loki-mode 10.6.7 → 10.6.8

package/docs/WORKSPACES.md

@@ -0,0 +1,29 @@
+# Workspaces: one issue across several repos
+
+Experimental, off by default. Set `LOKI_WORKSPACES=1` to enable. Design: `docs/v10/D51-PHASE-B.md`.
+
+Define a group of repos once in `loki.yaml`:
+
+```yaml
+workspaces:
+  shop:
+    repos:
+      - {repo: acme/api, path: ~/src/api, setup: "npm ci"}
+      - {repo: acme/web, path: ~/src/web, after: [acme/api]}
+    integration: {command: "make e2e", timeout_s: 900}
+```
+
+Then:
+
+```bash
+LOKI_WORKSPACES=1 loki workspace list
+LOKI_WORKSPACES=1 loki workspace run shop acme/api#12
+```
+
+- Each repo gets its own git worktree on a `loki/ws-<run-id>-N` branch and its own engine run. Your checkouts are not touched.
+- `after` orders repos: a repo starts once its predecessors succeed. If a predecessor fails, its dependents are SKIPPED.
+- A failing repo does not stop the others (continue and report). The command exits 0 only when every repo succeeded and the integration step did not fail; otherwise 1.
+- The repo that owns the issue ref gets the ref; other repos get a task text naming the ref and the sibling worktree paths as read-only context.
+- After all repos finish, the `integration` command runs once from the run directory with `LOKI_WS_DIR_<OWNER>_<REPO>` pointing at each worktree. A timeout counts as failed. With no integration configured the status is `not_configured`.
+- Evidence is written to `.loki/workspaces/<name>/<run-id>/integration.json`: head SHA per repo, exit code, log sha256. It is not part of the Seal.
+- Without `path`, a repo is cloned to `~/.loki/repos/owner__name`.

package/docs/alternative-installations.md

@@ -84,11 +84,13 @@ jobs:
 |-------|---------|-------------|
 | `mode` | `review` | `review`, `fix`, or `test` |
 | `provider` | `claude` | `claude` (recommended), `cline`, `codex`, `aider`, or `opencode`. `gemini` was REMOVED in v7.5.18. |
-| `budget_limit` | `5.00` | Max cost in USD |
+| `budget_limit` | `5.00` | Max cost in USD (passed to the Loki 10 engine as `--max-cost`) |
 | `max_iterations` | `3` | Max RARV cycles |
 | `github_token` | (required) | GitHub token for PR comments |
 | `prd_file` | | Path to PRD file (for fix/test modes) |
 
+**Engine:** every mode runs the Loki 10 engine through `loki start "<task>" --no-pr --provider <name> --max-cost <usd>` (the same path as `loki start owner/repo#N`), with `LOKI_ENGINE=v10`. The PRD file or PR diff is folded into the task text. The action never opens a PR itself (Rule of Two). A run that crosses the cap ends BUDGET_STOP (exit 3). The legacy `--simple` path is no longer used.
+
 **Modes:**
 
 | Mode | Description |

package/docs/control-plane-container.md

@@ -0,0 +1,45 @@
+# Run the Control Plane in a container
+
+The Control Plane (run ingest API plus UI) ships as its own small image built
+from `Dockerfile.control-plane`. It serves on port 47821, stores its SQLite
+database under `/data`, runs as a non-root user and contains no secrets.
+
+The server has no authentication of its own. Keep it on a private network or
+behind an authenticating proxy; do not expose it publicly.
+
+## Docker
+
+```bash
+docker build -f Dockerfile.control-plane -t loki-control-plane .
+docker run -d -p 47821:47821 -v loki-control:/data loki-control-plane
+LOKI_CONTROL_URL=http://localhost:47821 loki control status
+```
+
+Health: `/health` (liveness) and `/ready` (database check).
+
+## Helm
+
+```bash
+helm install loki-control ./deploy/helm/control-plane \
+  --namespace loki --create-namespace \
+  --set image.repository=<your-registry>/loki-control-plane \
+  --set existingSecret=autonomi-secrets \
+  --set 'secretKeys={ANTHROPIC_API_KEY}'
+```
+
+Provider keys are read from an existing Kubernetes Secret you name with
+`existingSecret`; nothing is stored in values. Ingress is off by default
+(`ingress.enabled=true` to turn it on). Keep `replicas: 1` (single SQLite volume).
+
+## ECS
+
+See `deploy/ecs/README.md` and `deploy/ecs/control-plane-task.json` (Fargate,
+EFS volume, secrets from Secrets Manager ARNs).
+
+## Configuration
+
+| Variable | Default in image | Meaning |
+| --- | --- | --- |
+| `PORT` | 47821 | listen port |
+| `LOKI_CONTROL_HOST` | 0.0.0.0 | bind address (outside the image: 127.0.0.1) |
+| `LOKI_CONTROL_DB` | /data/control.db | SQLite path |

package/docs/dev/architecture-reference.md

@@ -97,3 +97,7 @@ Default-on in the Bun runner (see `CHANGELOG.md` v7.x entries; documented in `sk
 - `LOKI_HANDOFF_MD` -- write a structured handoff doc before iteration close.
 
 These knobs together implement the RARV-C (closure) loop: findings -> override council -> learnings -> handoff. Reference: `skills/quality-gates.md`, `CHANGELOG.md` entries from v7.x for default-on flip and override-council semantics.
+
+## Worktree substrate (autonomy/lib/worktree_prep.py)
+
+`prepare_worktree(source_repo, dest, branch, setup=None, base=None)` creates an isolated git worktree and returns `{path, base_sha, deps, left_out_changes}`. The start point is `origin/HEAD` after a fetch (when a remote exists), else HEAD. Uncommitted edits in the source checkout are never carried or stashed; their count is reported as `left_out_changes`. An fcntl lock at `~/.loki/repos/<slug>.lock` covers fetch and worktree add. Dependencies: a `setup` command run in the worktree, else a copy-on-write copy of ignored top-level `node_modules`, `.venv`, `venv`, `vendor` (refused as "copy unsafe, declare setup" if it holds absolute symlinks or editable finders), else `none`. CLI: `python3 autonomy/lib/worktree_prep.py SRC DEST BRANCH [--setup CMD] [--base REF]` prints the result as JSON. Not yet wired into backlog or the UI.

package/docs/dev/project-structure.md

@@ -91,7 +91,7 @@ Line counts approximate; re-run `wc -l` for exact.
 | `memory/storage.py` | ~2,000 | File-based memory backend |
 | `memory/engine.py` | ~1,600 | Memory orchestrator |
 | `memory/consolidation.py` | ~1,100 | Episodic-to-semantic pipeline |
-| `mcp/server.py` | ~2,700 | MCP server (36 tools: 28 in-file + 7 magic + 1 gated managed; +3 resources, 2 prompts) |
+| `mcp/server.py` | ~2,700 | MCP server (39 tools: 31 in-file + 7 magic + 1 gated managed; +3 resources, 2 prompts) |
 | `providers/loader.sh` | ~185 | Provider loader |
 
