loki-mode 10.6.6 → 10.6.7

package/autonomy/run.sh

@@ -19183,6 +19183,14 @@ _loki_dashboard_reusable() {
     return 1
 }
 
+# Publish the URL of the port actually bound or reused, so the launcher (bg
+# banner, browser opener) never guesses the default 57374 after start_dashboard
+# walked past a refused port.
+_loki_publish_dashboard_url() {
+    mkdir -p .loki/dashboard 2>/dev/null || return 0
+    printf '%s\n' "$1" > .loki/dashboard/url.tmp 2>/dev/null && mv -f .loki/dashboard/url.tmp .loki/dashboard/url 2>/dev/null || true
+}
+
 start_dashboard() {
     loki_background_services_enabled || return 0
     log_header "Starting Loki Dashboard"
@@ -19262,6 +19270,7 @@ start_dashboard() {
     if [ "${DASHBOARD_REUSED:-0}" = "1" ]; then
         export LOKI_DASHBOARD_PORT="$DASHBOARD_PORT"
         log_info "Dashboard already live on port $DASHBOARD_PORT; reusing it."
+        _loki_publish_dashboard_url "http://127.0.0.1:${DASHBOARD_PORT}/"
         return 0
     fi
 
@@ -19419,6 +19428,7 @@ start_dashboard() {
         DASHBOARD_LAST_ALIVE=$(date +%s)
         log_info "Dashboard started (PID: $DASHBOARD_PID)"
         log_info "Dashboard: ${CYAN}${url_scheme}://127.0.0.1:$DASHBOARD_PORT/${NC}"
+        _loki_publish_dashboard_url "${url_scheme}://127.0.0.1:${DASHBOARD_PORT}/"
 
         # Auto-open the dashboard in the browser, but ONLY for an interactive
         # foreground session. loki_open_url (lib/browser-open.sh) refuses on
@@ -28816,6 +28826,8 @@ main() {
         fi
         # Initialize .loki directory first
         mkdir -p .loki/logs
+        # A url left by an earlier run must never be mistaken for this child's.
+        rm -f .loki/dashboard/url
 
         local log_file=".loki/logs/background-$(date +%Y%m%d-%H%M%S).log"
         local pid_file
@@ -28869,6 +28881,19 @@ main() {
         echo "$bg_pid" > "$pid_file"
         register_pid "$bg_pid" "background-session" "log=$log_file"
 
+        # The child picks the dashboard port (it walks past refused ports), so
+        # print the URL it publishes, never the requested default.
+        local _bg_dash_line="disabled (LOKI_DASHBOARD=false)"
+        if [ "$ENABLE_DASHBOARD" = "true" ] && loki_background_services_enabled; then
+            _bg_dash_line="starting (run: loki dashboard url, or see $log_file)"
+            local _bg_i
+            for _bg_i in $(seq 1 60); do
+                if [ -s .loki/dashboard/url ]; then _bg_dash_line="$(head -1 .loki/dashboard/url)"; break; fi
+                kill -0 "$bg_pid" 2>/dev/null || break
+                sleep 0.5
+            done
+        fi
+
         echo ""
         echo -e "${GREEN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
         echo -e "${GREEN}  Loki Mode Running in Background${NC}"
@@ -28878,7 +28903,7 @@ main() {
         echo -e "  ${CYAN}Path:${NC}       $project_path"
         echo -e "  ${CYAN}PID:${NC}        $bg_pid"
         echo -e "  ${CYAN}Log:${NC}        $log_file"
-        echo -e "  ${CYAN}Dashboard:${NC}  http://127.0.0.1:${DASHBOARD_PORT}/"
+        echo -e "  ${CYAN}Dashboard:${NC}  ${_bg_dash_line}"
         echo ""
         echo -e "${YELLOW}Control Commands:${NC}"
         echo -e "  ${DIM}Pause:${NC}      touch .loki/PAUSE"

package/bin/loki

@@ -350,6 +350,14 @@ case "${LOKI_ENGINE:-$_loki_engine_default}" in
                     *) _e10=1; _e10_args=(--no-pr "${@:2}") ;;
                 esac
                 ;;
+            # D58: `loki start <issue ref|issue URL|"multi-word task">` takes the same v10 path as
+            # `loki <ref>`; any other start call (PRD file, flags first, one word) stays legacy.
+            start)
+                case "${2:-}" in
+                    */*\#[0-9]*|http*://*/issues/*|http*://*/browse/*|*" "*) _e10=1; _e10_args=("${@:2}") ;;
+                    *) _e10=0 ;;
+                esac
+                ;;
             # http*://*/issues/* also covers GitLab's /-/issues/ URLs.
             */*\#[0-9]*|http*://*/issues/*|http*://*/browse/*) _e10=1 ;;
             *" "*) _e10=1 ;;

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "10.6.6"
+__version__ = "10.6.7"
 
 # Expose the control app for easy import
 try:

package/docs/AUDIT-CHAIN-THREAT-MODEL.md

@@ -32,7 +32,7 @@ The history was replaced wholesale and `verifyChain()` reported `valid: true`.
 `dashboard/audit.py` is a separate implementation with the same property:
 genesis is the constant `"0" * 64` (`:58`, `:115`), and `_compute_chain_hash`
 (`:194-200`) is an unkeyed `sha256(prev_hash + entry_json)`. Its own docstring
-at `:197` calls the result tamper-evident. Forged with the writer's exact recipe
+at `:197` overstates what the chain proves. Forged with the writer's exact recipe
 (`json.dumps(entry, sort_keys=True, default=str)`, field `_integrity_hash`,
 `:369-371`), `verify_log_integrity` reports:
 

package/docs/DEMOS.md

@@ -1,24 +1,12 @@
 # Loki Mode -- Interactive Content Index
 
-Complete listing of all interactive HTML experiences in the Loki Mode repository. 13 files total across three categories.
+Complete listing of all interactive HTML experiences in the Loki Mode repository. 8 files total across three categories.
 
