loki-mode 10.7.0 → 10.8.0

package/README.md

@@ -303,6 +303,7 @@ A local control plane and UI for many runs, on by default. Turn it off with `LOK
 loki control serve                       # 127.0.0.1, default port 47821 (--port N, --db PATH)
 loki control backfill .                  # ship ./.loki/runs to the control plane
 loki control status                      # reachable? how many runs held?
+loki control prune --repo acme/widget    # remove those runs from the local control DB (--before DATE, --dry-run)
 ```
 
 The URL comes from `LOKI_CONTROL_URL`, else `http://127.0.0.1:${LOKI_CONTROL_PORT:-47821}`. While `loki control serve` is running, runs on this machine ship to it automatically (it publishes `~/.loki/control/instance.json`, mode 0600, removed on exit); a run never starts the server. Set `LOKI_CONTROL_URL` to ship elsewhere. See [docs/v10/CONTROL-PLANE.md](docs/v10/CONTROL-PLANE.md).

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: An autonomous software factory that knows what it is supposed to deliver, and proves it did. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v10.7.0
+# Loki Mode v10.8.0
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the legacy engine, which still ships and is being removed (`loki start owner/repo#N` still routes to it; prefer `loki owner/repo#N`).
 
@@ -473,4 +473,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v10.7.0 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v10.8.0 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-10.7.0
+10.8.0

package/autonomy/loki

@@ -1981,6 +1981,9 @@ _loki_control_ui() {
             echo "loki: the Control Plane needs bun (https://bun.sh); using the classic dashboard." >&2
             return 1
         fi
+        # FC-07: LOKI_CONTROL=0 is the test off switch (supervisor, run-all-tests, local-ci);
+        # it must never start a detached `control serve` that writes ~/.loki/control.
+        [ "${LOKI_CONTROL:-}" = "0" ] && return 1
         local cli="$SKILL_DIR/loki-ts/dist/loki.js" cdir="${HOME}/.loki/control" spid
         [ -f "$cli" ] || cli="$SKILL_DIR/loki-ts/src/cli.ts"
         mkdir -p "$cdir" && chmod 700 "$cdir" 2>/dev/null || true
@@ -21331,7 +21334,7 @@ tokens_per_tier = {
 pricing = {
     'Fable':  {'input': 10.00, 'output': 50.00},
     'Opus':   {'input': 5.00, 'output': 25.00},
-    'Sonnet': {'input': 3.00, 'output': 15.00},
+    'Sonnet': {'input': 2.00, 'output': 10.00},
     'Haiku':  {'input': 1.00, 'output': 5.00},
 }
 

package/autonomy/run.sh

@@ -7581,7 +7581,7 @@ _write_pricing_json() {
     "fable":           {"input": 10.00, "output": 50.00, "label": "Fable 5 (top, 2x Opus)", "provider": "claude"},
     "claude-fable-5":  {"input": 10.00, "output": 50.00, "label": "Fable 5 (top, 2x Opus)", "provider": "claude"},
     "opus":            {"input": 5.00,  "output": 25.00, "label": "Opus (latest)",   "provider": "claude"},
-    "sonnet":          {"input": 3.00,  "output": 15.00, "label": "Sonnet (latest)", "provider": "claude"},
+    "sonnet":          {"input": 2.00,  "output": 10.00, "label": "Sonnet (latest)", "provider": "claude"},
     "haiku":           {"input": 1.00,  "output": 5.00,  "label": "Haiku (latest)",  "provider": "claude"},
     "gpt-5.3-codex":   {"input": 1.75,  "output": 14.00, "label": "GPT-5.3 Codex", "provider": "codex"}
   }
@@ -20250,7 +20250,7 @@ pricing = {
     'fable': {'input': 10.00, 'output': 50.00},
     'claude-fable-5': {'input': 10.00, 'output': 50.00},
     'opus': {'input': 5.00, 'output': 25.00},
-    'sonnet': {'input': 3.00, 'output': 15.00},
+    'sonnet': {'input': 2.00, 'output': 10.00},
     'haiku': {'input': 1.00, 'output': 5.00},
     'gpt-5.3-codex': {'input': 1.75, 'output': 14.00},
     'gpt-5.6-sol': {'input': 2.50, 'output': 20.00},
@@ -24828,10 +24828,14 @@ except Exception:
     if [[ "${ENABLE_DASHBOARD:-true}" == "true" ]] && command -v curl &>/dev/null; then
         local project_cwd
         project_cwd="$(pwd)"
-        curl -sf -X POST "http://127.0.0.1:${DASHBOARD_PORT}/api/focus" \
+        # CPE-24: the Control Plane answers 501 (no focus API). Best-effort; say so
+        # honestly in debug output rather than treating the miss as an error.
