loki-mode 10.6.6 → 10.6.8

package/docs/v10/E2E-D65.md

@@ -0,0 +1,87 @@
+# D65 Phase 2 end-to-end pass: plan, stub-leg results, bugs, operator commands
+
+Status: stub legs run 2026-10-02 (loki-mode 10.6.7 from npm `latest`, macOS arm64, bun 1.x on PATH).
+Real-provider legs are PENDING: they need `~/.config/loki/e2e.env`, which this document's author
+never read or loaded. No leg here used real provider auth.
+
+## 1. Plan
+
+Every leg starts from a clean install and never touches the operator's real HOME or any remote.
+
+1. Clean install: `npm i -g --prefix <run>/p loki-mode@<version>` with `HOME=<run>/home`,
+   `npm_config_cache=<run>/npmcache`. Record install seconds and `loki version`.
+2. Three repos:
+   - `asklokesh/augmentiq#52` (private, expected ALREADY_SATISFIED, needs gh token and provider auth: PENDING auth).
+   - `octocat/Hello-World` (tiny public repo, stub leg 1).
+   - `sindresorhus/is-plain-obj` (small public repo, stub leg 2).
+   - The gate proper (`scripts/real-repo-gate.sh`) also runs the two corpus rows (humanize-333, click) from `scripts/real-repo-gate.repos`.
+3. Push disabled: shallow clone (`--depth 1`), `git remote set-url --push origin no-push`, `GIT_CONFIG_GLOBAL=/dev/null`, `--no-pr`. Gate clones additionally set `remote.origin.pushurl=invalid://push-disabled-by-real-repo-gate`.
+4. Stub legs: a stub `claude` on PATH, `LOKI_NO_BROWSER=1`, `LOKI_DASHBOARD=false`, no API key variables. Real legs: credentials only through `LOKI_E2E_ENV_FILE` (below).
+5. Evidence per leg: exit codes, wall seconds, receipt presence, `loki verify` verdict, `loki proof verify`, diff.
+
+## 2. Stub-leg results (loki-mode 10.6.7)
+
+Install: `npm i -g --prefix ... loki-mode@latest` rc=0, 5 s (warm npm cache directory was empty, so a cold fetch), `loki version` = `Loki Mode v10.6.7`.
+
+| Leg | Repo @ SHA | Command | Exit | Wall | Receipt | `loki verify` | Notes |
+|---|---|---|---|---|---|---|---|
+| A | octocat/Hello-World @ 7fd1a60b01f91b314f59955a4e4d4e80d8edf11d | `loki start ./task.md --no-pr` (file task, exactly what the gate runs for corpus rows) | 1 | 1 s | none | rc=1, CONCERNS (empty diff) | `Unknown option: --no-pr` (BUG-1) |
+| B | octocat/Hello-World @ 7fd1a60b | `loki start "Add a short Contributing note to the README" --no-pr` (v10 route) | 1 | 4 s | yes, `.loki/runs/e10-20261003T020630Z-9ab3/receipt.json` (sha256:321a4232...) | rc=4, `NOT VERIFIED (run outcome FAILED; receipt integrity intact)` | `Not logged in` from the SDK loop; stub `claude` on PATH ignored by the v10 engine (BUG-2, BUG-3). Outcome FAILED, no diff |
+| C | sindresorhus/is-plain-obj @ 666df7c10035f7e26f27ec214fe5ae3173435f34 | `LOKI_ENGINE=legacy LOKI_MAX_ITERATIONS=1 LOKI_SDK_MODE=off LOKI_SKIP_AUTH_PREFLIGHT=1 loki start ./task.md` | 0 | 71 s | yes, `.loki/proofs/run-20261003020703-25030-19911` | rc=0, `VERDICT: VERIFIED` (2 files, +122) | `loki proof verify` rc=0 (hash_ok, headline_consistent); receipt body says `quality_gate:code_review: failed` (BUG-4) |
+| C0 | is-plain-obj @ 666df7c1 | same as C without `LOKI_SKIP_AUTH_PREFLIGHT=1` | 1 | 1 s | none | CONCERNS | Legacy auth preflight stops with `Claude Code is installed but not logged in`; correct behaviour |
+
+Push check: after every leg `git remote get-url --push origin` = `no-push`; nothing left the machine.
+
+## 3. Bugs
+
+BUG-1 (gate blocker, P1): `loki start <file> --no-pr` is rejected by the legacy parser.
+`bin/loki` routes `start` to the v10 engine only for issue refs, issue URLs and multi-word tasks (`bin/loki` start case); a path to a file stays legacy, and the legacy `cmd_start` has no `--no-pr`. `scripts/real-repo-gate.sh` runs corpus rows as `loki start <T>/issue-NAME.md --no-pr`, so both corpus rows (humanize-333, click) die in 1 s with `Unknown option: --no-pr` on a real install. The stub-`loki` test hides it because the stub accepts anything.
+Repro: `loki start ./task.md --no-pr` in any git clone; exit 1.