 ### Key Function Lookup

package/docs/slack.md

@@ -0,0 +1,26 @@
+# Two-way Slack (preview)
+
+Off by default. Set `LOKI_SLACK_INBOUND=1` to enable the inbound handler.
+
+```bash
+export LOKI_SLACK_INBOUND=1
+export SLACK_BOT_TOKEN=...        # from env only, never stored by Loki
+export SLACK_SIGNING_SECRET=...
+loki slack serve --port 3000      # binds 127.0.0.1 unless --host is given
+```
+
+Point the Slack Events API request URL at this server through a tunnel or reverse proxy you control.
+
+## What it does
+
+- `@loki <issue ref or task text>` in a channel starts a Loki 10 run (the same entry as `loki "<task>"`) and replies in the thread with the run id.
+- When the run ends BLOCKED, the question is posted in the same thread. A reply in that thread starts a follow-up run with your answer added to the original task (v10 has no in-place resume, BLOCKED is terminal).
+- Every request is verified with the Slack signature (HMAC sha256 over `v0:timestamp:body`, constant-time compare, timestamps older than 5 minutes are rejected). Retried events are deduplicated.
+
+## App manifest scopes
+
+Bot token scopes: `app_mentions:read`, `chat:write`, `channels:history` (and `groups:history` for private channels, `im:history` for DMs).
+
+Subscribe to bot events: `app_mention`, `message.channels` (plus `message.groups` for private channels).
+
+Outbound notifications (PR opened, BLOCKED, finished) are separate and use `LOKI_SLACK_WEBHOOK_URL`.

package/docs/v10/BOARD.md

@@ -697,4 +697,29 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | A-134b | A-134 opus notes: (1) standalone autonomy/verify.sh prints no attestation line (only `loki verify` has _deploy_receipt_verdict); print `attestation: UNCHECKED (run via loki verify)` instead of silence; (2) the quiet failure tail grep `[Ff]ailed` matched the RALPH system-prompt line and printed ~1.5k chars; anchor to `^\[(ERROR|WARN)\]` or cap line length; (3) the quiet inner run starts as a background job so its stdin is /dev/null even from a TTY: pause-mode keypress resume changes for quiet runs; (4) `loki quick --verbose` is also the A-122 cmd_quick flag, done | autonomy/verify.sh, autonomy/run.sh | MEDIUM | each note has a test | merged@2026-10-01T05:22Z | |
 | A-134c | A-134b r1 review finding: provider call sites in autonomy/run.sh (mainline claude -p at about 25455/25460, provider_invoke_argv about 1050/1053) do not redirect stdin, so under LOKI_VERBOSE=1 (and any non-quiet path) a parent stdin pipe that never closes blocks `claude -p` reading stdin (pre-existing). Fix: `< /dev/null` at provider invocations that pass the prompt as an argument | autonomy/run.sh (provider call sites only), providers/*.sh, tests | MEDIUM | never-closing stdin pipe: verbose `loki quick` completes under timeout 60 | merged@2026-10-01T09:00Z | |
 | A-130 | v10 quiet by default (item 2) | see plan A-130 | MEDIUM | first-run-gate assertion per plan card | released@2026-10-01T01:19Z | Wave per plan section 5; one writer per file. Released in v10.5.14 (merge a518bfea is an ancestor of v10.5.14). |
-| A-130b | A-130 Reason line prints first_error from a failing check verbatim (capped at 200 chars, control chars stripped) but unredacted: a `ghp_` token in a test failure line reaches the terminal. No TS redactor is reachable from engine10 core (only autonomy/lib/proof_redact.py). Port the token patterns to a small TS helper outside core or redact first_error where it is captured in verify | loki-ts/src (util), verify.ts or output.ts, tests | MEDIUM | ghp_/sk- token in first_error prints redacted | released@2026-10-01T02:27Z | ; sonnet APPROVE be50510f (redaction before cap, parity with proof_redact.py) Released in v10.5.16 (merge f214a0fa is an ancestor of v10.5.16). |
+| A-130b | A-130 Reason line prints first_error from a failing check verbatim (capped at 200 chars, control chars stripped) but unredacted: a `ghp_` token in a test failure line reaches the terminal. No TS redactor is reachable from engine10 core (only autonomy/lib/proof_redact.py). Port the token patterns to a small TS helper outside core or redact first_error where it is captured in verify | loki-ts/src (util), verify.ts or output.ts, tests | MEDIUM | ghp_/sk- token in first_error prints redacted | released@2026-10-01T02:27Z | ; sonnet APPROVE be50510f (redaction before cap, parity with proof_redact.py) Released in v10.5.16 (merge f214a0fa is an ancestor of v10.5.16). |
+| D61-17 | D62 P1: D61 slice 17, large eval tier (8 lg- tasks, arms v10-parallel, v10-seq, raw-claude, tokens per completed) | eval/loki10/tasks/lg-*, eval/loki10/harness.py, eval/loki10/summarize, eval/loki10/test-harness.sh | MEDIUM | building@2026-10-03T01:52Z | Restart (prior worktree held no saved work). docs/v10/D61-SPEED.md section 4 row 17. |
+| D61-01 | D62 P1: D61 slice 1, pre-model stage timer | engine10/supervisor.ts, engine10/output.ts, tests engine10/premodel_timing.test.ts | MEDIUM | building@2026-10-03T01:52Z | Behind LOKI_SPEED=1. D61-SPEED.md row 1. |
+| D61-08 | D62 P1: D61 slice 8, deterministic decomposer DAG | new engine10/decompose.ts, tests engine10/decompose.test.ts | MEDIUM | building@2026-10-03T01:52Z | Behind LOKI_SPEED=1. D61-SPEED.md row 8. |
+| D62-FIX | D62 P3: root action.yml routes to Loki 10 (no `--simple`), plus one real end-to-end BUDGET_STOP exit 3 test | action.yml, tests for action and budget e2e | MEDIUM | building@2026-10-03T01:52Z | Small fixes from the D60 report. |
+| D61-02 | D62 P1: D61 slice 2, lean prefix default plus byte-identity guard | e10ext/lean_prefix.ts, stages/implement.ts, stages/fix.ts | MEDIUM | building@2026-10-03T01:55Z | Next seat. |
+| D61-07 | D62 P1: D61 slice 7, worktree dependency prep | autonomy/lib/worktree_prep.py, tests/test-worktree-prep.sh | MEDIUM | building@2026-10-03T01:55Z | Next seat. |
+| D62-VIS | D62 P2a: visual evidence in PRs (local Playwright screenshots of changed pages in the PR body) | TBD by architect | MEDIUM | building@2026-10-03T01:55Z | Needs a slice card (D63 order 2 and 5). |
+| D62-JIRA | D62 P2c: Jira and Linear intake into v10 via autonomy/issue-providers.sh, intake only | TBD by architect | MEDIUM | building@2026-10-03T01:55Z | Needs a slice card (D63 order 2 and 5). |
+| D64-VIS | D64 1: visual evidence, local Playwright screenshots plus trace or video of changed pages in the PR body and receipt | new loki-ts/src/engine10/evidence_visual.ts, engine10/pr_body.ts hook, tests | MEDIUM | parked | D64 withdrawn 00:25Z; not started. |
+| D64-E2E | D64 2: verify runs the repo's Playwright or Cypress e2e when present; mobile only if already installed; never claim coverage that did not run | new loki-ts/src/engine10/e2e.ts, verify stage hook, tests | MEDIUM | parked | D64 withdrawn 00:25Z; not started. |
+| D64-SERVE | D64 4: loki serve webhooks (GitHub, Linear, Jira) and cron schedules in the Control Plane | packages/control-plane/src/server/triggers*, tests | MEDIUM | parked | D64 withdrawn 00:25Z; not started. |
+| D64-MERGE | D64 6: loki merge, merge queue landing approved Loki PRs in order with re-verify on the updated base | new loki-ts/src/engine10/merge_queue.ts, CLI arm, tests | MEDIUM | parked | D64 withdrawn 00:25Z; not started. |
+| D64-REVIEW | D64 7: loki review <pr> posts a review with a deterministic risk score | new loki-ts/src/engine10/review_risk.ts, CLI arm, tests | MEDIUM | parked | D64 withdrawn 00:25Z; not started. |
+| D64-PLAN | D64 8: loki plan shows contract, units and files for approval before running | new loki-ts/src/engine10/plan_mode.ts, CLI arm, tests | MEDIUM | parked | D64 withdrawn 00:25Z; not started. |
+| D64-MEM | D64 9: project memory (D50 item 3) in the v10 context pack | new loki-ts/src/e10ext/project_memory.ts, tests | MEDIUM | parked | D64 withdrawn 00:25Z; not started. |
+| D64-INTAKE | D64 10: Jira, Linear and Sentry intake into v10 via autonomy/issue-providers.sh | autonomy/issue-providers.sh, v10 intake ref parsing, tests | MEDIUM | parked | D64 withdrawn 00:25Z; not started. |
+| D64-EASE | D64 ease: first-run gate ease row (time to first PR, prompt count), published in METRICS | first-run gate script, docs/v10/FIRST-RUN-GATE.md, METRICS | MEDIUM | parked | D64 withdrawn 00:25Z; not started. |
+| D61-05 | D65: D61 slice 5, warm engine socket in the dashboard daemon | engine10/dashboard/server.ts, new engine10/warm.ts, tests | MEDIUM | building@2026-10-03T01:55Z | D65 phase 1. |
+| D61-06 | D65: D61 slice 6, CLI warm client with 50ms socket try and cold fallback | engine10/cli.ts, new engine10/warm_client.ts, tests | MEDIUM | building@2026-10-03T01:55Z | D65 phase 1. |
+| D65-CP | D65 D63-3: Control Plane as the default UI plus BLOCKED answer UI | packages/control-plane, loki control wiring | MEDIUM | building@2026-10-03T01:55Z | D65 phase 1. |
+| D65-SLACK | D65 D63-4: Slack two-way (@loki starts a run, BLOCKED answers return) | new integrations slack module, docs | MEDIUM | building@2026-10-03T01:55Z | D65 phase 1. |
+| D65-SPEC | D65 D63-6: spec to delivery contract with criteria traced in the receipt | new engine10/contract.ts, receipt fields | MEDIUM | building@2026-10-03T01:55Z | D65 phase 1. |
+| D65-MULTI | D65 D63-7: multi-repo workspaces, D51 Phase B slices behind LOKI_WORKSPACES | per docs/v10/D51-PHASE-B.md | MEDIUM | building@2026-10-03T01:55Z | D65 phase 1. |
+| D65-MCP | D65 D63-8: MCP server tools run, status and verify for v10 | mcp/server.py, tests | MEDIUM | building@2026-10-03T01:55Z | D65 phase 1. |
+| D65-CONT | D65 D63-9: one container for the Control Plane plus Helm and ECS examples | Dockerfile.control-plane, deploy/helm, deploy/ecs, docs | MEDIUM | building@2026-10-03T01:55Z | D65 phase 1. |

