loki-mode 10.6.7 → 10.6.8

package/README.md

@@ -11,7 +11,7 @@ An autonomous software factory that knows what it is supposed to deliver, and pr
 
 Loki Mode is a free, source-available autonomous coding agent by [Autonomi](https://www.autonomi.dev/). Hand it a PRD, GitHub issue, OpenAPI doc or one-line brief. It derives a delivery contract (the acceptance criteria), builds against it, and ends with a signed Evidence Receipt that states what was proven and what was not. If the contract cannot be derived, it stops and asks one question instead of guessing.
 
-Before a build counts as done, a review council selects reviewers from a specialist pool (`agents/types.json`, scored by `run.sh:FOCUS_KEYWORDS`). The bundled MCP server exposes 36 tools over stdio (`mcp/server.py`).
+Before a build counts as done, a review council selects reviewers from a specialist pool (`agents/types.json`, scored by `run.sh:FOCUS_KEYWORDS`). The bundled MCP server exposes 39 tools over stdio (`mcp/server.py`), including `loki_v10_run`, `loki_v10_status` and `loki_v10_verify` to start a Loki 10 run in the background, read its phase, verdict and cost, and verify its receipt.
 
 ## Contents
 
@@ -120,6 +120,8 @@ flowchart TD
 | pr | Opened by the supervisor, not the worker (the worker never holds a GitHub token). A non-VERIFIED run opens a draft PR. The body is written for a 60-second review: what the issue asked, what changed, how it was tested, NOT PROVEN, then the receipt digest and `loki verify`. Data the run did not record prints "not recorded". |
 | deep verify | Detached, started after the PR opens (so not with `--no-pr`): full suite, app-boot probe, council, secret scan. A check that is refused or unavailable is reported as NOT PROVEN, never as red. `--deep` is a separate flag that raises the implement and run budgets. |
 
+Warm start (experimental, `LOKI_SPEED=1`, off by default): `loki engine10 dashboard` also serves a unix socket at `~/.loki/run/engine.sock` (override with `LOKI_WARM_SOCK`) that keeps the repo map and test map in memory, keyed by the tree SHA plus a hash of dirty files, so an edit invalidates them. A run tries the socket for 50ms and prints `warm in Xs` when it answers; with no daemon it runs the cold path with identical events.
+
 PR body sample (`loki-ts/src/e10ext/reviewer_body.ts`):
 
 ```
@@ -153,6 +155,27 @@ A finished run prints a short summary (see [Quiet output](#quiet-output), which
 
 `loki status [run-id]` and `loki verify [run-id]` are built on the v10 path (bare `loki verify` follows the newest run, v10 or legacy). `loki dashboard` and `loki status` reach the v10 commands with `LOKI_ENGINE=v10`. Slack notifications are not part of the v10 engine surface yet.
 
+## Run from Jira or Linear
+
+Loki 10 can start from a Jira or Linear issue the same way it starts from a GitHub issue: same run, same receipt. The issue is fetched deterministically before any model runs and normalized into the same `issue.json`, with a `source` field of `jira` or `linear`.
+
+```bash
+loki jira:PROJ-123     # or https://<site>.atlassian.net/browse/PROJ-123
+loki linear:ENG-42     # or a linear.app issue URL
+```
+
+- Jira needs `JIRA_EMAIL` and `JIRA_API_TOKEN`, plus `JIRA_BASE_URL` (for example `https://acme.atlassian.net`) unless you pass the full browse URL. The ADF description is converted to plain text.
+- Linear needs `LINEAR_API_KEY`.
+- A missing variable stops the run before any work with an error naming it (exit code 2, like other intake errors). GitHub refs are unchanged.
+
+## Two-way Slack (preview)
+
+With `LOKI_SLACK_INBOUND=1`, `loki slack serve --port N` (127.0.0.1 by default) lets you mention `@loki <issue ref or task>` in Slack to start a run, and answer a BLOCKED question in the same thread. Needs `SLACK_BOT_TOKEN` and `SLACK_SIGNING_SECRET` in the environment. See [docs/slack.md](docs/slack.md) for the scopes.