+Fix options: route `start <file>.md --no-pr` to v10, or accept and ignore `--no-pr` in legacy `cmd_start`, or have the gate pass the issue text as a multi-word task. Add a gate test that uses the real routing.
+
+BUG-2 (P2): the v10 engine does not use a `claude` found on PATH, so a stub provider cannot drive it.
+The SDK loop spawns its own Claude Code and reports `Not logged in` even with a stub first on PATH. The legacy engine does honor PATH `claude`. Result: v10 stub legs are impossible, so no hermetic v10 e2e exists beyond unit tests. Suggest an env override (an executable path for the SDK loop) for tests.
+Repro: Leg B.
+
+BUG-3 (P2): an unauthenticated provider is reported as a generic failure by v10.
+`loki-ts/src/engine10/machine.ts` matches only `Failed to authenticate|API key is invalid` and the credit-balance wording. The SDK's `Not logged in - Please run /login` is not matched, so the run ends `Outcome: FAILED  Reason: exit 1 (general error)` plus four NOT PROVEN items, with no pointer to the login fix. Legacy prints an actionable message.
+Repro: Leg B stderr log `.loki/runs/*/..-impl.stderr.log` contains `[sdk-loop error: Claude Code returned an error result: Not logged in ...]`.
+
+BUG-4 (P3, wording): after a legacy run whose receipt lists `quality_gate:code_review: failed` under "Not yet verified", bare `loki verify` prints `VERDICT: VERIFIED`, because it is the diff-scope deterministic verify, while the receipt headline is not a full pass. Two commands, two meanings of VERIFIED. Operators should read the receipt headline, not only `loki verify`. Repro: Leg C.
+
+Observation, not a Loki bug: my first stub appended to `README.md` on every invocation, including the auth probe, so the stub must only write on a real `-p` call.
+
+## 4. Gate script change (this commit)
+
+`scripts/real-repo-gate.sh` accepts `LOKI_E2E_ENV_FILE` (default unset, behaviour unchanged when unset). When set it requires a regular non-symlink file owned by the current user with mode 0600 (refuses with exit 2 otherwise), then loads it with `set -a; . file; set +a` inside the gate process only, output discarded, never echoed. Tested in `tests/test-real-repo-gate.sh` (0644 refused, 0600 loads, dummy value absent from stdout, stderr and logs). Caveat: the gate's per-repo log captures `loki` output, so a provider that echoes its own key would land in the log; the gate itself never writes values.
+
+## 5. Operator commands once `~/.config/loki/e2e.env` exists
+
+Create it with `umask 077` and put only the provider variables in it (`ANTHROPIC_API_KEY` or `CLAUDE_CODE_OAUTH_TOKEN`; `GH_TOKEN` for the private augmentiq repo, or rely on `gh auth login`).
+
+```bash
+chmod 600 ~/.config/loki/e2e.env
+stat -f '%Lp %Su' ~/.config/loki/e2e.env        # expect: 600 <you>
+
+# 0. Do not run until BUG-1 is fixed, or the two corpus rows fail on the file-task route.
+cd <loki-mode checkout>
+
+# 1. Local gate on the published latest (clean install, throwaway HOME, push disabled, all three repos)
+LOKI_E2E_ENV_FILE=$HOME/.config/loki/e2e.env \
+  bash scripts/real-repo-gate.sh --version "$(npm view loki-mode version)" \
+  --results "$HOME/loki-ci-logs/real-repo-gate-e2e.results"
+echo "gate exit: $?"        # 0 pass, 1 repo failed or nothing ran, 2 setup error
+
+# 2. augmentiq#52 alone, for a clearer log
+LOKI_E2E_ENV_FILE=$HOME/.config/loki/e2e.env \
+  bash scripts/real-repo-gate.sh --version "$(npm view loki-mode version)" --repo 'asklokesh/augmentiq#52'
+
+# 3. Inspect: results table and per-repo logs (logs are in the .logs dir next to the results file)
+cat "$HOME/loki-ci-logs/real-repo-gate-e2e.results"
+ls "$HOME/loki-ci-logs/real-repo-gate-e2e.logs"
+
+# 4. Confirm no push happened and nothing leaked
+grep -rIl -E 'sk-ant-|oat01-' "$HOME/loki-ci-logs/real-repo-gate-e2e.logs" || echo "no key material in logs"
+```
+
+Pass criteria per repo are in `scripts/real-repo-gate.repos` (expected outcome, allowed diff paths, max seconds); evidence to record for the log: exit code, wall seconds, Outcome line, receipt path, `loki verify` verdict.