package/docs/v10/CONTROL-PLANE.md

@@ -100,3 +100,7 @@ Dependencies to add (none present today; web-app/package.json pins react 19, vit
 4. Retention: keep events forever, or prune `heartbeat` after N days?
 5. One shared token for ingest and read, or separate ingest-only tokens per team (D54 scale, team budgets)?
 6. Workspaces: once D51 Phase B lands, should group.json also be shipped as envelope events, the same way as backlog (CP-13)?
+
+## BLOCKED answer and default entry (D65)
+
+A run blocked on a spec conflict shows its question in the run view with an answer box. The answer is POSTed to `/v1/runs/<source>/<run>/answer` (application/json, `answer` up to 4000 chars, the run must be blocked, ids are validated, the server binds 127.0.0.1) and written to `$LOKI_CONTROL_ANSWER_DIR` (default `~/.loki/control/answers`) as `<source>/<run>.answer.txt`, mode 0600. The engine has no in-place resume reader, so resuming is manual: `loki "$(cat <file>)"`. `LOKI_CONTROL_DEFAULT=1` (off by default) makes `loki dashboard` open the Control Plane.

package/docs/v10/D61-SPEED.md

@@ -61,18 +61,23 @@ Architect design, 2026-10-02, base fbbd31299, v10.6.6. Design only; nothing belo
 | 14 | Group events and terminal unit table (TTY repaint 2s, plain lines otherwise) | engine10/events.ts, engine10/output.ts, tests output_group.test.ts | snapshot tests for TTY and non-TTY; validateEnvelope accepts group fields | 30m | MEDIUM |
 | 15 | Live grid: dashboard /g/<group> and Control Plane group_id column | engine10/dashboard/page.ts, packages/control-plane/src/server/runs.ts, packages/control-plane/src/db/, tests | ingesting a 3-unit fixture shows 3 rows with stage and elapsed; missing data says "no data ingested" | 30m | MEDIUM |
 | 16 | Route `loki "<task>"` and `loki <file>` through decomposer behind LOKI_SPEED | engine10/cli.ts (route only), engine10/supervisor.ts (group entry), tests route_group.test.ts | flag off: byte-identical behaviour; flag on: small task never decomposes | 30m | HIGH |
-| 17 | Large eval tier: 8 lg- tasks (4 decomposable, 4 sequential by design), arms v10-parallel, v10-seq, raw-claude, tokens per completed for every arm | eval/loki10/tasks/lg-*, eval/loki10/harness.py, eval/loki10/summarize, eval/loki10/test-harness.sh | D38 provenance check passes; summarize prints wall, completion, tokens per arm; a capped arm is never completed | 30m x2 (tasks, harness) | MEDIUM |
+| 17 | Speed eval tier: 8 spd- tasks (4 decomposable, 4 sequential by design), arms v10-parallel, v10-seq, raw-claude, tokens per completed for every arm | eval/loki10/tasks/spd-*, eval/loki10/harness.py, eval/loki10/summarize, eval/loki10/test-harness.sh | D38 provenance check passes; summarize prints wall, completion, tokens per arm; a capped arm is never completed | 30m x2 (tasks, harness) | MEDIUM |
 | 18 | METRICS D61 section and the flag flip decision | docs/v10/METRICS.md | rows cite results.jsonl paths; losses shown; flip only if section 5 targets hold | 15m | LOW |
 
 Order: 1, 2, 7, 8 start now (disjoint files); 3-6 and 9-11 next; 12-16 after 8-11; 17 in parallel from the start; 18 last. HIGH slices get opus reviewers (D12).
 