+
+## Spec to contract
+
+Opt in with `LOKI_CONTRACT=1` (off by default). `loki contract <spec.md>` parses a spec or PRD into numbered acceptance criteria (AC-1, AC-2, up to 50) from checklist items (`- [ ]`) and from bullets and numbered lists under headings such as "Acceptance criteria", "Requirements" or "Must", prints them, and writes `.loki/contract.json` at the repo root. When a run seals with a contract present, each criterion is matched to changed files and checks by keyword overlap and recorded in an optional `contract` field on the receipt (`keyword_match` or `no_match`). Unmatched criteria are listed under NOT PROVEN in the receipt and the PR body (advisory only, the verdict is unchanged). Keyword overlap is a heuristic: `keyword_match` means a changed file plausibly relates to the criterion, not that the criterion is proven. The legacy PRD path is unchanged.
+
 ## Triggers without a cloud
 
 Both run on your own GitHub Actions minutes; there is no hosted service.
@@ -210,6 +233,10 @@ loki verify
 
 A verified receipt is bound to the run's event log, so a receipt lifted out of its run, or a log edited after sealing, does not verify. Signing proves the receipt came from the key holder; it does not prove the generated code is bug-free. A receipt only claims what its checks ran, and states what they did not.
 
+### Visual evidence (opt-in)
+
+With `LOKI_VISUAL_EVIDENCE=1`, a v10 run that changed web page files (html, jsx, tsx, vue, svelte under app/, pages/, src/ or public/) starts the repo's dev, preview or start script and screenshots each changed route with the repo's own Playwright (nothing is downloaded) into a fresh per-run directory `.loki/runs/<run_id>/evidence/<random>/` (at most 5 routes, total capture budget 25s, aborted with the seal stage). API-only repos with an openapi file get an HTTP transcript at `.loki/runs/<run_id>/evidence/<random>/http.json` (not hashed into the receipt). Each screenshot's sha256 is recorded in the receipt as `evidence_screens`, the PR body gets an Evidence section, and `loki verify` reports TAMPERED if a recorded screenshot is altered, missing or a symlink. Capture never fails the run; a skip is listed in NOT PROVEN. Off by default.
+
 ## Quiet output
 
 The v10 run is quiet by default: no stage chatter, only the final summary. `--verbose` tails the event stream live (one line per finished stage and a heartbeat with elapsed time and the running diff size). `--json` prints one JSON object (`ok`, `outcome`, `stop`, `run_id`, `receipt_sha256`) instead of text.
@@ -261,6 +288,12 @@ LOKI_CONTROL=1 loki control status       # reachable? how many runs held?
 
 The URL comes from `LOKI_CONTROL_URL`, else `http://127.0.0.1:${LOKI_CONTROL_PORT:-47821}`. Set `LOKI_CONTROL_URL` on a run to ship it live. See [docs/v10/CONTROL-PLANE.md](docs/v10/CONTROL-PLANE.md).
 
+Answering a BLOCKED run: when a run stops on a spec conflict, its run page shows the question and an answer box. Submitting posts to `POST /v1/runs/<source>/<run>/answer` (JSON `{"answer": "..."}`, up to 4000 characters, loopback only) and writes `~/.loki/control/answers/<source>/<run>.answer.txt` (override the directory with `LOKI_CONTROL_ANSWER_DIR`). The page prints the resume command, which re-runs the task with that file's text.
+
+Set `LOKI_CONTROL_DEFAULT=1` (off by default) to make `loki dashboard`, `loki dashboard start` and `loki dashboard open` start the Control Plane instead of the old dashboard. The old dashboard is unchanged when the flag is unset.
+
+Container, Helm and ECS deployment: [docs/control-plane-container.md](docs/control-plane-container.md).
+
 ## Providers
 
 Loki's autonomy and quality loop are the product; the coding CLI is swappable. With `LOKI_PROVIDER` unset, Loki auto-detects the first installed provider in this order (`providers/loader.sh`): claude, cline, codex, aider, opencode. An explicit choice always wins and is never silently substituted. Gemini CLI is deprecated: `LOKI_PROVIDER=gemini` exits with a migration message.
@@ -515,6 +548,7 @@ Loki 10 engine:
 | `loki owner/repo#N` | Same, from a GitHub, GitLab or Jira issue |
 | `loki quick "<task>"` | Small task, lean path, no PR |
 | `loki backlog owner/repo --all\|--label X\|--issues N,N` | Run every matching open issue, N in parallel (`--concurrency N`, `--dry-run`) |
+| `loki workspace list \| run <name> <ref>` | Experimental (`LOKI_WORKSPACES=1`): run one issue across the repos of a `loki.yaml` workspace; see [docs/WORKSPACES.md](docs/WORKSPACES.md) |
 | `loki status [--json]` | Current status |
 | `loki verify [run-id]` | Re-check a sealed receipt (exit codes above) |
 | `loki doctor [--json] [--airgap]` | Check environment and providers |

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: An autonomous software factory that knows what it is supposed to deliver, and proves it did. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v10.6.7
+# Loki Mode v10.6.8
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the legacy engine, which still ships and is being removed (`loki start owner/repo#N` still routes to it; prefer `loki owner/repo#N`).