package/docs/v10/GUIDE.md

@@ -6,7 +6,8 @@ Loki 10 is the rewritten engine (docs/v10/ENGINE.md). Since the D48 flip it
 is the default for three entry points: `loki "<task>"`, `loki owner/repo#N`
 (issue mode) and `loki quick "<task>"`. Each prints one start line,
 `Loki 10 engine (set LOKI_ENGINE=legacy or run 'loki legacy' for the previous
-engine)`, then the summary below. Everything else (`loki start`, `loki
+engine)`, then the summary below. `loki start <issue ref | issue URL | "multi-word task">` takes the same
+v10 path as `loki <ref>`. Everything else (`loki start ./prd.md`, `loki
 status`, `loki dashboard` and the rest) is unchanged unless you set
 LOKI_ENGINE=v10 explicitly, which also routes status, verify and dashboard
 to the v10 commands. Bare `loki verify` (no LOKI_ENGINE) follows the newest
@@ -16,6 +17,12 @@ missing or LOKI_PROVIDER is unsupported, the default mode falls back to the
 legacy engine and prints one stderr line saying why. The previous engine stays one step away:
 `loki legacy <args>` and LOKI_ENGINE=legacy.
 
+`loki start owner/repo#N`, `loki start <issue URL>` and `loki start "<multi-word
+task>"` run Loki 10, the same as `loki owner/repo#N` and `loki "<task>"`. A PRD
+file, a flag-first call (`loki start --simple prd.md`) and a one-word start stay
+on the legacy engine. The legacy engine is being removed (planned work
+resumes 2026-10-07, see docs/v10/LEGACY-REMOVAL.md).
+
 Some pieces named in this guide are still being built. Each one below says
 so plainly instead of describing a finished feature.
 
@@ -66,6 +73,14 @@ Flags, from the engine's own `--help`:
   from 480s to 1800s (`loki-ts/src/engine10/types.ts`).
 - `--provider <name>`: pick the coding provider for this run. See the
   provider table below.
+- `--max-cost <usd>`: per-run cost cap in dollars. Without the flag the cap is
+  `budgets.per_run` in the repo's `loki.yaml` (for example
+  `budgets:` then `  per_run: 5`), else the default of $20.00. The flag wins over
+  the file. The start line shows the cap in force, for example
+  `... previous engine), cap $20.00 (default)`. Once priced cost reaches the cap
+  the running stage is stopped, no later stage starts, and the run ends
+  BUDGET_STOP with exit code 3. Sessions with no provider price never count
+  toward the cap.
 