 ## 5. Targets (measured on the eval, never claimed)
 - A. Small tier (29 tasks): Loki p50 time to PR at or below raw `claude -p` (39s baseline, METRICS gate report) on the same model; tokens per completed at or below raw; pre-model overhead p50 under 2s warm. Losses published, including the D50 sonnet loss.
-- B. Large tier: on decomposable tasks, parallel wall time at most 0.5x sequential with completion not lower; on sequential-by-design tasks the check must choose sequential (a parallel run there counts as a loss).
+- B. Speed tier (authored spd- tasks, D67): on decomposable tasks, parallel wall time at most 0.5x sequential with completion not lower; on sequential-by-design tasks the check must choose sequential (a parallel run there counts as a loss).
 - C. Parallel total tokens at or below v10-seq on the same task; report tokens per completed task for all three arms.
 - D. Every slice adds its METRICS row (what changed, command, result file, exit code). Nothing flips to default on a fixture result alone (feedback: fixture-green is not verification).
+- E. The `LOKI_SPEED` default flips only if 5 B and 5 C hold on the speed tier AND, on the real medium pub- tasks (plus any D34 large tasks on main), `LOKI_SPEED=1` shows completion not lower and p50 wall and tokens per completed not worse than `LOKI_SPEED=0`, at 2 runs per arm.
 
 ## 6. Risks and non-goals
 - Research section 4: parallel lost 39-70% on sequential work and multi-agent runs cost about 15x tokens. Defence: conservative check, no transcript sharing, single writer per file, one central integrator.
 - Warm daemon must never be load-bearing: cold path stays the reference; slice 6 asserts identical events.
 - Not in v1: stacked PRs, cross-repo groups (D51 Phase B), remote runners.
+
+## Slice 2 status: stage prefix (LOKI_SPEED=1)
+
+With `LOKI_SPEED=1` (default off), the implement, fix, wall and plan stage prompts all begin with the same fixed block (`STAGE_PREFIX` in `loki-ts/src/e10ext/lean_prefix.ts`), so the provider prompt cache can reuse it across stages. With the flag off, prompts are unchanged byte for byte. `loki-ts/tests/e10ext/prefix_identity.test.ts` asserts the first 200 bytes match across stages and that flag-off output is unprefixed.

package/docs/v10/DECISIONS.md

@@ -491,3 +491,27 @@ A product feature, not a build-process change: `loki "small task"` should finish
 
 ## D60-5 default cost cap (2026-10-02 23:05Z)
 A Loki 10 run caps priced spend at $20.00 by default. `--max-cost N` beats loki.yaml `budgets.per_run`, which beats the default. The start line prints the cap and its source. Hitting the cap ends the run as BUDGET_STOP with exit 3. Unpriced sessions (no cost event) never count toward the cap, so a subscription or local provider never stops on it.
+
+## D62: resume now, no pause until 2026-10-07 (founder via the autonomi-dev session, 2026-10-03 about 00:05Z)
+Founder: "don't have to pause until wed oct 7th, remove that and resume now". Ends the D59 pause. Pacing follows the usage governor: week at 44% with about 4.6 days to reset, so about 0.5% per hour, seats scaled to live /usage. Trains and the D49 auto-promote continue unchanged. Priorities in order: (1) D61 speed (slice 17 large eval arm, then warm maps, then decomposer, integrator and parallel units, all behind LOKI_SPEED until the eval holds); (2) Vorflux gaps: visual evidence in PRs (local screenshots of changed pages when the repo has Playwright or a web app), multi-repo workspaces (D51 Phase B behind LOKI_WORKSPACES), Jira and Linear issue intake into v10 reusing autonomy/issue-providers.sh (intake only, no sync claims), project memory (D50 item 3); later merge queue, PR review risk score, REST API; (3) small fixes: root action.yml routes to v10 instead of `loki start --simple`, and one real end-to-end BUDGET_STOP exit 3 test. Each release reports its version and what users can now do to the autonomi-dev session.
+
+## D63: industry-standard autonomous software factory roadmap (founder via the autonomi-dev session, 2026-10-03 00:15Z)
+Founder: "I want everything top notch features and UI and connections and updates to make loki mode the industry standard best tool comparable to cognition devin, factory.ai and even 8090.ai and claude code, but fully autonomous super intelligence software factory". Recorded as the roadmap in docs/v10/ROADMAP-D63.md (nine pillars, each with a measurable bar). D50, D51, D56 and D61 slot into it. No row is done without a test or an eval row. User-facing text makes no superintelligence or benchmark claims. Build order this week, under the governor: D61 eval and warm start, visual evidence in PRs, Control Plane default with the BLOCKED answer UI, two-way Slack, Jira and Linear intake, spec to contract, multi-repo, MCP run/verify server, containers.
+
+## D64 (WITHDRAWN 2026-10-03 00:25Z, never acted on): win every Vorflux row, 10/10 ease of use, max pace (founder via the autonomi-dev session, 2026-10-03 00:20Z)
+Founder: "i want to win on all things versus vorflux and rated 10/10 in ease of use for users, anything that says vorflux wins should become loki, complete all releases towards that in fastest way and I want everything done right now". Raises D63 to max pace. The 0.5%/h pacing is lifted: as many parallel builders as the machine and CI allow (sonnet builders, haiku for docs and mechanical work, opus only for moat reviews). One hard floor: no new work starts when live /usage shows the week at 90% or above. CI gates and the two-leg promote stay. Every "Us" row in ~/git/autonomi-dev/research/vorflux/docs-teardown.md section 6 becomes a local, free Loki win, each on its own train: visual evidence (local Playwright screenshots, trace or video, in the PR and the receipt); browser testing in verify (Playwright or Cypress when present; mobile only when an emulator or simulator is already installed, said plainly otherwise; never claim coverage that did not run); D61 parallel units; triggers (`loki serve` webhooks for GitHub, Linear, Jira, plus cron); multi-repo (D51-B); merge queue (`loki merge`); PR review with a deterministic risk score (`loki review <pr>`); plan mode (`loki plan`); project memory; Jira, Linear and Sentry intake plus two-way Slack; Control Plane default with mobile layout and a REST API for runs. Ease of use is measured and gated: fresh machine to first merge-ready PR under 5 minutes, zero config with at most one decision, `loki` with no args opens the UI with guided onboarding, every error names the one fix, and an "ease" row in the first-run gate (time to first PR, prompt count) is published.
+
+D64 withdrawn (founder via the autonomi-dev session, 00:25Z): "I think your build order is better, just follow that, ignore my last message". Recorded only; no D64 builder was started. Pacing and order return to D63: about 0.5% of the week per hour at a staffing of 4, order as in docs/v10/ROADMAP-D63.md. The Vorflux section 6 rows remain a reference for later D63 items.
+
+## D65: build all nine D63 items today, then one end-to-end pass (founder via the autonomi-dev session, 2026-10-03 00:35Z)
+Founder: "this looks amazing ... i want everything done today, no testing required, first develop and complete all releases, then do one end to end testing of all things and fix bugs and make improvements". Phase 1: build all nine D63 items in D63 order, in parallel; builder-side test runs and review rounds are off (builders run typecheck and the structural dash check only, because a red train is dropped, not waited on); each slice merges and ships on trains as built. CI and the release gates are unchanged (required-ci, Tests, Bun Parity, Coverage, Security Audit, two-leg promote). The 0.5%/h pace is lifted for today; hard floor: no new work starts once live /usage shows the week at 85%, and the autonomi-dev session is told. Phase 2: from a clean `npm i -g loki-mode@latest` in a throwaway HOME, exercise every D63 feature on real push-disabled clones (augmentiq#52 plus two public eval repos), record pass or fail with evidence in docs/v10/E2E-D65.md, then fix bugs in priority order on trains. Phase 2 real-repo runs need provider auth present in the session environment; stored keys are never read.
+
+## D66: D65 feature code lives in loki-ts/src/features/ under its own cap (CTO call, 2026-10-03 02:00Z)
+The D61 decomposer (125 lines) does not fit: engine10 core is at 4,993 of its 5,000-line cap (D29, D33, never raised) and e10ext at 1,490 of 1,500 (D42). New D65 modules (decomposer, warm start, visual evidence, contract, Slack inbound, Jira/Linear fetch) go in loki-ts/src/features/, with its own 3,000-line cap and the D42 import rules (no import of stages/, seal, verify, wall or verify_cmd except whole-statement `import type`), enforced in budget.test.ts. Core and e10ext caps are unchanged; each slice's edit to engine10 or e10ext is a hook of at most a few lines, and a slice that pushes core or e10ext over its cap is trimmed or dropped at the train.
+
+## D67: authored speed tier is separate from the D34 large tier (CTO, 2026-10-03, on the Chief of Staff's request)
+- D61 slice 17 added 8 authored tasks under the lg- name with tier "large" and excluded lg-* from the D34 size gate. Rejected: the real D34/D38 large tasks are also named lg-<repo>-<issue> (EV-12F, EV-12G), so the exclusion would have exempted them on merge, and D34 already closed synthetic lg-* tasks.
+- Authored decomposition tasks are a separate tier: id prefix spd-, "tier": "speed", a boolean "decomposable", and D38 hidden-test provenance, sha256 freeze and a requirements map. No refdiff and no size gate. validate enforces the prefix and the tier in both directions.
+- D34 and D38 are unchanged. lg- and tier "large" mean only real upstream PR tasks. measure-size.py runs over every task with no name exclusion, and a test proves an unsized lg- task fails it.
+- Speed-tier results measure decomposer choice and wall-time ratio only. They are never published as large-tier, "any size" or completion-at-scale claims.
+- The LOKI_SPEED default flips only when D61 section 5 B and 5 C hold on the speed tier and LOKI_SPEED=1 is no worse than LOKI_SPEED=0 on completion, p50 wall and tokens per completed across the real medium tasks and any D34 large tasks on main, at 2 runs per arm. A loss on any axis keeps the default off.