 
@@ -473,4 +473,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v10.6.7 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v10.6.8 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-10.6.7
+10.6.8

package/autonomy/lib/workspace.py

@@ -0,0 +1,290 @@
+#!/usr/bin/env python3
+"""loki workspace: run one issue across several repos (D51 Phase B, D65).
+
+    loki workspace list
+    loki workspace run <name> <issue-ref>
+
+Gated by LOKI_WORKSPACES=1. Workspaces are defined in loki.yaml:
+
+    workspaces:
+      shop:
+        repos:
+          - {repo: acme/api, path: ~/src/api, setup: "npm ci"}
+          - {repo: acme/web, path: ~/src/web, after: [acme/api]}
+        integration: {command: "make e2e", timeout_s: 900}
+
+Each repo gets its own worktree and engine run (continue-and-report: a failing
+repo does not stop the others; dependents of a failed repo are SKIPPED). After
+every repo has finished, the integration command runs once with each run branch
+checked out, and evidence lands in
+.loki/workspaces/<name>/<run-id>/integration.json. Integration evidence is not
+part of the Seal.
+
+Exit: 0 all repos ok and integration not failed; 1 otherwise; 2 usage/config.
+
+Test seam: LOKI_WORKSPACE_LAUNCHER replaces the engine launcher (called with
+the issue ref or task text, cwd = the repo worktree).
+"""
+import datetime
+import hashlib
+import json
+import os
+import re
+import signal
+import subprocess
+import sys
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, HERE)
+
+REPO_ROOT = os.path.abspath(os.path.join(HERE, "..", ".."))
+REPO_RE = re.compile(r"^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$")
+REF_RE = re.compile(r"^([A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+)#(\d+)$")
+
+
+def say(msg):
+    print(msg, flush=True)
+
+
+def enabled(env=None):
+    return (os.environ if env is None else env).get("LOKI_WORKSPACES") == "1"
+
+
+def git(*args, cwd=None):
+    return subprocess.run(["git", *args], cwd=cwd, capture_output=True, text=True)
+
+
+def load_workspaces(cfg=None):
+    """Return (workspaces, errors) from loki.yaml (or the given cfg mapping)."""
+    if cfg is None:
+        import loki_yaml
+        cfg, _path, errors = loki_yaml.load()
+        if errors:
+            return {}, errors
+    return cfg.get("workspaces") or {}, []
+
+
+def order_repos(ws):
+    """Return repo entries ordered so every `after` predecessor comes first.
+
+    Raises ValueError on an unknown `after` entry, a duplicate repo or a cycle.
+    """
+    entries = list(ws.get("repos") or [])
+    names = [e.get("repo") for e in entries]
+    if len(set(names)) != len(names):
+        raise ValueError("duplicate repo in workspace")
+    for e in entries:
+        if not isinstance(e.get("repo"), str) or not REPO_RE.match(e["repo"]):
+            raise ValueError("repo must be owner/name, got %r" % (e.get("repo"),))
+        for dep in e.get("after") or []:
+            if dep not in names:
+                raise ValueError("%s: unknown after repo %s" % (e["repo"], dep))
+    done, ordered, remaining = set(), [], entries
+    while remaining:
+        ready = [e for e in remaining if all(d in done for d in e.get("after") or [])]
+        if not ready:
+            raise ValueError("cycle in `after`: " + ", ".join(e["repo"] for e in remaining))
+        for e in ready:
+            ordered.append(e)
+            done.add(e["repo"])
+        remaining = [e for e in remaining if e not in ready]
+    return ordered
+
+
+def _slug(repo):
+    return repo.replace("/", "__")
+
+
+def source_checkout(entry):
+    """Local checkout for a repo entry: its `path`, else clone into ~/.loki/repos/<slug>."""