 `--no-pr`, `--deep` and `--provider` are parsed by the supervisor
 (`loki-ts/src/engine10/supervisor.ts`) and take effect on a real run.
@@ -102,6 +117,36 @@ Time:       4m12s (intake 11s, plan 20s, implement 3m10s, verify 31s)
 - **PR**: the opened pull request URL, or `none` when the run used
   `--no-pr` or never got that far. A draft PR adds the draft reason in
   parentheses.
+
+The PR body is reviewable in 60 seconds. It leads with what the issue asked,
+then what changed and why, how it was tested, NOT PROVEN, and the receipt digest
+with the `loki verify` command. A field the run did not record reads "not
+recorded", never a number:
+
+```
+## What the issue asked
+- handles empty input
+- rejects bad tokens
+
+## What changed and why
+- Why: Fix the parser
+- src/parser.ts
+- tests/parser.test.ts
+
+## How it was tested
+- Verdict: VERIFIED
+- Checks: 2 passed, 0 failed, 0 not run, 0 flaky (4 individual tests counted)
+- Command: `bun test tests/parser.test.ts` -> pass
+- Target tests (written before the fix): parser.test.ts
+- Before the fix: 2 failing, 0 passing on base; after: pass
+
+## NOT PROVEN
+- none
+
+## Receipt
+- Digest: sha256:ab12... (signed)
+- Verify: `loki verify run-1`
+```
 - **Verdict**: one of VERIFIED, PARTIAL, ALREADY_SATISFIED, SPEC_CONFLICT or
   FAILED.
 - **NOT PROVEN**: everything the run did not check, comma-joined. Never
@@ -124,6 +169,23 @@ called by the supervisor at the end of every run, so a real `loki "<task>"`
 or `loki <issue-ref>` run prints this block on completion. The block above
 is that function's real output, not a mockup.
 
+## Triggers without a cloud
+
+Both run on your own GitHub Actions minutes; there is no hosted service.
+
+- Issue to PR: copy `.github/workflows/loki-issue-to-pr.yml` into your repository. Label an issue `loki`, or comment `/loki` as an owner, member or collaborator, and it runs `loki owner/repo#N` (the Loki 10 engine) and opens a pull request with an evidence receipt. The agent job holds a read-only token; a separate publish job opens the PR. Set `ANTHROPIC_API_KEY` in repository secrets.
+- Nightly backlog: copy `examples/loki-nightly-backlog.yml` into `.github/workflows/`. Its `schedule:` trigger runs `loki backlog owner/repo --label loki`, one Loki 10 run per labeled open issue:
+
+```yaml
+on:
+  schedule:
+    - cron: '17 3 * * *'   # nightly, 03:17 UTC
+# ...
+      - run: loki backlog "${GITHUB_REPOSITORY}" --label loki --concurrency 2
+```
+
+`loki backlog` also takes `--all`, `--issues 1,2,3` and `--dry-run`. The nightly job runs the agent and a write token together, so label only issues you trust.
+
 ## NOT PROVEN
 