package/docs/v10/DEPS.md

@@ -261,6 +261,8 @@ Node.js current stable: 26.10.0 (cycle 26); Python current stable: 3.14.7 (cycle
 | File | Name | Current | Latest stable | Bump | Note |
 |---|---|---|---|---|---|
 | `Dockerfile` | `ubuntu:24.04` | `ubuntu:24.04` | `24.04.5 (newest line 26.04.1)` | MAJOR | EOL 2029-05-31 (not yet); patch in line; MAJOR to newest line |
+| `Dockerfile.control-plane` | `oven/bun:1.4.2` | `oven/bun:1.4.2` | `-` | unknown | floating/arbitrary registry tag, see Docker section for endoflife-mapped images |
+| `Dockerfile.control-plane` | `oven/bun:1.4.2-slim` | `oven/bun:1.4.2-slim` | `-` | unknown | floating/arbitrary registry tag, see Docker section for endoflife-mapped images |
 | `Dockerfile.purplelab-test` | `node:22-slim` | `node:22-slim` | `22.23.3 (newest line 26.10.0)` | MAJOR | EOL 2027-04-30 (not yet); minor in line; MAJOR to newest line |
 | `Dockerfile.sandbox` | `debian:bookworm-slim` | `debian:bookworm-slim` | `12.15 (newest line 13.7)` | MAJOR | EOL 2028-06-30 (not yet); minor in line; MAJOR to newest line |
 | `Dockerfile.sandbox` | `debian:bookworm-slim` | `debian:bookworm-slim` | `12.15 (newest line 13.7)` | MAJOR | EOL 2028-06-30 (not yet); minor in line; MAJOR to newest line |
@@ -293,6 +295,8 @@ Node.js current stable: 26.10.0 (cycle 26); Python current stable: 3.14.7 (cycle
 | `deploy/helm/autonomi/tests/test-health.yaml` | `curlimages/curl:8.5.0` | `curlimages/curl:8.5.0` | `-` | unknown | floating/arbitrary registry tag, see Docker section for endoflife-mapped images |
 | `deploy/helm/autonomi/values.yaml` | `alpine/git:latest` | `alpine/git:latest` | `-` | unknown | floating/arbitrary registry tag, see Docker section for endoflife-mapped images |
 | `deploy/helm/autonomi/values.yaml` | `image.repository` | `asklokesh/loki-mode:(defaults to appVersion)` | `-` | n/a | own product image, tracked via VERSION not a third-party dep |
+| `deploy/helm/control-plane/Chart.yaml` | `appVersion` | `10.6.7` | `10.6.7` | up-to-date | repo VERSION file is 10.6.7 |
+| `deploy/helm/control-plane/Chart.yaml` | `chart dependencies` | `(none declared)` | `-` | n/a |  |
 | `helm/loki-mode/Chart.yaml` | `appVersion` | `9.19.1` | `10.2.1` | drifted | DRIFTED: chart appVersion does not track the product VERSION file (10.2.1) |
 | `helm/loki-mode/Chart.yaml` | `chart dependencies` | `(none declared)` | `-` | n/a |  |
 | `helm/loki-mode/values.yaml` | `redis:7-alpine` | `redis:7-alpine` | `-` | unknown | floating/arbitrary registry tag, see Docker section for endoflife-mapped images |
@@ -372,8 +376,8 @@ Counts are all from the single `Bump` column (current line vs newest line in the
 | Python (pyproject) | 0 | 1 | 1 | 1 | 0 | 0 | 1 | 0 | 0 |
 | GitHub Actions | 1 | 0 | 0 | 75 | 0 | 0 | 2 | 13 | 2 |
 | Runtimes | 0 | 5 | 0 | 2 | 1 | 0 | 1 | 0 | 0 |
-| Docker/Compose | 0 | 3 | 0 | 8 | 1 | 0 | 8 | 0 | 1 |
-| Helm | 0 | 0 | 0 | 0 | 0 | 2 | 5 | 0 | 34 |
+| Docker/Compose | 0 | 3 | 0 | 8 | 1 | 0 | 10 | 0 | 1 |
+| Helm | 0 | 0 | 0 | 0 | 0 | 2 | 5 | 1 | 35 |
 | Terraform | 0 | 0 | 0 | 4 | 0 | 0 | 0 | 0 | 15 |
 | Homebrew | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 1 | 0 |
 