+    if entry.get("path"):
+        return os.path.abspath(os.path.expanduser(entry["path"]))
+    dest = os.path.join(os.path.expanduser("~"), ".loki", "repos", _slug(entry["repo"]))
+    if not os.path.isdir(os.path.join(dest, ".git")):
+        os.makedirs(os.path.dirname(dest), exist_ok=True)
+        r = subprocess.run(["git", "clone", "https://github.com/%s.git" % entry["repo"], dest],
+                           capture_output=True, text=True)
+        if r.returncode != 0:
+            raise RuntimeError("clone failed: " + (r.stderr.strip().splitlines() or ["git error"])[-1])
+    return dest
+
+
+def prepare(source, dest, branch, setup):
+    """Make a worktree via worktree_prep when available, else a minimal `git worktree add`."""
+    try:
+        import worktree_prep
+        res = worktree_prep.prepare_worktree(source, dest, branch, setup=setup)
+        return res["path"]
+    except ImportError:
+        pass
+    os.makedirs(os.path.dirname(dest), exist_ok=True)
+    r = git("worktree", "add", "-B", branch, dest, "HEAD", cwd=source)
+    if r.returncode != 0:
+        raise RuntimeError("worktree: " + (r.stderr.strip().splitlines() or ["git error"])[-1])
+    if setup:
+        s = subprocess.run(setup, shell=True, cwd=dest, capture_output=True, text=True)
+        if s.returncode != 0:
+            raise RuntimeError("setup failed: " + (s.stderr.strip().splitlines() or ["no output"])[-1])
+    return dest
+
+
+def task_for(entry, ref, siblings):
+    """(launcher argument, extra env) for a repo: the issue ref when it lives here, else task text."""
+    m = REF_RE.match(ref)
+    if m and m.group(1) == entry["repo"]:
+        return ref, {}
+    text = ("Implement the change described by %s for the repo %s. Sibling worktrees (read-only "
+            "context, do not edit): %s" % (ref, entry["repo"], ", ".join(siblings) or "none"))
+    return text, {"LOKI_E10_TASK_TEXT": text}
+
+
+def run_integration(ws, run_dir, worktrees, heads):
+    """Run the integration command once; return the evidence dict."""
+    integ = ws.get("integration") or {}
+    cmd = integ.get("command")
+    ev = {"heads": heads, "exit_code": None, "log_sha256": None, "status": "not_configured",
+          "seal": False, "note": "integration evidence is not part of the Seal"}
+    if not cmd:
+        return ev
+    timeout = integ.get("timeout_s", 900)
+    env = dict(os.environ)
+    for repo, wt in worktrees.items():
+        env["LOKI_WS_DIR_" + re.sub(r"[^A-Za-z0-9]", "_", repo).upper()] = wt
+    log_path = os.path.join(run_dir, "integration.log")
+    with open(log_path, "wb") as lf:
+        p = subprocess.Popen(cmd, shell=True, cwd=run_dir, env=env, stdout=lf, stderr=subprocess.STDOUT,
+                             stdin=subprocess.DEVNULL, start_new_session=True)
+        try:
+            rc = p.wait(timeout=timeout)
+            ev["status"] = "passed" if rc == 0 else "failed"
+        except subprocess.TimeoutExpired:
+            try:
+                os.killpg(p.pid, signal.SIGKILL)
+            except OSError:
+                pass
+            p.wait()
+            rc = 124
+            ev["status"] = "failed"
+            ev["note"] += "; timeout after %ss" % timeout
+    ev["exit_code"] = rc
+    with open(log_path, "rb") as f:
+        ev["log_sha256"] = hashlib.sha256(f.read()).hexdigest()
+    return ev
+
+
+def run_workspace(name, ref, workspaces, base_dir=None, launcher=None):
+    """Run the workspace; return (exit_code, evidence_path_or_None)."""