 NOT PROVEN lists what a run did not verify, so a passing run is never read

package/docs/v10/HANDOFF-NEXT-WEEK.md

@@ -0,0 +1,40 @@
+# Handoff state (D59 pause ended early by D62 on 2026-10-03 about 00:05Z; work resumed, see DECISIONS D62)
+
+## On npm now (updated 2026-10-02T23:52Z after the D60 sprint)
+- latest and next: 10.6.7 (`npm view loki-mode dist-tags` gave latest 10.6.7, next 10.6.7 at 23:51Z; moved by the D49 auto-promote after Post-Release Smoke passed on bfce1db12; the D58 real-repo gate is still not wired into promote).
+
+## Releases this window and their CI
+- 10.6.0 (9f9569c35, tree d922ef170): Tests, Bun Parity, Coverage, Security Audit all green on train/72 and on main. Published.
+- 10.6.1 (9bc3cfcc7): Tests red, shard 7, `test-engine10-docs.sh` (the D57 docs pass removed the README loki10-default marker). Not published.
+- 10.6.2 (5c1e3324d): Tests red from W1-ROUTE (moat P5 egress-blocked-start-seal-verify, P5 local-provider-no-claude-sidecalls, P9 injection-cannot-reach-token; `loki run --help` flags; UI bare loki; progressive isolation help; platform-divergent construct; docs-drift `loki agent` in docs/R10-MARKETPLACE-PLAN.md). Not published; W1-ROUTE reverted (30096450f).
+- 10.6.3 (f289f8bf2): Tests red, shard 7, `test-ui-bare-loki` (LEAK3 prints http://127.0.0.1:57374/start where the test expects otherwise). Not published; LEAK3 reverted (05410c554).
+- 10.6.4 (3a4df211c): every Tests job failed installing deps (npm 404 on baseline-browser-mapping-2.11.27.tgz, a fresh publish not yet propagated; 200 a few minutes later). Not published; content carried into 10.6.5.
+- 10.6.5 (0472f306a): Moat suite red, P9 injection-cannot-reach-token regressed by the minimal `loki start <ref>` route (b2e3afc43): the P9 probe drives `loki start <issue>` and expects a provider session; engine10 exited rc=2 first. Not published; start route reverted (621437c0a).
+- 10.6.6 (456058bae): scope control, Control Plane v0, train-cycle fix, docs. Tests, Bun Parity, Coverage, Security Audit all green; Release succeeded. Published.
+
+## D60 sprint (2026-10-02, one hour, all five slices in 10.6.7)
+- 10.6.7 (bfce1db12, train/79 1917333e1): Tests, Bun Parity, Coverage, Security Audit, First-run gate, SBOM, Release, Post-Release Smoke, Promote all success.
+- Shipped: `loki start` runs Loki 10 (moat P9 probe ported, moat rc=0); dashboard prints the bound port (LEAK3, test-ui-bare-loki rc=0); reviewer-first PR body; issue-to-PR Action on Loki 10 plus nightly `loki backlog` example; visible cost cap ($20 default, `--max-cost`, loki.yaml `budgets.per_run`, BUDGET_STOP exit 3).
+- Open: no real end-to-end exit 3 run of the cost cap yet; root action.yml still uses `loki start --simple`.
+- D61 (speed, docs/v10/D61-SPEED.md) resumed under D62. Worktree agent-ad890c5afa3648ae6 held no saved slice 17 work (clean, no commits), so slice 17 restarts. Peer GO covers slices 1, 2, 7, 8, 17 behind LOKI_SPEED=1.
+- D58 basics 1 and 2 below are superseded by 10.6.7 (now PASS on CI; still unproven on a real repo).
+
+## D58 basics
+1. `loki start` runs v10: FAIL. Both the minimal route (b2e3afc43, a 7-line bin/loki start arm) and the full re-route regress moat P9, because tests/moat P9 drives `loki start <issue>` through the legacy path; port that probe to the v10 issue path first, then re-land b2e3afc43. The full re-route W1-ROUTE is built (branch slice-D57-W1-ROUTE, commit a8ed5461a, which is based on the old main that still has the CP-00 JWT commits, so cherry-pick it, never merge it) but turned Tests red as listed above. Its docs follow-up is f001bc0f1.
+2. Dashboard: FAIL. LEAK3 (bound URL, scoped reuse, 57374-57399 guard; branch slice-P0-DASH-LEAK3, ceba8a6de) failed `test-ui-bare-loki` in CI and was reverted. The Control Plane v0 live view (CP-RELAND) ships in 10.6.6, off unless LOKI_CONTROL_URL is set.
+3. Scope control: SHIPPED in 10.6.6 (D58-SCOPE, reverts unrelated edits, lists them in NOT PROVEN). Unproven on a real repo.
+4. Clean install: PASS on 10.6.0 (per-platform @oven/bun-* deps; post-release smoke passed, which is what fired the promote).
+5. Real-repo gate before latest moves: FAIL. `scripts/real-repo-gate.sh` exists but promote does not call it, and it needs operator provider auth (ANTHROPIC_API_KEY or CLAUDE_CODE_OAUTH_TOKEN, plus GH_TOKEN) that this session does not have. Not run against latest.
+
+## NOT DONE and why
+- W1-ROUTE and its docs cleanup: red CI (above); dropped per D46 rule 2.
+- LEAK3 dashboard fix: red CI (`test-ui-bare-loki`); dropped. Its test expectation and the new bound-URL output disagree; decide which is right.
+- Real-repo gate run: no provider auth in the session; never reads stored keys.
+- Coverage W1-ROUTE removed and must be replaced when it re-lands: `why --json` schema test, eval harness cost checks (R2, S41-01), five trust-core probe cases (CTO sign-off).
+- Wiring the real-repo gate into promote.yml (so latest cannot move without it).
+
+## Founder queue
+- Re-land W1-ROUTE with the moat P5/P9 regressions fixed first (moat outranks everything).
+- Decide whether promote must call the real-repo gate, and supply provider auth for it.
+- The D59 override (release without waiting for CI) expired at 20:10Z; the Release workflow's required-ci still enforced green Tests throughout.
+- Housekeeping: about 43 worktrees under .claude/worktrees (cap 15); backup branches backup/train-67..70 and backup/main-pre-rebuild hold the CP-00 JWT lineage, so never push them.