-## Walkthroughs (6 HTML files)
+## Overview (1 HTML file)
 
-Located in `docs/walkthrough/`.
-
-| File | Title | Description |
-|------|-------|-------------|
-| `index.html` | Build Your First App | Step-by-step tutorial from PRD to deployment |
-| `architecture.html` | System Architecture | Interactive SVG diagram of the full system |
-| `comparison.html` | Feature Comparison | Loki Mode vs competitor feature matrix |
-| `gallery.html` | Project Gallery | Example projects across categories |
-| `video-placeholder.html` | Build Process Animation | CSS-animated build walkthrough |
-| `hub.html` | Walkthrough Hub | Links to all walkthroughs with categories and estimated durations |
-
-An earlier version of this page also listed `build-demo.html`, `ide-demo.html`,
-`enterprise-demo.html`, `provider-race-demo.html`, `memory-demo.html`, and
-`dashboard-demo.html`. None of those files exist in the repository; they have
-been removed from the list rather than left as broken references.
+`docs/overview.html`: Loki Mode 10 explained in five views (Users, Engineers,
+Architects, Executives, Pitch), with Mermaid flow diagrams. It replaces the six
+legacy-era pages that used to live in `docs/walkthrough/`.
 
 ## Demo Apps (6 HTML files)
 
@@ -43,28 +31,25 @@ Located in `examples/`. Each was generated by Loki Mode from a single prompt.
 
 | Category | Count |
 |----------|-------|
-| Walkthroughs | 6 |
+| Overview | 1 |
 | Demo Apps | 6 |
 | Product Website | 1 |
-| **Total** | **13** |
+| **Total** | **8** |
 
 ## Viewing Locally
 
 All files are self-contained HTML. Open directly in any browser:
 
 ```bash
-# Open the demo hub (links to everything)
-open docs/walkthrough/hub.html
-
-# Open a specific walkthrough
-open docs/walkthrough/architecture.html
+# Open the overview
+open docs/overview.html
 
 # Open a demo app
 open examples/demo-saas-dashboard.html
 
 # Or serve the entire repo with a local server
 python3 -m http.server 8080
-# Then visit http://localhost:8080/docs/walkthrough/hub.html
+# Then visit http://localhost:8080/docs/overview.html
 ```
 
 ## Design
@@ -75,4 +60,4 @@ All interactive content shares these characteristics:
 - **No build step** -- Open in any browser, works offline (except Google Fonts)
 - **Dark theme** -- Consistent dark design with purple accent (#553DE9)
 - **Responsive** -- Adapts to mobile, tablet, and desktop viewports
-- **No external dependencies** -- No npm packages, no CDN libraries, no frameworks
+- **No build step dependencies** -- No npm packages; `docs/overview.html` loads Mermaid from a CDN to draw its diagrams

package/docs/EVALUATING.md

@@ -191,9 +191,8 @@ both of us if you find it here.
 
 - **No published enterprise case studies.** We have adoption signal (fork ratio
   well above the norm for a tool this size) but no named enterprise references.
-- **No independent third-party benchmark placement.** The SWE-bench Verified
-  leaderboard is months stale and every entry on it is self-reported, ours would
-  be too.
+- **No independent third-party benchmark placement.** Public leaderboards are
+  self-reported, and ours would be too.
 - **Only the CLI surface is audited, not whole products.** Section 6 measures
   every named competitor that ships a local CLI (opencode, aider, codex, Claude
   Code, cursor-agent) and none exposes output verification. That is a real

package/docs/INSTALLATION.md

@@ -2,9 +2,9 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v10.6.6
+**Version:** v10.6.7
 
-**Migration Note:** Legacy engine removed in 10.6.0. Use `loki "<task>"`, `loki owner/repo#N`, or `loki backlog` instead.
+**Engine note:** `loki "<task>"`, `loki owner/repo#N` and `loki quick` run the Loki 10 engine. `loki start` still routes to the legacy engine, which is being removed (planned work resumes 2026-10-07); prefer `loki owner/repo#N`. See [docs/v10/GUIDE.md](v10/GUIDE.md).
 