+    ws = workspaces.get(name)
+    if ws is None:
+        say("workspace: unknown workspace %r (known: %s)" % (name, ", ".join(sorted(workspaces)) or "none"))
+        return 2, None
+    try:
+        ordered = order_repos(ws)
+    except ValueError as e:
+        say("workspace: %s: %s" % (name, e))
+        return 2, None
+    if not ordered:
+        say("workspace: %s has no repos" % name)
+        return 2, None
+
+    base_dir = base_dir or os.getcwd()
+    run_id = datetime.datetime.now(datetime.timezone.utc).strftime("%Y%m%dT%H%M%S%fZ")
+    run_dir = os.path.join(base_dir, ".loki", "workspaces", name, run_id)
+    os.makedirs(run_dir, exist_ok=True)
+    launcher = launcher or os.environ.get("LOKI_WORKSPACE_LAUNCHER") or os.path.join(REPO_ROOT, "bin", "loki")
+    child_env_base = dict(os.environ, LOKI_ENGINE="v10", LOKI_NO_BROWSER="1")
+
+    outcome, worktrees, heads = {}, {}, {}
+    running = {}
+
+    def stop(*_):
+        for p in running.values():
+            try:
+                os.killpg(p.pid, signal.SIGTERM)
+            except OSError:
+                pass
+        sys.exit(130)
+    signal.signal(signal.SIGTERM, stop)
+
+    for i, entry in enumerate(ordered):
+        repo = entry["repo"]
+        failed_dep = [d for d in entry.get("after") or [] if outcome.get(d) != "ok"]
+        if failed_dep:
+            outcome[repo] = "SKIPPED (predecessor failed: %s)" % ", ".join(failed_dep)
+            say("workspace: %s %s" % (repo, outcome[repo]))
+            continue
+        try:
+            src = source_checkout(entry)
+            dest = os.path.join(run_dir, "worktrees", _slug(repo))
+            wt = prepare(src, dest, "loki/ws-%s-%d" % (run_id, i), entry.get("setup"))
+        except (RuntimeError, OSError) as e:
+            outcome[repo] = "FAILED: %s" % e
+            say("workspace: %s %s" % (repo, outcome[repo]))
+            continue
+        worktrees[repo] = wt
+        siblings = [os.path.join(run_dir, "worktrees", _slug(o["repo"])) for o in ordered if o["repo"] != repo]
+        arg, extra = task_for(entry, ref, siblings)
+        log = os.path.join(run_dir, "%s.log" % _slug(repo))
+        say("workspace: %s running" % repo)
+        with open(log, "w") as lf:
+            p = subprocess.Popen([launcher, arg], cwd=wt, env=dict(child_env_base, **extra), stdout=lf,
+                                 stderr=subprocess.STDOUT, stdin=subprocess.DEVNULL, start_new_session=True)
+            running[repo] = p
+            rc = p.wait()
+            running.pop(repo, None)
+        outcome[repo] = "ok" if rc == 0 else "FAILED: exit %d" % rc
+        say("workspace: %s %s" % (repo, outcome[repo]))
+
+    for repo, wt in worktrees.items():
+        r = git("rev-parse", "HEAD", cwd=wt)
+        heads[repo] = r.stdout.strip() if r.returncode == 0 else None
+
+    ev = run_integration(ws, run_dir, worktrees, heads)
+    ev["outcomes"] = outcome
+    ev_path = os.path.join(run_dir, "integration.json")
+    tmp = ev_path + ".tmp"
+    with open(tmp, "w") as f:
+        json.dump(ev, f, indent=2, sort_keys=True)
+    os.replace(tmp, ev_path)
+
+    say("")
+    say("Summary: workspace %s (%s)" % (name, run_id))
+    for repo, res in outcome.items():
+        say("%-30s %s" % (repo, res))
+    say("%-30s %s" % ("integration", ev["status"]))
+    bad = any(v != "ok" for v in outcome.values()) or ev["status"] == "failed"
+    return (1 if bad else 0), ev_path
+
+
+def main(argv):
+    if not enabled():
+        say("loki workspace is disabled. Set LOKI_WORKSPACES=1 to use it.")
+        return 2
+    if not argv or argv[0] in ("-h", "--help", "help"):
+        say("Usage: loki workspace list | run <name> <owner/repo#N | task text>")
+        return 0 if argv else 2
+    try:
+        workspaces, errors = load_workspaces()
+    except Exception as e:  # CannotCheck or parse failure
+        say("workspace: cannot read loki.yaml: %s" % e)
+        return 2
+    if errors:
+        for e in errors:
+            say("workspace: config error: %s" % e)
+        return 2
+    cmd = argv[0]
+    if cmd == "list":
+        if not workspaces:
+            say("no workspaces defined in loki.yaml")
+        for n, ws in sorted(workspaces.items()):
+            say("%s: %s" % (n, ", ".join(e.get("repo", "?") for e in ws.get("repos") or [])))
+        return 0
+    if cmd == "run" and len(argv) >= 3:
+        rc, _ = run_workspace(argv[1], " ".join(argv[2:]), workspaces)
+        return rc
+    say("Usage: loki workspace list | run <name> <issue-ref>")
+    return 2
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1:]))

package/autonomy/lib/worktree_prep.py

@@ -0,0 +1,143 @@
+#!/usr/bin/env python3
+"""Shared worktree substrate (D51 Phase B, D61 slice 7).