package/docs/v10/PROGRESS.md

@@ -1898,3 +1898,16 @@ The swarm is stopped: .loki/V10-STOP exists, the loop has no wake-ups, and the c
 - NPM-LAG guard row: publish, smoke and promote wait up to 45 min for the version and re-trigger promote; train-cycle merges origin/main back after each release (it stalled at 16:20Z, merged by hand as cc3e1392).
 - E-160 (D55, train verdict reuse on main; CodeQL always runs; kill switch LOKI_E160_REUSE=0) merged locally after an opus APPROVE.
 - D56 Control Plane: design (docs/v10/CONTROL-PLANE.md, 19 slices), CP-00 corpus, CP-01 service (Hono, Drizzle, bun:sqlite; idempotent ingest, 409 on conflict, fold-derived runs), CP-02 shipper (no-op unless LOKI_CONTROL_URL; exactly-once backfill; redaction) and CP-03 UI (runs list and detail; unpriced never shown as 0) merged locally. CP-04 (wire loki control, packaging, CI, test isolation) and BUN-OPT (npm 11 allow-scripts warning: per-platform @oven/bun packages) building.
+
+## 2026-10-02T23:24Z D60 sprint: v10.6.7 cut with all five slices; D61 paused by the governor
+- v10.6.7 (release commit bfce1db12, train/79 at 1917333e1): `loki start owner/repo#N` runs Loki 10 (D60-1, merge 1e6cbeb65, moat P9 probe ported, moat run rc=0 "no rule failed (4 of 9 proven)"), dashboard prints the port it bound (D60-2, test-ui-bare-loki rc=0), reviewer-first PR body (D60-3, merge 6cfabcf8b), issue-to-PR Action on Loki 10 plus nightly `loki backlog` example (D60-4, test-issue-to-pr-action rc=0), visible cost cap with $20 default and BUDGET_STOP exit 3 (D60-5, merge 34c007e9e).
+- train/79 CI: Tier A, Bun Parity, First-run gate, Coverage, Security Audit, Tests all success. train-cycle phase B "PROMOTED train/79 -> main" 23:21:15Z; phase C "RELEASED v10.6.7" 23:21:26Z. On bfce1db12 so far: Bun Parity, First-run gate, SBOM success; Release and npm `next` pending.
+- train/78 (4da502a47) was red on Tier A "emoji/dash on changes" (literal dashes in reviewer_body.test.ts regex); fixed forward with unicode escapes (1917333e1). e10ext budget 1520 > 1500 fixed by trimming blank lines in assert_delta.ts (4da502a47; engine10 1032 pass, 0 fail).
+- Not done: a real end-to-end exit 3 run for the cost cap (unit-tested only); the root action.yml still uses `loki start --simple`.
+- D61 (speed, docs/v10/D61-SPEED.md): paused, governor max engineers 0 (weekly projected 167.8%). Slice 17 engineer stopped; partial work in worktree agent-ad890c5afa3648ae6.
+- 23:51Z: Post-Release Smoke and Promote success on bfce1db12; npm latest and next both 10.6.7. Sprint closed. (The pause was lifted by D62 at about 00:05Z on 2026-10-03.)
+
+## 2026-10-03T01:56Z D62 resume, D63 roadmap, D64 withdrawn; 4 builders on D63 order
+- D62 (resume now) and D63 (roadmap, docs/v10/ROADMAP-D63.md) recorded and pushed (main 49a940d81). D64 (max pace, all Vorflux rows) arrived at 00:20Z and was withdrawn at 00:25Z; recorded as WITHDRAWN, no builder started.
+- Building (sonnet, worktrees): D61-17 large eval tier, D61-01 pre-model timer, D61-08 decomposer, D62-FIX (action.yml to Loki 10 plus real BUDGET_STOP exit 3 test). Ready next: D61-02, D61-07, D62-VIS, D62-JIRA.
+- Governor: weekly projected 57.4% at 01:55Z; pace target about 0.5% of the week per hour at 4 engineers.