 ---
 

package/docs/TOOLS.md

@@ -607,7 +607,7 @@ Model cost advisor -- /tmp/ws
   Projected saving:    UNKNOWN
   Records found: 0  measured: 0  priced: 0
 
-  Cited external benchmark (SWE-bench verified) -- NOT a measurement of your workload:
+  Cited external benchmark -- NOT a measurement of your workload:
     MiniMax M2.5 (open weights)    score 75.8   cost $36.64
     Claude Opus 4.6                score 75.6   cost $275.76
     the harness itself was worth about 3.4 points on an identical model

package/docs/air-gapped.md

@@ -13,7 +13,7 @@ Verified from vendor documentation, 2026-07-31:
 | Cursor | No. Cloud service; embeddings are uploaded (obfuscated and encrypted). |
 | Claude Code | Partly. Runs against Bedrock / Vertex / Foundry in your own cloud, so data residency is yours -- but a model endpoint is still required. |
 | Lovable, Replit, Emergent | No. Browser products on their infrastructure. |
-| opencode | Structurally yes (MIT, self-hostable) -- but no SOC2, SSO, audit logs, or support. |
+| opencode | Structurally yes (MIT, self-hostable) -- but no SSO, audit logs, or support. |
 
 Devin's is the strongest enterprise packaging in the category and it still
 cannot run disconnected. That is a structural property of a hosted control

package/docs/dashboard-guide.md

@@ -26,6 +26,8 @@ The dashboard automatically syncs with Loki Mode when it's running, polling `das
 
 **Ports:** The dashboard and API run on unified port **57374** (FastAPI serves both). See [INSTALLATION.md](INSTALLATION.md#ports) for details.
 
+**Bound port:** if 57374 is held by something that is not this install's dashboard (another project, an older version, a foreign process), Loki walks to the next free port and never reuses or opens the foreign one. `loki start` and `loki dashboard` open and print the URL of the port actually bound; `loki start` publishes it to `.loki/dashboard/url`. A running dashboard is reused only when its `/health` reports the same version and install path.
+
 ---
 
 ## UI Components

package/docs/dev/project-structure.md

@@ -72,7 +72,7 @@ autonomy/                   # Runtime and autonomous execution
   context-tracker.py        # Context window usage tracking
   notification-checker.py   # Notification trigger evaluation
 templates/                  # 21 PRD templates (saas, cli, discord-bot, etc.)
-benchmarks/                 # SWE-bench and HumanEval benchmarks
+benchmarks/                 # benchmark harnesses
 ```
 
 ## Codebase Knowledge Graph (Quick Reference)

package/docs/dev/release-checklist.md

@@ -157,6 +157,5 @@ gh release view vX.Y.Z
 ## Testing
 