+
+prepare_worktree() creates a git worktree for a run from a clean start point,
+never carrying the source checkout's uncommitted edits, and prepares
+dependencies (setup command, else copy-on-write copy of ignored dep dirs).
+"""
+
+import fcntl
+import json
+import os
+import re
+import subprocess
+import sys
+
+DEP_DIRS = ("node_modules", ".venv", "venv", "vendor")
+
+
+def _git(repo, *args, check=True):
+    return subprocess.run(
+        ["git", "-C", repo, *args], capture_output=True, text=True, check=check
+    )
+
+
+def _slug(repo):
+    real = os.path.realpath(repo)
+    return re.sub(r"[^A-Za-z0-9._-]+", "-", real).strip("-")[-120:] or "repo"
+
+
+def _lock_path(repo):
+    d = os.path.join(os.path.expanduser("~"), ".loki", "repos")
+    os.makedirs(d, exist_ok=True)
+    return os.path.join(d, _slug(repo) + ".lock")
+
+
+def _start_point(repo, base):
+    if base:
+        return base
+    if _git(repo, "remote", check=False).stdout.strip():
+        _git(repo, "fetch", "--quiet", check=False)
+    for ref in ("origin/HEAD", "HEAD"):
+        probe = _git(repo, "rev-parse", "--verify", "--quiet", ref + "^{commit}", check=False)
+        if probe.returncode == 0:
+            return ref
+    raise RuntimeError("no start point: repository has no commits")
+
+
+def _left_out_changes(repo):
+    out = _git(repo, "status", "--porcelain", check=False).stdout
+    return len([line for line in out.splitlines() if line.strip()])
+
+
+def _cow_copy(src, dst):
+    if sys.platform == "darwin":
+        cmds = [["cp", "-c", "-R", src, dst]]
+    else:
+        cmds = [["cp", "-R", "--reflink=auto", src, dst]]
+    cmds.append(["cp", "-R", src, dst])
+    for cmd in cmds:
+        if os.path.lexists(dst):
+            subprocess.run(["rm", "-rf", dst], check=False)
+        if subprocess.run(cmd, capture_output=True).returncode == 0:
+            return True
+    return False
+
+
+def _escapes_source(path):
+    """True if a dep dir has an absolute symlink or an editable finder."""
+    for root, dirs, files in os.walk(path):
+        for name in dirs + files:
+            p = os.path.join(root, name)
+            if os.path.islink(p):
+                if os.path.isabs(os.readlink(p)):
+                    return True
+            elif name.endswith(".pth") or name.startswith("__editable__"):
+                return True
+    return False
+
+
+def _copy_deps(source, dest, start):
+    copied = 0
+    for name in DEP_DIRS:
+        s = os.path.join(source, name)
+        if not os.path.isdir(s) or os.path.islink(s):
+            continue
+        if _git(source, "check-ignore", "-q", name + "/", check=False).returncode != 0:
+            continue
+        if _git(source, "ls-tree", "-d", start, name, check=False).stdout.strip():
+            continue
+        if _escapes_source(s):
+            raise RuntimeError("deps: copy unsafe, declare setup")
+        if not _cow_copy(s, os.path.join(dest, name)):
+            raise RuntimeError("deps: copy failed, declare setup")
+        copied += 1
+    return copied
+
+
+def prepare_worktree(source_repo, dest, branch, setup=None, base=None):
+    source_repo = os.path.abspath(source_repo)
+    dest = os.path.abspath(dest)
+    lock = open(_lock_path(source_repo), "w")
+    try:
+        fcntl.flock(lock, fcntl.LOCK_EX)
+        left_out = _left_out_changes(source_repo)
+        start = _start_point(source_repo, base)
+        base_sha = _git(source_repo, "rev-parse", start + "^{commit}").stdout.strip()
+        _git(source_repo, "worktree", "add", "-b", branch, dest, base_sha)
+    finally:
+        fcntl.flock(lock, fcntl.LOCK_UN)
+        lock.close()
+
+    deps = "none"
+    if setup:
+        r = subprocess.run(setup, shell=True, cwd=dest)