package/docs/v10/ROADMAP-D63.md

@@ -0,0 +1,35 @@
+# Roadmap D63: the industry-standard autonomous software factory
+
+Founder directive D63 (2026-10-03 00:15Z, relayed by the autonomi-dev session). This page sets the roadmap that D50, D51, D56 and D61 slot into. The measurable bars below are the only claim we make. User-facing text makes no "superintelligence" or benchmark claims, and no row is done without a test or an eval row in METRICS.
+
+## Pillars: the bar to match, and how we beat it
+
+| # | Pillar | Bar to match | How we beat it | Done when (test or eval row) |
+|---|---|---|---|---|
+| 1 | Autonomy | Devin, Factory Droids: an issue, backlog or spec goes in; merge-ready PRs come out; no babysitting | Proof plus lift | D50 lift on the eval, never below raw on the same model; D61 speed targets; a BLOCKED run asks exactly one question |
+| 2 | Speed at scale | Factory: parallel units with an integrator; warm start | Same or fewer tokens than one sequential session | D61 large-arm eval holds (section 5 of D61-SPEED.md) before the default flips |
+| 3 | Evidence | Devin, Vorflux: PR bodies with tests, screenshots of changed pages, HTTP transcripts for APIs | A signed receipt covers all of it | Screenshots are generated locally (Playwright) and hashed into the receipt; `loki verify` fails if one is altered |
+| 4 | Control Plane UI | Devin web app, Factory dashboard | Every number links to its receipt | D56 is the default: live runs, history, PRs and issues, cost, compare, and a BLOCKED question answerable in the UI; one container with Helm and ECS examples; the old dashboard retired once at parity |
+| 5 | Connections | Devin, Factory integrations | Intake is the same v10 run with the same receipt | GitHub (PAT now, GitHub App next) and GitLab; Jira and Linear intake; two-way Slack (`@loki` in a thread starts a run, BLOCKED answers come back); issue-to-PR Action; an MCP server exposing run, status and verify; VS Code and JetBrains via ACP later |
+| 6 | Spec to software | 8090 | Every acceptance criterion traced to code and a check in the receipt | A spec or PRD file becomes a delivery contract, decomposed (D61) into units and then PRs; replaces the legacy PRD path (D57) |
+| 7 | Legacy and modernization | 8090, Factory | Proof of function on legacy code | `loki modernize` stays hidden until it passes a real-repo eval; not this week |
+| 8 | Claude Code parity | Claude Code | Runs inside it with a receipt | loki-seal plus a /loki command that runs the v10 engine on the current task; CLAUDE.md and .claude/skills honoured in the context pack |
+| 9 | Enterprise | Devin and Factory enterprise tiers | Audit from the receipt chain | An audit log of model calls; budgets per team; SSO for the Control Plane later; never certification claims |
+
+## Order this week (under the usage governor)
+1. D61 eval arm (slice 17), then warm start (slices 5 and 6), with slices 1, 2, 7 and 8 in parallel.
+2. Visual evidence in PRs (pillar 3).
+3. Control Plane as the default, with the BLOCKED answer UI (pillar 4).
+4. Two-way Slack (pillar 5).
+5. Jira and Linear intake (pillar 5).
+6. Spec to contract (pillar 6).
+7. Multi-repo workspaces (D51 Phase B, behind LOKI_WORKSPACES).
+8. MCP run, status and verify server (pillar 5).
+9. Containers (pillar 4).
+
+Also from D62: root action.yml routes to Loki 10; one real end-to-end BUDGET_STOP exit 3 test; project memory (D50 item 3). Later: merge queue, PR review with a risk score, REST API.
+
+## Rules
+- Each item ships on its own train, behind a flag where it changes defaults, with README and docs updated in the same slice.
+- Each release reports its version and what users can now do to the autonomi-dev session.
+- Pacing follows the governor (about 0.5% of the weekly window per hour); seats scale only with live /usage.