package/docs/v10/E2E-D65.md

@@ -0,0 +1,87 @@
+# D65 Phase 2 end-to-end pass: plan, stub-leg results, bugs, operator commands
+
+Status: stub legs run 2026-10-02 (loki-mode 10.6.7 from npm `latest`, macOS arm64, bun 1.x on PATH).
+Real-provider legs are PENDING: they need `~/.config/loki/e2e.env`, which this document's author
+never read or loaded. No leg here used real provider auth.
+
+## 1. Plan
+
+Every leg starts from a clean install and never touches the operator's real HOME or any remote.
+
+1. Clean install: `npm i -g --prefix <run>/p loki-mode@<version>` with `HOME=<run>/home`,
+   `npm_config_cache=<run>/npmcache`. Record install seconds and `loki version`.
+2. Three repos:
+   - `asklokesh/augmentiq#52` (private, expected ALREADY_SATISFIED, needs gh token and provider auth: PENDING auth).
+   - `octocat/Hello-World` (tiny public repo, stub leg 1).
+   - `sindresorhus/is-plain-obj` (small public repo, stub leg 2).
+   - The gate proper (`scripts/real-repo-gate.sh`) also runs the two corpus rows (humanize-333, click) from `scripts/real-repo-gate.repos`.
+3. Push disabled: shallow clone (`--depth 1`), `git remote set-url --push origin no-push`, `GIT_CONFIG_GLOBAL=/dev/null`, `--no-pr`. Gate clones additionally set `remote.origin.pushurl=invalid://push-disabled-by-real-repo-gate`.
+4. Stub legs: a stub `claude` on PATH, `LOKI_NO_BROWSER=1`, `LOKI_DASHBOARD=false`, no API key variables. Real legs: credentials only through `LOKI_E2E_ENV_FILE` (below).
+5. Evidence per leg: exit codes, wall seconds, receipt presence, `loki verify` verdict, `loki proof verify`, diff.
+
+## 2. Stub-leg results (loki-mode 10.6.7)
+
+Install: `npm i -g --prefix ... loki-mode@latest` rc=0, 5 s (warm npm cache directory was empty, so a cold fetch), `loki version` = `Loki Mode v10.6.7`.
+
+| Leg | Repo @ SHA | Command | Exit | Wall | Receipt | `loki verify` | Notes |
+|---|---|---|---|---|---|---|---|
+| A | octocat/Hello-World @ 7fd1a60b01f91b314f59955a4e4d4e80d8edf11d | `loki start ./task.md --no-pr` (file task, exactly what the gate runs for corpus rows) | 1 | 1 s | none | rc=1, CONCERNS (empty diff) | `Unknown option: --no-pr` (BUG-1) |
+| B | octocat/Hello-World @ 7fd1a60b | `loki start "Add a short Contributing note to the README" --no-pr` (v10 route) | 1 | 4 s | yes, `.loki/runs/e10-20261003T020630Z-9ab3/receipt.json` (sha256:321a4232...) | rc=4, `NOT VERIFIED (run outcome FAILED; receipt integrity intact)` | `Not logged in` from the SDK loop; stub `claude` on PATH ignored by the v10 engine (BUG-2, BUG-3). Outcome FAILED, no diff |
+| C | sindresorhus/is-plain-obj @ 666df7c10035f7e26f27ec214fe5ae3173435f34 | `LOKI_ENGINE=legacy LOKI_MAX_ITERATIONS=1 LOKI_SDK_MODE=off LOKI_SKIP_AUTH_PREFLIGHT=1 loki start ./task.md` | 0 | 71 s | yes, `.loki/proofs/run-20261003020703-25030-19911` | rc=0, `VERDICT: VERIFIED` (2 files, +122) | `loki proof verify` rc=0 (hash_ok, headline_consistent); receipt body says `quality_gate:code_review: failed` (BUG-4) |
+| C0 | is-plain-obj @ 666df7c1 | same as C without `LOKI_SKIP_AUTH_PREFLIGHT=1` | 1 | 1 s | none | CONCERNS | Legacy auth preflight stops with `Claude Code is installed but not logged in`; correct behaviour |
+
+Push check: after every leg `git remote get-url --push origin` = `no-push`; nothing left the machine.
+
+## 3. Bugs
+
+BUG-1 (gate blocker, P1): `loki start <file> --no-pr` is rejected by the legacy parser.
+`bin/loki` routes `start` to the v10 engine only for issue refs, issue URLs and multi-word tasks (`bin/loki` start case); a path to a file stays legacy, and the legacy `cmd_start` has no `--no-pr`. `scripts/real-repo-gate.sh` runs corpus rows as `loki start <T>/issue-NAME.md --no-pr`, so both corpus rows (humanize-333, click) die in 1 s with `Unknown option: --no-pr` on a real install. The stub-`loki` test hides it because the stub accepts anything.
+Repro: `loki start ./task.md --no-pr` in any git clone; exit 1.
+Fix options: route `start <file>.md --no-pr` to v10, or accept and ignore `--no-pr` in legacy `cmd_start`, or have the gate pass the issue text as a multi-word task. Add a gate test that uses the real routing.
+
+BUG-2 (P2): the v10 engine does not use a `claude` found on PATH, so a stub provider cannot drive it.
+The SDK loop spawns its own Claude Code and reports `Not logged in` even with a stub first on PATH. The legacy engine does honor PATH `claude`. Result: v10 stub legs are impossible, so no hermetic v10 e2e exists beyond unit tests. Suggest an env override (an executable path for the SDK loop) for tests.
+Repro: Leg B.
+
+BUG-3 (P2): an unauthenticated provider is reported as a generic failure by v10.
+`loki-ts/src/engine10/machine.ts` matches only `Failed to authenticate|API key is invalid` and the credit-balance wording. The SDK's `Not logged in - Please run /login` is not matched, so the run ends `Outcome: FAILED  Reason: exit 1 (general error)` plus four NOT PROVEN items, with no pointer to the login fix. Legacy prints an actionable message.
+Repro: Leg B stderr log `.loki/runs/*/..-impl.stderr.log` contains `[sdk-loop error: Claude Code returned an error result: Not logged in ...]`.
+
+BUG-4 (P3, wording): after a legacy run whose receipt lists `quality_gate:code_review: failed` under "Not yet verified", bare `loki verify` prints `VERDICT: VERIFIED`, because it is the diff-scope deterministic verify, while the receipt headline is not a full pass. Two commands, two meanings of VERIFIED. Operators should read the receipt headline, not only `loki verify`. Repro: Leg C.
+
+Observation, not a Loki bug: my first stub appended to `README.md` on every invocation, including the auth probe, so the stub must only write on a real `-p` call.
+
+## 4. Gate script change (this commit)
+
+`scripts/real-repo-gate.sh` accepts `LOKI_E2E_ENV_FILE` (default unset, behaviour unchanged when unset). When set it requires a regular non-symlink file owned by the current user with mode 0600 (refuses with exit 2 otherwise), then loads it with `set -a; . file; set +a` inside the gate process only, output discarded, never echoed. Tested in `tests/test-real-repo-gate.sh` (0644 refused, 0600 loads, dummy value absent from stdout, stderr and logs). Caveat: the gate's per-repo log captures `loki` output, so a provider that echoes its own key would land in the log; the gate itself never writes values.
+
+## 5. Operator commands once `~/.config/loki/e2e.env` exists
+
+Create it with `umask 077` and put only the provider variables in it (`ANTHROPIC_API_KEY` or `CLAUDE_CODE_OAUTH_TOKEN`; `GH_TOKEN` for the private augmentiq repo, or rely on `gh auth login`).
+
+```bash
+chmod 600 ~/.config/loki/e2e.env
+stat -f '%Lp %Su' ~/.config/loki/e2e.env        # expect: 600 <you>
+
+# 0. Do not run until BUG-1 is fixed, or the two corpus rows fail on the file-task route.
+cd <loki-mode checkout>
+
+# 1. Local gate on the published latest (clean install, throwaway HOME, push disabled, all three repos)
+LOKI_E2E_ENV_FILE=$HOME/.config/loki/e2e.env \
+  bash scripts/real-repo-gate.sh --version "$(npm view loki-mode version)" \
+  --results "$HOME/loki-ci-logs/real-repo-gate-e2e.results"
+echo "gate exit: $?"        # 0 pass, 1 repo failed or nothing ran, 2 setup error
+
+# 2. augmentiq#52 alone, for a clearer log
+LOKI_E2E_ENV_FILE=$HOME/.config/loki/e2e.env \
+  bash scripts/real-repo-gate.sh --version "$(npm view loki-mode version)" --repo 'asklokesh/augmentiq#52'
+
+# 3. Inspect: results table and per-repo logs (logs are in the .logs dir next to the results file)
+cat "$HOME/loki-ci-logs/real-repo-gate-e2e.results"
+ls "$HOME/loki-ci-logs/real-repo-gate-e2e.logs"
+
+# 4. Confirm no push happened and nothing leaked
+grep -rIl -E 'sk-ant-|oat01-' "$HOME/loki-ci-logs/real-repo-gate-e2e.logs" || echo "no key material in logs"
+```
+
+Pass criteria per repo are in `scripts/real-repo-gate.repos` (expected outcome, allowed diff paths, max seconds); evidence to record for the log: exit code, wall seconds, Outcome line, receipt path, `loki verify` verdict.