 ```bash
-./benchmarks/run-benchmarks.sh humaneval --execute --loki
-./benchmarks/run-benchmarks.sh swebench --execute --loki
+npm test
 ```

package/docs/enterprise/architecture.md

@@ -202,7 +202,7 @@ Key methods:
 - `AuditLog.verifyChain()` -- Verify hash chain integrity, returns `{ valid, entries, brokenAt, error }`
 - `AuditLog.readEntries(filter)` -- Query entries with `who`, `what`, `since`, `until` filters
 
-The public API at `src/audit/index.js` adds compliance reporting (`generateReport('soc2'|'iso27001'|'gdpr')`) and data residency checks (`checkProvider(provider, region)`).
+The public API at `src/audit/index.js` adds audit report summaries and data residency checks (`checkProvider(provider, region)`).
 
 **Python Audit (Dashboard-Level):** `dashboard/audit.py`
 

package/docs/siem-integration.md

@@ -474,8 +474,8 @@ enterprise:
 ## Compliance Reporting
 
 **Loki does not generate framework-specific compliance reports.** An earlier
-version of this page showed `loki enterprise audit export --format soc2|hipaa|pci`
-and `loki compliance report --framework <name>`. Neither exists:
+version of this page showed framework-specific export and report commands.
+They do not exist:
 `loki enterprise audit` has only `summary` and `tail`, and `loki compliance`
 has only `snapshot`.
 

package/docs/v10/D61-SPEED.md

@@ -0,0 +1,78 @@
+# D61: speed for users (design)
+
+Architect design, 2026-10-02, base fbbd31299, v10.6.6. Design only; nothing below is built unless marked "exists". Build flag `LOKI_SPEED=1` while slices land; it flips to default-on (and the flag is deleted) when slice 17's targets pass. Users never set a flag or write config.
+
+## 1. What the user sees (from the terminal outward)
+- First run in a repo: `loki "fix the off-by-one in pager.py"`. Loki prints one start line, then streams stage lines, then the PR:
+  `loki: small task, lean path, sonnet, 3 impacted tests, cap $0.50, warm in 0.4s (first run here: maps built in 2.1s)`
+  Second and later runs say `warm in 0.1s`. No daemon setup, no prompt, no config: the warm engine starts itself in the background after the first run and is used if alive, ignored if not.
+- Big work: `loki ./spec.md` or `loki "add CSV export to api, web and cli"`. Loki prints its decision before spending a token on code:
+  `loki: 5 units, 3 in parallel (decomposable: disjoint write sets, 1 shared file serialized), est 6-9 min`
+  `loki: live at http://127.0.0.1:57375/g/<group>` (or the Control Plane URL when LOKI_CONTROL_URL is set)
+  then a compact unit table repainted every 2s on a TTY (one line per state change otherwise): unit, files, stage, elapsed, tokens.
+- When the work does not split: `loki: sequential (reason: units share 4 of 6 files)`. It never forces parallel.
+- The end: one PR with a unit table (goal, files, tests, tokens, model per unit), one combined receipt, and a final line `done in 7m12s, 412k tokens (5 units, 1 fix unit), PR <url>`.
+- `loki backlog` keeps per-issue parallelism (exists) and shares one slot pool with any issue that decomposes.
+
+## 2. What exists (evidence) and the gap
+| Piece | Where | Status |
+|---|---|---|
+| Lean path (skip Plan and Wall for small tasks with relevant tests) | engine10/sizing.ts:44-46, stages/plan.ts:74-77, stages/wall.ts:145 | exists; gap: only fires when the task names a file (sizing.ts:10 namedFiles) |
+| Byte-stable prefix | e10ext/lean_prefix.ts (LOKI_E10_PREFIX=lean) | exists, opt-in; no guard that every stage prompt starts with identical bytes |
+| Repo map and test map cached by HEAD^{tree} | engine10/cache.ts, repomap.ts, testmap.ts | exists on disk; rebuilt per process, no in-memory warm copy |
+| Impacted tests only | testmap.ts:201 impactedRefs, stages/verify.ts:251 | exists |
+| Repo context pack (20 files plus impacted tests) | e10ext/context.ts | exists |
+| Scope control (out-of-scope edits reverted, listed NOT PROVEN) | e10ext/scope.ts, e10ext/commit_filter.ts | exists; reusable as a unit's write-set fence |
+| Sonnet-then-escalate cascade | sizing.ts:54 cascadeEnabled | exists |
+| Cheap-model already-done check on the critical path | already_done.ts:167-182 (wallModel) | exists; cost on the small path not yet measured |
+| Per-session child process | session.ts:1-2 (self-respawn through cli.ts) | exists; cold bun start per session |
+| Parallel worktree runner | autonomy/lib/backlog.py:180-257 (worktree add -B loki/backlog-N, concurrency, daily cap) | exists; issue refs only, no dependency prep, in-memory queue |
+| Worktree dependency prep (`worktree_prep`) | none (grep finds nothing); D51-PHASE-B.md notes fresh worktrees lack node_modules/.venv | MISSING |
+| Decomposer, integrator, group run | none | MISSING |
+| Local dashboard (SSE, folds .loki/runs) | engine10/dashboard/server.ts (port 57375) | exists; one repo, no group view |
+| Control Plane v0 and live shipping | loki-ts/src/commands/control.ts, packages/control-plane/, e10ext/ship_hook.ts | exists, preview (LOKI_CONTROL=1); no group_id column |
+| Eval tiers and token capture | eval/loki10/harness.py:53 TIERS includes large, :1157 _v10_tokens; stage-profile.py | exists; 0 lg- tasks, no parallel or sequential arm split |
+
+## 3. Design
