated alias for `loki start` |
 
 ## Deprecated
 
 | Item | Deprecated In | Notes |
 |------|---------------|-------|
-| `loki run <issue>` | v6.84.0 | Alias for `loki start`. Will be removed in next major. |
+| `loki run <issue>` | v6.84.0 | Alias for `loki start`. Removal is part of the planned legacy removal. |
+| `loki start`, RARV skill loop | v10.6.6 | Legacy engine, planned for removal; use `loki "<task>"` / `loki owner/repo#N`. |
 | VSCode extension (`vscode-extension/`) | v7.2.0 | No longer actively maintained; dashboard web UI is the supported front-end. |
 
 ---
 
-**v10.6.6 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**
+**v10.6.7 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-10.6.6
+10.6.7

package/autonomy/loki

@@ -1872,12 +1872,39 @@ for p in range(int(sys.argv[1]), int(sys.argv[1]) + 100):
 PY
 }
 
+# Fail-closed reuse check for a dashboard found via the ~/.loki/dashboard
+# registry or a busy port: reusable only if /health reports THIS package's
+# version AND realpath, and GET / is 200 text/html. Any missing field, curl
+# error or mismatch means "not ours". Mirrors _loki_dashboard_reusable in run.sh.
+_loki_dashboard_port_is_ours() {
+    local port="$1" want want_pkg health probe
+    case "$port" in ''|*[!0-9]*) return 1 ;; esac
+    want="$(tr -d '[:space:]' <"$SKILL_DIR/VERSION" 2>/dev/null)" || return 1
+    [ -n "$want" ] || return 1
+    want_pkg="$(cd "$SKILL_DIR" 2>/dev/null && pwd -P)" || return 1
+    health="$(curl -s --max-time 2 "http://127.0.0.1:${port}/health" 2>/dev/null)" || return 1
+    case "$health" in
+        *"\"version\":\"${want}\""* | *"\"version\": \"${want}\""*) ;;
+        *) return 1 ;;
+    esac
+    case "$health" in
+        *"\"package\":\"${want_pkg}\""* | *"\"package\": \"${want_pkg}\""*) ;;
+        *) return 1 ;;
+    esac
+    probe="$(curl -s -o /dev/null -w '%{http_code} %{content_type}' --max-time 2 "http://127.0.0.1:${port}/" 2>/dev/null)" || return 1
+    case "$probe" in "200 text/html"*) return 0 ;; esac
+    return 1
+}
+
 cmd_ui() {
     local port="" pid=""
     if [ -f "$DASHBOARD_PID_FILE" ]; then
         pid=$(cat "$DASHBOARD_PID_FILE" 2>/dev/null)
         if [ -n "$pid" ] && kill -0 "$pid" 2>/dev/null; then
             port=$(cat "${DASHBOARD_PID_DIR}/port" 2>/dev/null)
+            # A registry entry whose live server is not this package's dashboard
+            # (stale, foreign worktree, other version) is never reused.
+            _loki_dashboard_port_is_ours "$port" || port=""
         fi
     fi
     if [ -z "$port" ]; then
@@ -3759,9 +3786,18 @@ cmd_start() {
                 # + cockpit, honoring the card's "open dashboard" promise. The
                 # cockpit hint is printed by _loki_start_handoff for the Both path.
                 args+=("--bg")
-                local _du="http://127.0.0.1:${LOKI_DASHBOARD_PORT:-57374}"
-                # stdout must stay unredirected: loki_open_url checks the TTY.
-                loki_open_url "$_du" 2>/dev/null &
+                # Open the URL the runner PUBLISHES for the port it actually bound
+                # or reused (it walks past refused ports); never guess the default
+                # 57374, which may be a foreign or stale dashboard. stdout must
+                # stay unredirected: loki_open_url checks the TTY.
+                local _dfile="${PWD}/.loki/dashboard/url"
+                rm -f "$_dfile" 2>/dev/null
+                (
+                    for _ in $(seq 1 120); do
+                        if [ -s "$_dfile" ]; then loki_open_url "$(head -1 "$_dfile")" 2>/dev/null; exit 0; fi
+                        sleep 0.5
+                    done
+                ) &
                 ;;
             launch-bg-watch)
                 # Watch (cockpit only) detaches without opening the browser.
@@ -7482,13 +7518,15 @@ cmd_dashboard_start() {
     if [ -f "$DASHBOARD_PID_FILE" ]; then
         local existing_pid
         existing_pid=$(cat "$DASHBOARD_PID_FILE" 2>/dev/null)
-        if [ -n "$existing_pid" ] && kill -0 "$existing_pid" 2>/dev/null; then
+        if [ -n "$existing_pid" ] && kill -0 "$existing_pid" 2>/dev/null \
+            && _loki_dashboard_port_is_ours "$(cat "${DASHBOARD_PID_DIR}/port" 2>/dev/null)"; then
             echo -e "${YELLOW}Dashboard server already running (PID: $existing_pid)${NC}"
             echo ""
             cmd_dashboard_status
             exit 0
         fi
-        # Stale PID file, remove it
+        # Stale PID file, or a live server that is not this package's dashboard
+        # (never killed here, just not reused): remove the registry entry.
         rm -f "$DASHBOARD_PID_FILE"
     fi