package/docs/v10/HANDOFF-NEXT-WEEK.md

@@ -1,8 +1,7 @@
-# Handoff to next week (D59, written 2026-10-01; resume Wednesday 2026-10-07)
+# Handoff state (D59 pause ended early by D62 on 2026-10-03 about 00:05Z; work resumed, see DECISIONS D62)
 
-## On npm now
-- latest: 10.6.6 (moved by the D49 auto-promote after post-release smoke passed, seen 20:28Z; the D58 real-repo gate is not wired into promote yet).
-- next: 10.6.6 (Release run succeeded 20:12Z; npm can lag about 30 minutes, check `npm view loki-mode dist-tags`). 
+## On npm now (updated 2026-10-02T23:52Z after the D60 sprint)
+- latest and next: 10.6.7 (`npm view loki-mode dist-tags` gave latest 10.6.7, next 10.6.7 at 23:51Z; moved by the D49 auto-promote after Post-Release Smoke passed on bfce1db12; the D58 real-repo gate is still not wired into promote).
 
 ## Releases this window and their CI
 - 10.6.0 (9f9569c35, tree d922ef170): Tests, Bun Parity, Coverage, Security Audit all green on train/72 and on main. Published.
@@ -13,6 +12,13 @@
 - 10.6.5 (0472f306a): Moat suite red, P9 injection-cannot-reach-token regressed by the minimal `loki start <ref>` route (b2e3afc43): the P9 probe drives `loki start <issue>` and expects a provider session; engine10 exited rc=2 first. Not published; start route reverted (621437c0a).
 - 10.6.6 (456058bae): scope control, Control Plane v0, train-cycle fix, docs. Tests, Bun Parity, Coverage, Security Audit all green; Release succeeded. Published.
 
+## D60 sprint (2026-10-02, one hour, all five slices in 10.6.7)
+- 10.6.7 (bfce1db12, train/79 1917333e1): Tests, Bun Parity, Coverage, Security Audit, First-run gate, SBOM, Release, Post-Release Smoke, Promote all success.
+- Shipped: `loki start` runs Loki 10 (moat P9 probe ported, moat rc=0); dashboard prints the bound port (LEAK3, test-ui-bare-loki rc=0); reviewer-first PR body; issue-to-PR Action on Loki 10 plus nightly `loki backlog` example; visible cost cap ($20 default, `--max-cost`, loki.yaml `budgets.per_run`, BUDGET_STOP exit 3).
+- Open: no real end-to-end exit 3 run of the cost cap yet; root action.yml still uses `loki start --simple`.
+- D61 (speed, docs/v10/D61-SPEED.md) resumed under D62. Worktree agent-ad890c5afa3648ae6 held no saved slice 17 work (clean, no commits), so slice 17 restarts. Peer GO covers slices 1, 2, 7, 8, 17 behind LOKI_SPEED=1.
+- D58 basics 1 and 2 below are superseded by 10.6.7 (now PASS on CI; still unproven on a real repo).
+
 ## D58 basics
 1. `loki start` runs v10: FAIL. Both the minimal route (b2e3afc43, a 7-line bin/loki start arm) and the full re-route regress moat P9, because tests/moat P9 drives `loki start <issue>` through the legacy path; port that probe to the v10 issue path first, then re-land b2e3afc43. The full re-route W1-ROUTE is built (branch slice-D57-W1-ROUTE, commit a8ed5461a, which is based on the old main that still has the CP-00 JWT commits, so cherry-pick it, never merge it) but turned Tests red as listed above. Its docs follow-up is f001bc0f1.
 2. Dashboard: FAIL. LEAK3 (bound URL, scoped reuse, 57374-57399 guard; branch slice-P0-DASH-LEAK3, ceba8a6de) failed `test-ui-bare-loki` in CI and was reverted. The Control Plane v0 live view (CP-RELAND) ships in 10.6.6, off unless LOKI_CONTROL_URL is set.