+**A. Small path (seconds).** (1) Warm engine: the engine10 dashboard process (already a long-lived bun server on 127.0.0.1) also serves a Unix socket `~/.loki/run/engine.sock`; it holds repo map and test map in memory keyed by (repoKey, HEAD^{tree}, dirty-file hash) and runs intake and sizing in-process. The CLI tries the socket for 50ms, else runs cold exactly as today and spawns the daemon detached for next time (fail-safe: no daemon never changes a result). (2) Pre-model overhead budget 2s, measured per stage from argv to the first provider byte and printed as `warm in Xs`. (3) Lean prefix becomes the default with a byte-identity guard. (4) Wider lean eligibility: a task that names no file uses context.ts keyword selection over the cached map, still requiring impacted tests (fail-safe keeps Wall). (5) The already-done model check moves off the critical path: it runs only when deterministic hits exist, concurrently with implement, and cancels implement on a confirmed hit.
+
+**B. Big work (minutes, in parallel).** Decomposer (engine10/decompose.ts, deterministic first): split the task or spec into requirement items (numbered or bulleted lines, headings, issue checklists); map each to a write set via context.ts selection plus module boundaries (top-level dirs, package workspaces, test map ownership); union units whose write sets overlap; mark shared files (lockfiles, package manifests, barrels, CHANGELOG) as serialized. A cheap model (wallModel) may only confirm or merge proposed units against a strict JSON schema; invalid output means the deterministic DAG stands. Decomposability check: parallel only if at least 2 units, write-set overlap ratio below 0.2, no unit reads a symbol another unit creates, and each unit sizes small or normal. Otherwise one sequential run, reason printed. Runner: backlog.py's launch loop generalised to units (same worktree layout, branches loki/unit-<group>-<n>), each unit a full v10 run with `--no-pr`, its write set enforced by scope.ts, its own context pack, cheapest capable model via the cascade (escalation only on a failed check, research section 3). Integrator (engine10/integrate.ts): merge unit branches in DAG order onto loki/group-<id>; conflicts become targeted fix units (conflict hunks only); run the full suite once; failures map back to units through the test map and become fix units (at most 2 rounds); Seal once on the combined diff; one PR. Stacked PRs are a later option, not v1.
+
+**C. Tokens at or below one sequential session.** No transcript sharing between units; each unit gets only its context pack and the shared lean prefix (cache hits across units); per-unit token budget = sequential estimate / units x 1.1, enforced by the existing budget path; deterministic search and test selection, no model-driven exploration in the decomposer. Every run prints tokens; the eval compares against sequential and raw.
+
+**D. Live view.** run.started gains `group_id`, `unit_id`, `deps`; a group event file records the DAG and integrator stages. The dashboard adds /g/<group> (unit grid); the Control Plane runs table gains group_id so the same grid works there.
+
+## 4. Slices (numbered; each ships with its METRICS row)
+| # | Goal | File set | Wall check | Budget | Tier |
+|---|---|---|---|---|---|
+| 1 | Pre-model stage timer: argv to first provider byte, per stage, in run.completed data and the start line | engine10/supervisor.ts, engine10/output.ts, tests engine10/premodel_timing.test.ts | test asserts the timing fields exist and sum within 50ms of the span; stage-profile.py prints a pre_model column | 30m | MEDIUM |
+| 2 | Lean prefix default plus byte-identity guard across implement, fix, wall, plan prompts | e10ext/lean_prefix.ts, engine10/stages/implement.ts, stages/fix.ts, tests e10ext/prefix_identity.test.ts | guard fails when any stage prompt's first 200 bytes differ; second run shows cache_read tokens over 0 in the cost event | 30m | MEDIUM |
+| 3 | Lean eligibility without a named file (context.ts selection), fail-safe to Wall | engine10/sizing.ts, tests engine10/sizing_lean.test.ts | fixtures: unnamed-file small task goes lean only when impacted tests exist; no-runner repo stays wall | 30m | MEDIUM |
+| 4 | Already-done check off the critical path (deterministic hits gate it, runs concurrent with implement) | engine10/already_done.ts, engine10/stages/intake.ts, tests already_done.test.ts | no-hit task makes zero cheap-model calls; augmentiq #52 fixture still ALREADY_SATISFIED | 30m | HIGH |
+| 5 | Warm engine socket in the dashboard daemon: in-memory maps keyed by tree plus dirty hash | engine10/dashboard/server.ts, new engine10/warm.ts, tests engine10/warm.test.ts | warm intake under 300ms on the fixture repo; dirty edit invalidates; daemon killed mid-run gives the same verdict cold | 30m | MEDIUM |
+| 6 | CLI client: 50ms socket try, cold fallback, detached daemon start after first run, `warm in Xs` text | engine10/cli.ts, new engine10/warm_client.ts, tests warm_client.test.ts | no daemon: identical events to today; LOKI_NO_BROWSER honoured; no test binds 57374-57399 | 30m | MEDIUM |
+| 7 | Worktree dependency prep: APFS/reflink clone of node_modules, .venv reuse, else install | new autonomy/lib/worktree_prep.py, tests/test-worktree-prep.sh | fresh worktree runs the fixture's tests with no network; copy-on-write used on darwin | 30m | MEDIUM |
+| 8 | Decomposer, deterministic DAG (items, write sets, union on overlap, shared files serialized) | new engine10/decompose.ts, tests engine10/decompose.test.ts | 6 fixture specs: expected unit count and write sets; same input gives byte-identical DAG | 30m | MEDIUM |