+        if r.returncode != 0:
+            raise RuntimeError("deps: setup command failed (exit %d)" % r.returncode)
+        deps = "setup"
+    elif _copy_deps(source_repo, dest, base_sha):
+        deps = "cow" if sys.platform in ("darwin", "linux") else "copy"
+    return {"path": dest, "base_sha": base_sha, "deps": deps, "left_out_changes": left_out}
+
+
+def main(argv=None):
+    import argparse
+
+    p = argparse.ArgumentParser(description="Prepare an isolated git worktree")
+    p.add_argument("source")
+    p.add_argument("dest")
+    p.add_argument("branch")
+    p.add_argument("--setup", default=None)
+    p.add_argument("--base", default=None)
+    a = p.parse_args(argv)
+    try:
+        res = prepare_worktree(a.source, a.dest, a.branch, a.setup, a.base)
+    except (RuntimeError, subprocess.CalledProcessError) as e:
+        print(json.dumps({"error": str(e)}))
+        return 1
+    print(json.dumps(res))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/autonomy/loki

@@ -1630,6 +1630,7 @@ show_help() {
     echo "  start [SPEC]     Start a build (PRD file, GitHub/GitLab/Jira/Azure issue, or no arg)"
     echo "  plan <PRD-file>  Dry-run analysis: complexity, cost, execution plan"
     echo "  backlog <owner/repo> --all|--label X|--issues N,N   Run every matching open issue, N in parallel"
+    echo "  workspace list | run <name> <ref>   Multi-repo runs from loki.yaml workspaces (LOKI_WORKSPACES=1)"
     echo "  quickstart [idea]  Guided first build: setup, idea, template, plan, go"
     echo ""
     echo "Session:"
@@ -7324,6 +7325,17 @@ _loki_dashboard_bind_is_safe() {
 cmd_dashboard() {
     local subcommand="${1:-}"
 
+    # LOKI_CONTROL_DEFAULT=1 (off by default): open the Control Plane instead of the old dashboard.
+    # The old dashboard stays available when the flag is unset, and via `loki dashboard stop|status|url`.
+    if [ "${LOKI_CONTROL_DEFAULT:-0}" = "1" ]; then
+        case "$subcommand" in
+            ""|start|open)
+                echo "LOKI_CONTROL_DEFAULT=1: starting the Control Plane (unset it to use the old dashboard)"
+                LOKI_CONTROL=1 exec "$0" control serve
+                ;;
+        esac
+    fi
+
     # If no subcommand provided, show help (backward compatible with old behavior)
     if [ -z "$subcommand" ]; then
         cmd_dashboard_help
@@ -12909,6 +12921,16 @@ cmd_config_schema() {
     loki_config_generate_schema
 }
 
+# D65: multi-repo workspaces (D51 Phase B). Gated by LOKI_WORKSPACES=1.
+cmd_workspace() {
+    if [ "${LOKI_WORKSPACES:-}" != "1" ]; then
+        echo -e "${RED}loki workspace is disabled.${NC} Set LOKI_WORKSPACES=1 to use it." >&2
+        return 2
+    fi
+    command -v python3 >/dev/null 2>&1 || { echo -e "${RED}loki workspace: python3 is required${NC}" >&2; return 2; }
+    python3 "$_LOKI_SCRIPT_DIR/lib/workspace.py" "$@"
+}
+
 # D51: headless backlog runner. One v10 issue-mode run per open issue, each in
 # its own worktree and branch, at most N in parallel (loki.yaml concurrency).
 cmd_backlog() {
@@ -21922,6 +21944,9 @@ main() {
         backlog)
             cmd_backlog "$@"
             ;;
+        workspace)
+            cmd_workspace "$@"
+            ;;
         config)
             cmd_config "$@"
             ;;

package/bin/loki

@@ -567,7 +567,7 @@ fi
 # Two-token routes (provider show/list, memory list/index) match on the first
 # token only; the Bun dispatcher handles subcommand routing internally.
 case "${1:-}" in
-    version|--version|-v|status|stats|doctor|provider|memory|rollback|internal|kpis|trust|proof|receipt|wiki|crash|control)
+    version|--version|-v|status|stats|doctor|provider|memory|rollback|internal|kpis|trust|proof|receipt|wiki|crash|control|contract)