package/docs/v10/PROGRESS.md

@@ -1898,3 +1898,16 @@ The swarm is stopped: .loki/V10-STOP exists, the loop has no wake-ups, and the c
 - NPM-LAG guard row: publish, smoke and promote wait up to 45 min for the version and re-trigger promote; train-cycle merges origin/main back after each release (it stalled at 16:20Z, merged by hand as cc3e1392).
 - E-160 (D55, train verdict reuse on main; CodeQL always runs; kill switch LOKI_E160_REUSE=0) merged locally after an opus APPROVE.
 - D56 Control Plane: design (docs/v10/CONTROL-PLANE.md, 19 slices), CP-00 corpus, CP-01 service (Hono, Drizzle, bun:sqlite; idempotent ingest, 409 on conflict, fold-derived runs), CP-02 shipper (no-op unless LOKI_CONTROL_URL; exactly-once backfill; redaction) and CP-03 UI (runs list and detail; unpriced never shown as 0) merged locally. CP-04 (wire loki control, packaging, CI, test isolation) and BUN-OPT (npm 11 allow-scripts warning: per-platform @oven/bun packages) building.
+
+## 2026-10-02T23:24Z D60 sprint: v10.6.7 cut with all five slices; D61 paused by the governor
+- v10.6.7 (release commit bfce1db12, train/79 at 1917333e1): `loki start owner/repo#N` runs Loki 10 (D60-1, merge 1e6cbeb65, moat P9 probe ported, moat run rc=0 "no rule failed (4 of 9 proven)"), dashboard prints the port it bound (D60-2, test-ui-bare-loki rc=0), reviewer-first PR body (D60-3, merge 6cfabcf8b), issue-to-PR Action on Loki 10 plus nightly `loki backlog` example (D60-4, test-issue-to-pr-action rc=0), visible cost cap with $20 default and BUDGET_STOP exit 3 (D60-5, merge 34c007e9e).
+- train/79 CI: Tier A, Bun Parity, First-run gate, Coverage, Security Audit, Tests all success. train-cycle phase B "PROMOTED train/79 -> main" 23:21:15Z; phase C "RELEASED v10.6.7" 23:21:26Z. On bfce1db12 so far: Bun Parity, First-run gate, SBOM success; Release and npm `next` pending.
+- train/78 (4da502a47) was red on Tier A "emoji/dash on changes" (literal dashes in reviewer_body.test.ts regex); fixed forward with unicode escapes (1917333e1). e10ext budget 1520 > 1500 fixed by trimming blank lines in assert_delta.ts (4da502a47; engine10 1032 pass, 0 fail).
+- Not done: a real end-to-end exit 3 run for the cost cap (unit-tested only); the root action.yml still uses `loki start --simple`.
+- D61 (speed, docs/v10/D61-SPEED.md): paused, governor max engineers 0 (weekly projected 167.8%). Slice 17 engineer stopped; partial work in worktree agent-ad890c5afa3648ae6.
+- 23:51Z: Post-Release Smoke and Promote success on bfce1db12; npm latest and next both 10.6.7. Sprint closed. (The pause was lifted by D62 at about 00:05Z on 2026-10-03.)
+
+## 2026-10-03T01:56Z D62 resume, D63 roadmap, D64 withdrawn; 4 builders on D63 order
+- D62 (resume now) and D63 (roadmap, docs/v10/ROADMAP-D63.md) recorded and pushed (main 49a940d81). D64 (max pace, all Vorflux rows) arrived at 00:20Z and was withdrawn at 00:25Z; recorded as WITHDRAWN, no builder started.
+- Building (sonnet, worktrees): D61-17 large eval tier, D61-01 pre-model timer, D61-08 decomposer, D62-FIX (action.yml to Loki 10 plus real BUDGET_STOP exit 3 test). Ready next: D61-02, D61-07, D62-VIS, D62-JIRA.
+- Governor: weekly projected 57.4% at 01:55Z; pace target about 0.5% of the week per hour at 4 engineers.

package/docs/v10/ROADMAP-D63.md

@@ -0,0 +1,35 @@
+# Roadmap D63: the industry-standard autonomous software factory
+
+Founder directive D63 (2026-10-03 00:15Z, relayed by the autonomi-dev session). This page sets the roadmap that D50, D51, D56 and D61 slot into. The measurable bars below are the only claim we make. User-facing text makes no "superintelligence" or benchmark claims, and no row is done without a test or an eval row in METRICS.
+
+## Pillars: the bar to match, and how we beat it
+
+| # | Pillar | Bar to match | How we beat it | Done when (test or eval row) |
+|---|---|---|---|---|
+| 1 | Autonomy | Devin, Factory Droids: an issue, backlog or spec goes in; merge-ready PRs come out; no babysitting | Proof plus lift | D50 lift on the eval, never below raw on the same model; D61 speed targets; a BLOCKED run asks exactly one question |
+| 2 | Speed at scale | Factory: parallel units with an integrator; warm start | Same or fewer tokens than one sequential session | D61 large-arm eval holds (section 5 of D61-SPEED.md) before the default flips |
+| 3 | Evidence | Devin, Vorflux: PR bodies with tests, screenshots of changed pages, HTTP transcripts for APIs | A signed receipt covers all of it | Screenshots are generated locally (Playwright) and hashed into the receipt; `loki verify` fails if one is altered |
+| 4 | Control Plane UI | Devin web app, Factory dashboard | Every number links to its receipt | D56 is the default: live runs, history, PRs and issues, cost, compare, and a BLOCKED question answerable in the UI; one container with Helm and ECS examples; the old dashboard retired once at parity |
+| 5 | Connections | Devin, Factory integrations | Intake is the same v10 run with the same receipt | GitHub (PAT now, GitHub App next) and GitLab; Jira and Linear intake; two-way Slack (`@loki` in a thread starts a run, BLOCKED answers come back); issue-to-PR Action; an MCP server exposing run, status and verify; VS Code and JetBrains via ACP later |
+| 6 | Spec to software | 8090 | Every acceptance criterion traced to code and a check in the receipt | A spec or PRD file becomes a delivery contract, decomposed (D61) into units and then PRs; replaces the legacy PRD path (D57) |
+| 7 | Legacy and modernization | 8090, Factory | Proof of function on legacy code | `loki modernize` stays hidden until it passes a real-repo eval; not this week |
+| 8 | Claude Code parity | Claude Code | Runs inside it with a receipt | loki-seal plus a /loki command that runs the v10 engine on the current task; CLAUDE.md and .claude/skills honoured in the context pack |
+| 9 | Enterprise | Devin and Factory enterprise tiers | Audit from the receipt chain | An audit log of model calls; budgets per team; SSO for the Control Plane later; never certification claims |
+
+## Order this week (under the usage governor)
+1. D61 eval arm (slice 17), then warm start (slices 5 and 6), with slices 1, 2, 7 and 8 in parallel.
+2. Visual evidence in PRs (pillar 3).
+3. Control Plane as the default, with the BLOCKED answer UI (pillar 4).
+4. Two-way Slack (pillar 5).
+5. Jira and Linear intake (pillar 5).
+6. Spec to contract (pillar 6).
+7. Multi-repo workspaces (D51 Phase B, behind LOKI_WORKSPACES).
+8. MCP run, status and verify server (pillar 5).
+9. Containers (pillar 4).
+
+Also from D62: root action.yml routes to Loki 10; one real end-to-end BUDGET_STOP exit 3 test; project memory (D50 item 3). Later: merge queue, PR review with a risk score, REST API.
+
+## Rules
+- Each item ships on its own train, behind a flag where it changes defaults, with README and docs updated in the same slice.
+- Each release reports its version and what users can now do to the autonomi-dev session.
+- Pacing follows the governor (about 0.5% of the weekly window per hour); seats scale only with live /usage.