+| 9 | Decomposability check plus optional cheap-model confirm under a strict schema | engine10/decompose.ts (check fn only after 8 merges), tests decompose_check.test.ts | sequential fixtures return sequential with reason; malformed model JSON keeps the deterministic DAG | 30m | MEDIUM |
+| 10 | Unit runner: backlog.py launch loop accepts a DAG, branches loki/unit-<g>-<n>, deps respected, one slot pool shared with issues | autonomy/lib/backlog.py, tests/test-backlog-units.sh | LOKI_BACKLOG_LAUNCHER stub: max concurrency never exceeded, dependent unit starts only after its parent passes | 30m | MEDIUM |
+| 11 | Unit run mode: write set as scope fence, per-unit context pack and token budget, no transcript in | e10ext/scope.ts, e10ext/context.ts, tests e10ext/unit_mode.test.ts | an edit outside the write set is reverted and listed NOT PROVEN; brief contains only pack files | 30m | HIGH |
+| 12 | Integrator merge and fix units (conflict hunks, failing tests mapped to units, 2 rounds max) | new engine10/integrate.ts, tests engine10/integrate.test.ts | fixture with one planted conflict and one cross-unit failure ends VERIFIED with exactly 2 fix units | 30m | HIGH |
+| 13 | One Seal and combined receipt (per-unit sub-receipts) plus PR body unit table | engine10/stages/seal.ts, engine10/types.ts, engine10/pr_body.ts, tests seal_group.test.ts | `loki verify` passes on the combined receipt; tampering one unit's events fails it | 30m (60m review) | HIGH |
+| 14 | Group events and terminal unit table (TTY repaint 2s, plain lines otherwise) | engine10/events.ts, engine10/output.ts, tests output_group.test.ts | snapshot tests for TTY and non-TTY; validateEnvelope accepts group fields | 30m | MEDIUM |
+| 15 | Live grid: dashboard /g/<group> and Control Plane group_id column | engine10/dashboard/page.ts, packages/control-plane/src/server/runs.ts, packages/control-plane/src/db/, tests | ingesting a 3-unit fixture shows 3 rows with stage and elapsed; missing data says "no data ingested" | 30m | MEDIUM |
+| 16 | Route `loki "<task>"` and `loki <file>` through decomposer behind LOKI_SPEED | engine10/cli.ts (route only), engine10/supervisor.ts (group entry), tests route_group.test.ts | flag off: byte-identical behaviour; flag on: small task never decomposes | 30m | HIGH |
+| 17 | Large eval tier: 8 lg- tasks (4 decomposable, 4 sequential by design), arms v10-parallel, v10-seq, raw-claude, tokens per completed for every arm | eval/loki10/tasks/lg-*, eval/loki10/harness.py, eval/loki10/summarize, eval/loki10/test-harness.sh | D38 provenance check passes; summarize prints wall, completion, tokens per arm; a capped arm is never completed | 30m x2 (tasks, harness) | MEDIUM |
+| 18 | METRICS D61 section and the flag flip decision | docs/v10/METRICS.md | rows cite results.jsonl paths; losses shown; flip only if section 5 targets hold | 15m | LOW |
+
+Order: 1, 2, 7, 8 start now (disjoint files); 3-6 and 9-11 next; 12-16 after 8-11; 17 in parallel from the start; 18 last. HIGH slices get opus reviewers (D12).
+
+## 5. Targets (measured on the eval, never claimed)
+- A. Small tier (29 tasks): Loki p50 time to PR at or below raw `claude -p` (39s baseline, METRICS gate report) on the same model; tokens per completed at or below raw; pre-model overhead p50 under 2s warm. Losses published, including the D50 sonnet loss.
+- B. Large tier: on decomposable tasks, parallel wall time at most 0.5x sequential with completion not lower; on sequential-by-design tasks the check must choose sequential (a parallel run there counts as a loss).
+- C. Parallel total tokens at or below v10-seq on the same task; report tokens per completed task for all three arms.
+- D. Every slice adds its METRICS row (what changed, command, result file, exit code). Nothing flips to default on a fixture result alone (feedback: fixture-green is not verification).
+
+## 6. Risks and non-goals
+- Research section 4: parallel lost 39-70% on sequential work and multi-agent runs cost about 15x tokens. Defence: conservative check, no transcript sharing, single writer per file, one central integrator.
+- Warm daemon must never be load-bearing: cold path stays the reference; slice 6 asserts identical events.
+- Not in v1: stacked PRs, cross-repo groups (D51 Phase B), remote runners.

package/docs/v10/DECISIONS.md

@@ -482,3 +482,12 @@ Loki's definition: "autonomous software factory that runs with the knowledge of
 
 ## D59: two-hour finish, then stop until next week (founder, 2026-10-01 18:10Z, override 18:14Z)
 Founder: "complete all loki mode work faster ... everything complete in two hours with least tokens used and highest code push and releases ... even if means no testing". Override given directly at 18:14Z: until 20:10Z, merge and release without waiting for Tests, Bun Parity, Coverage or Security Audit. Kept: rollback of `latest` by dist-tag if Post-Release Smoke shows `npm i -g loki-mode` or `loki --version` broken. Each release's CI result is recorded in docs/v10/HANDOFF-NEXT-WEEK.md. Order: 10.6.0, W1-ROUTE, D58-SCOPE, LEAK3, CP-RELAND, D57 W1 docs, one real-repo gate run against latest. Target 19:15Z, hard stop 20:10Z, then no agents, loops or crons until next week. Workflow-level gates (release.yml required-ci, pre-push secret scan) are not edited.
+
+## D60: one-hour user-impact sprint (founder via the autonomi-dev session, 2026-10-02 22:45Z)