         # v7.5.2: rollback added (wires loki-ts/src/commands/rollback.ts).
         # v7.5.3: internal added for autonomy/run.sh phase1-hooks calls.
         # v7.5.28: kpis added (Phase K MVP: read-only KPI snapshot).

package/completions/_loki

@@ -207,6 +207,7 @@ function _loki_commands {
         'otel:OpenTelemetry management'
         'wiki:Wiki commands'
         'control:Control plane (preview, LOKI_CONTROL=1)'
+        'workspace:Multi-project workspaces (preview, LOKI_WORKSPACES=1)'
         'backlog:Run every matching open issue, N in parallel'
         'explain:Explain Loki concepts'
         'optimize:Optimization commands'

package/completions/loki.bash

@@ -5,8 +5,7 @@ _loki_completion() {
     _init_completion || return
 
     # Main subcommands (must match autonomy/loki main case statement)
-    local main_commands="start backlog quick monitor demo tour welcome init stop pause resume steer status next ship dashboard web serve api sandbox notify import github issue config provider reset memory compound checkpoint council dogfood projects enterprise secrets cockpit secure own handoff doctor watchdog audit metrics syslog onboard share proof receipt outcomes explain plan report cost estimate kpis stats test ci watch telemetry agent context ctx code run export review optimize heal modernize migrate cluster worktree wt trigger failover remote deploy docker mcp magic assets analyze compliance crash control open otel preview quickstart rc rollback self-update sentrux setup-skill spec state template trust trust-metrics ultracode update verify voice why wiki bench cleanup logs grill docs cp version completions help keys"
-    local main_commands="start backlog quick monitor demo tour welcome init stop pause resume steer status next ship dashboard web serve api sandbox notify import github issue intent config provider reset memory compound checkpoint council dogfood projects enterprise secrets cockpit secure own handoff doctor watchdog audit metrics syslog onboard share proof receipt explain plan report cost estimate kpis stats test ci watch telemetry agent context ctx code run export review optimize heal modernize migrate cluster worktree wt trigger failover remote deploy docker mcp magic assets analyze compliance crash control open otel preview quickstart rc rollback self-update sentrux setup-skill spec state template trust trust-metrics ultracode update verify voice why wiki bench cleanup logs grill docs cp version completions help keys"
+    local main_commands="start backlog quick monitor demo tour welcome init stop pause resume steer status next ship dashboard web serve api sandbox notify import github issue intent config provider reset memory compound checkpoint council dogfood projects enterprise secrets cockpit secure own handoff doctor watchdog audit metrics syslog onboard share proof receipt outcomes explain plan report cost estimate kpis stats test ci watch telemetry agent context ctx code run export review optimize heal modernize migrate cluster worktree wt trigger failover remote deploy docker mcp magic assets analyze compliance crash control workspace open otel preview quickstart rc rollback self-update sentrux setup-skill spec state template trust trust-metrics ultracode update verify voice why wiki bench cleanup logs grill docs cp version completions help keys"
 
     # 1. If we are on the first argument (subcommand)
     if [[ $cword -eq 1 ]]; then

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "10.6.7"
+__version__ = "10.6.8"
 
 # Expose the control app for easy import
 try:

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v10.6.7
+**Version:** v10.6.8
 
 **Engine note:** `loki "<task>"`, `loki owner/repo#N` and `loki quick` run the Loki 10 engine. `loki start` still routes to the legacy engine, which is being removed (planned work resumes 2026-10-07); prefer `loki owner/repo#N`. See [docs/v10/GUIDE.md](v10/GUIDE.md).
 

package/docs/WANG-PRINCIPLES-PLAN.md

@@ -53,7 +53,7 @@ Measured on this machine, not asserted.
 | **1 Systems Thinking** | STRONG | 8 quality gates, RARV-C loop, council, Evidence Receipt, dual-route parity enforced by test |
 | **2 Speed** | MEASURED, UNOPTIMISED | agent call = **980s = 96%** of iteration; all gates together = 44s |
 | **3 Reliability** | STRONG, newly so | 73 mutation-proven trust invariants; four gates were shipping broken until v8.38.0 |
-| **4 Extensibility** | STRONG | 5 providers, agent type registry, MCP (36 tools), plugin marketplace |
+| **4 Extensibility** | STRONG | 5 providers, agent type registry, MCP (39 tools), plugin marketplace |
 | **5 Feedback Loops / Evals** | **BROKEN** | `cost_usd == 0` on **3 of 5** efficiency records; no eval score for our own harness |
 
 **Principle 5 is the gap, and it is the one Wang weights highest.** He states the