+Ends the D59 pause early for this sprint only. Five slices, released as soon as each is green: (1) `loki start` runs Loki 10, after porting moat P9 to the v10 issue path and re-landing b2e3afc43; (2) the dashboard opens the port it bound (LEAK3, with test-ui-bare-loki fixed); (3) an evidence-rich PR body (INTEL-3); (4) the shipped GitHub Action runs `loki owner/repo#N`, plus a documented nightly `loki backlog` cron; (5) a visible cost cap (INTEL-2) in the v10 start line. CI gates are unchanged: Tests, Bun Parity, Coverage and Security Audit must be green before a release, plus the two-leg promote. Anything red at about minute 50 is dropped. Report at minute 60, then stop per HANDOFF-NEXT-WEEK.md.
+
+## D61: speed for users (founder via the autonomi-dev session, 2026-10-02 22:50Z)
+A product feature, not a build-process change: `loki "small task"` should finish in seconds, at or below raw Claude Code time and tokens. `loki "big task"` and `loki backlog` should decide by themselves whether the work splits, run the units in parallel worktrees on the user's machine, merge, test once and open one PR, using no more tokens than one sequential session, visible live and with no flags. Design only for now: docs/v10/D61-SPEED.md (an opus architect). Builders start after D60 and after the founder's go. Every target is measured on an eval arm and published in METRICS, losses included.
+
+## D60-5 default cost cap (2026-10-02 23:05Z)
+A Loki 10 run caps priced spend at $20.00 by default. `--max-cost N` beats loki.yaml `budgets.per_run`, which beats the default. The start line prints the cap and its source. Hitting the cap ends the run as BUDGET_STOP with exit 3. Unpriced sessions (no cost event) never count toward the cap, so a subscription or local provider never stops on it.

package/docs/v10/GUIDE.md

@@ -6,7 +6,8 @@ Loki 10 is the rewritten engine (docs/v10/ENGINE.md). Since the D48 flip it
 is the default for three entry points: `loki "<task>"`, `loki owner/repo#N`
 (issue mode) and `loki quick "<task>"`. Each prints one start line,
 `Loki 10 engine (set LOKI_ENGINE=legacy or run 'loki legacy' for the previous
-engine)`, then the summary below. Everything else (`loki start`, `loki
+engine)`, then the summary below. `loki start <issue ref | issue URL | "multi-word task">` takes the same
+v10 path as `loki <ref>`. Everything else (`loki start ./prd.md`, `loki
 status`, `loki dashboard` and the rest) is unchanged unless you set
 LOKI_ENGINE=v10 explicitly, which also routes status, verify and dashboard
 to the v10 commands. Bare `loki verify` (no LOKI_ENGINE) follows the newest
@@ -16,6 +17,12 @@ missing or LOKI_PROVIDER is unsupported, the default mode falls back to the
 legacy engine and prints one stderr line saying why. The previous engine stays one step away:
 `loki legacy <args>` and LOKI_ENGINE=legacy.
 
+`loki start owner/repo#N`, `loki start <issue URL>` and `loki start "<multi-word
+task>"` run Loki 10, the same as `loki owner/repo#N` and `loki "<task>"`. A PRD
+file, a flag-first call (`loki start --simple prd.md`) and a one-word start stay
+on the legacy engine. The legacy engine is being removed (planned work
+resumes 2026-10-07, see docs/v10/LEGACY-REMOVAL.md).
+
 Some pieces named in this guide are still being built. Each one below says
 so plainly instead of describing a finished feature.
 
@@ -66,6 +73,14 @@ Flags, from the engine's own `--help`:
   from 480s to 1800s (`loki-ts/src/engine10/types.ts`).
 - `--provider <name>`: pick the coding provider for this run. See the
   provider table below.
+- `--max-cost <usd>`: per-run cost cap in dollars. Without the flag the cap is
+  `budgets.per_run` in the repo's `loki.yaml` (for example
+  `budgets:` then `  per_run: 5`), else the default of $20.00. The flag wins over
+  the file. The start line shows the cap in force, for example
+  `... previous engine), cap $20.00 (default)`. Once priced cost reaches the cap
+  the running stage is stopped, no later stage starts, and the run ends
+  BUDGET_STOP with exit code 3. Sessions with no provider price never count
+  toward the cap.
 
 `--no-pr`, `--deep` and `--provider` are parsed by the supervisor
 (`loki-ts/src/engine10/supervisor.ts`) and take effect on a real run.
@@ -102,6 +117,36 @@ Time:       4m12s (intake 11s, plan 20s, implement 3m10s, verify 31s)
 - **PR**: the opened pull request URL, or `none` when the run used
   `--no-pr` or never got that far. A draft PR adds the draft reason in
   parentheses.
+
+The PR body is reviewable in 60 seconds. It leads with what the issue asked,
+then what changed and why, how it was tested, NOT PROVEN, and the receipt digest
+with the `loki verify` command. A field the run did not record reads "not
+recorded", never a number:
+
+```
+## What the issue asked
+- handles empty input
+- rejects bad tokens
+
+## What changed and why
+- Why: Fix the parser
+- src/parser.ts
+- tests/parser.test.ts
+
+## How it was tested
+- Verdict: VERIFIED
+- Checks: 2 passed, 0 failed, 0 not run, 0 flaky (4 individual tests counted)
+- Command: `bun test tests/parser.test.ts` -> pass
+- Target tests (written before the fix): parser.test.ts
+- Before the fix: 2 failing, 0 passing on base; after: pass
+
+## NOT PROVEN
+- none
+
+## Receipt
+- Digest: sha256:ab12... (signed)
+- Verify: `loki verify run-1`
+```
 - **Verdict**: one of VERIFIED, PARTIAL, ALREADY_SATISFIED, SPEC_CONFLICT or
   FAILED.
 - **NOT PROVEN**: everything the run did not check, comma-joined. Never
@@ -124,6 +169,23 @@ called by the supervisor at the end of every run, so a real `loki "<task>"`
 or `loki <issue-ref>` run prints this block on completion. The block above
 is that function's real output, not a mockup.
 
+## Triggers without a cloud
+
+Both run on your own GitHub Actions minutes; there is no hosted service.
+
+- Issue to PR: copy `.github/workflows/loki-issue-to-pr.yml` into your repository. Label an issue `loki`, or comment `/loki` as an owner, member or collaborator, and it runs `loki owner/repo#N` (the Loki 10 engine) and opens a pull request with an evidence receipt. The agent job holds a read-only token; a separate publish job opens the PR. Set `ANTHROPIC_API_KEY` in repository secrets.
+- Nightly backlog: copy `examples/loki-nightly-backlog.yml` into `.github/workflows/`. Its `schedule:` trigger runs `loki backlog owner/repo --label loki`, one Loki 10 run per labeled open issue:
+
+```yaml
+on:
+  schedule:
+    - cron: '17 3 * * *'   # nightly, 03:17 UTC
+# ...
+      - run: loki backlog "${GITHUB_REPOSITORY}" --label loki --concurrency 2
+```
+
+`loki backlog` also takes `--all`, `--issues 1,2,3` and `--dry-run`. The nightly job runs the agent and a write token together, so label only issues you trust.
+
 ## NOT PROVEN
 
 NOT PROVEN lists what a run did not verify, so a passing run is never read

package/docs/v10/HANDOFF-NEXT-WEEK.md

@@ -0,0 +1,34 @@
+# Handoff to next week (D59, written 2026-10-01; resume Wednesday 2026-10-07)
+
+## On npm now
+- latest: 10.6.6 (moved by the D49 auto-promote after post-release smoke passed, seen 20:28Z; the D58 real-repo gate is not wired into promote yet).
+- next: 10.6.6 (Release run succeeded 20:12Z; npm can lag about 30 minutes, check `npm view loki-mode dist-tags`). 
+
+## Releases this window and their CI
+- 10.6.0 (9f9569c35, tree d922ef170): Tests, Bun Parity, Coverage, Security Audit all green on train/72 and on main. Published.
+- 10.6.1 (9bc3cfcc7): Tests red, shard 7, `test-engine10-docs.sh` (the D57 docs pass removed the README loki10-default marker). Not published.
+- 10.6.2 (5c1e3324d): Tests red from W1-ROUTE (moat P5 egress-blocked-start-seal-verify, P5 local-provider-no-claude-sidecalls, P9 injection-cannot-reach-token; `loki run --help` flags; UI bare loki; progressive isolation help; platform-divergent construct; docs-drift `loki agent` in docs/R10-MARKETPLACE-PLAN.md). Not published; W1-ROUTE reverted (30096450f).
+- 10.6.3 (f289f8bf2): Tests red, shard 7, `test-ui-bare-loki` (LEAK3 prints http://127.0.0.1:57374/start where the test expects otherwise). Not published; LEAK3 reverted (05410c554).
+- 10.6.4 (3a4df211c): every Tests job failed installing deps (npm 404 on baseline-browser-mapping-2.11.27.tgz, a fresh publish not yet propagated; 200 a few minutes later). Not published; content carried into 10.6.5.
+- 10.6.5 (0472f306a): Moat suite red, P9 injection-cannot-reach-token regressed by the minimal `loki start <ref>` route (b2e3afc43): the P9 probe drives `loki start <issue>` and expects a provider session; engine10 exited rc=2 first. Not published; start route reverted (621437c0a).
+- 10.6.6 (456058bae): scope control, Control Plane v0, train-cycle fix, docs. Tests, Bun Parity, Coverage, Security Audit all green; Release succeeded. Published.
+
+## D58 basics
+1. `loki start` runs v10: FAIL. Both the minimal route (b2e3afc43, a 7-line bin/loki start arm) and the full re-route regress moat P9, because tests/moat P9 drives `loki start <issue>` through the legacy path; port that probe to the v10 issue path first, then re-land b2e3afc43. The full re-route W1-ROUTE is built (branch slice-D57-W1-ROUTE, commit a8ed5461a, which is based on the old main that still has the CP-00 JWT commits, so cherry-pick it, never merge it) but turned Tests red as listed above. Its docs follow-up is f001bc0f1.
+2. Dashboard: FAIL. LEAK3 (bound URL, scoped reuse, 57374-57399 guard; branch slice-P0-DASH-LEAK3, ceba8a6de) failed `test-ui-bare-loki` in CI and was reverted. The Control Plane v0 live view (CP-RELAND) ships in 10.6.6, off unless LOKI_CONTROL_URL is set.
+3. Scope control: SHIPPED in 10.6.6 (D58-SCOPE, reverts unrelated edits, lists them in NOT PROVEN). Unproven on a real repo.
+4. Clean install: PASS on 10.6.0 (per-platform @oven/bun-* deps; post-release smoke passed, which is what fired the promote).
+5. Real-repo gate before latest moves: FAIL. `scripts/real-repo-gate.sh` exists but promote does not call it, and it needs operator provider auth (ANTHROPIC_API_KEY or CLAUDE_CODE_OAUTH_TOKEN, plus GH_TOKEN) that this session does not have. Not run against latest.
+
+## NOT DONE and why
+- W1-ROUTE and its docs cleanup: red CI (above); dropped per D46 rule 2.
+- LEAK3 dashboard fix: red CI (`test-ui-bare-loki`); dropped. Its test expectation and the new bound-URL output disagree; decide which is right.
+- Real-repo gate run: no provider auth in the session; never reads stored keys.
+- Coverage W1-ROUTE removed and must be replaced when it re-lands: `why --json` schema test, eval harness cost checks (R2, S41-01), five trust-core probe cases (CTO sign-off).
+- Wiring the real-repo gate into promote.yml (so latest cannot move without it).
+
+## Founder queue
+- Re-land W1-ROUTE with the moat P5/P9 regressions fixed first (moat outranks everything).
+- Decide whether promote must call the real-repo gate, and supply provider auth for it.
+- The D59 override (release without waiting for CI) expired at 20:10Z; the Release workflow's required-ci still enforced green Tests throughout.
+- Housekeeping: about 43 worktrees under .claude/worktrees (cap 15); backup branches backup/train-67..70 and backup/main-pre-rebuild hold the CP-00 JWT lineage, so never push them.