+        _focus_code="$(curl -s -o /dev/null -w '%{http_code}' -X POST "http://127.0.0.1:${DASHBOARD_PORT}/api/focus" \
             -H "Content-Type: application/json" \
-            -d "{\"project_dir\": \"${project_cwd}\"}" \
-            >/dev/null 2>&1 || true
+            -d "{\"project_dir\": \"${project_cwd}\"}" 2>/dev/null || true)"
+        case "$_focus_code" in
+            501|410) type log_debug >/dev/null 2>&1 && log_debug "project focus: not available on the Control Plane (HTTP ${_focus_code})" ;;
+        esac
     fi
 
     # Initialize Cross-Provider Failover (v6.19.0)

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "10.7.0"
+__version__ = "10.8.0"
 
 # Expose the control app for easy import
 try:

package/dashboard/server.py

@@ -7752,7 +7752,7 @@ _DEFAULT_PRICING = {
     "fable":  {"input": 10.00, "output": 50.00},
     "claude-fable-5": {"input": 10.00, "output": 50.00},
     "opus":   {"input": 5.00, "output": 25.00},
-    "sonnet": {"input": 3.00, "output": 15.00},
+    "sonnet": {"input": 2.00, "output": 10.00},
     "haiku":  {"input": 1.00, "output": 5.00},
     # OpenAI Codex
     "gpt-5.3-codex": {"input": 1.50, "output": 12.00},
@@ -8587,18 +8587,16 @@ _PROVIDER_LABELS = {
 }
 
 # Display-only pricing notes, keyed by model. These annotate the pricing table in
-# the UI WITHOUT changing any computed cost number. The Sonnet 5 launch carries an
-# intro price ($2/$10 per MTok through Aug 31 2026), but the cost estimator keeps
-# quoting the standard $3/$15 rate: over-estimating the display is the safe
-# direction (a bill can only come in lower than quoted, never higher). This note
-# tells the user why the quote is conservative during the intro window.
+# the UI WITHOUT changing any computed cost number. The Sonnet 5 intro price
+# ($2/$10 per MTok) became the standard price, so the 2026-09-01 increase to
+# $3/$15 will not occur (platform.claude.com pricing page, read 2026-10-03).
 _UNVERIFIED_RATE_NOTE = (
     "Unverified placeholder rate, scaled from gpt-5.3; not from OpenAI's pricing page."
 )
 _MODEL_PRICING_NOTES = {
     "sonnet": (
-        "Intro pricing: $2 / $10 per MTok through Aug 31 2026. "
-        "Estimates use the standard $3 / $15 rate (conservative)."
+        "Standard pricing: $2 / $10 per MTok. "
+        "The intro price became the standard price; no increase to $3 / $15."
     ),
     # See the UNVERIFIED RATES comment on the pricing table: shown, not hidden.
     "gpt-5.6-sol": _UNVERIFIED_RATE_NOTE,

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v10.7.0
+**Version:** v10.8.0
 
 **Engine note:** `loki "<task>"`, `loki owner/repo#N` and `loki quick` run the Loki 10 engine. `loki start` still routes to the legacy engine, which is being removed (planned work resumes 2026-10-07); prefer `loki owner/repo#N`. See [docs/v10/GUIDE.md](v10/GUIDE.md).
 

package/docs/v10/CONTROL-PLANE.md

@@ -46,6 +46,7 @@ Architect design, 2026-10-01, base 1dfc87103. Design only. Flag: `LOKI_CONTROL=1
 - events.jsonl is the spool. The shipper never writes to it (the supervisor treats outside writes as tamper). Its acked cursor lives in `.loki/runs/<id>/ship.json {acked_seq, url}`, written atomically.
 - Started by the supervisor next to the log (one hook line, skipped when `LOKI_CONTROL=0`; the url comes from `LOKI_CONTROL_URL` or local discovery, section 6), it uses `tail()` (events.ts:155), batches up to 200 events or 1 s, and POSTs. Backoff 1, 2, 4 ... 60 s with jitter. It never blocks or fails the run: on supervisor exit it flushes for at most 5 s, then leaves the rest for replay.
 - Every string in `data` goes through `redactSecrets` before sending.
+- Cleanup: `loki control prune --repo OWNER/NAME` and/or `--before ISO_DATE` (`--dry-run` previews) deletes matching runs, their events and orphaned sources in one transaction, direct on the SQLite file (WAL, 5 s busy timeout), so it works with the server up or down. `DELETE /v1/runs/:source/:run` (JSON content type, same-host Origin, bearer when a token is set) removes one run and writes an `audit` row first; the UI Run detail page has a Remove button with a confirm step.
 - Replay: `loki control backfill [--repo DIR]` and every `loki` start ship each run whose ship.json acked_seq is below its last seq. Backfill of old .loki/runs uses the same code path.
 
 ## 6. Local discovery (on by default)
@@ -111,3 +112,9 @@ A run blocked on a spec conflict shows its question in the run view with an answ
 `loki answer [<run-id>] [--text "..."]` reads the run's task and question from `.loki/runs/<run>/events.jsonl` and the answer from `--text` or the answer file above, then launches `bin/loki "<task>\n\nClarification answering \"<question>\": <answer>"` and prints the new run id. The default run is the newest BLOCKED run in the current repo. The child env drops every `SLACK_*` variable and `LOKI_CONTROL_TOKEN` and sets `LOKI_NO_BROWSER=1`. A run that is not BLOCKED, or has no answer, exits 2 with the reason.
 
 `LOKI_CONTROL_DEFAULT=1` (off by default) makes `loki dashboard` open the Control Plane.
+
+### Integrity and the display verdict (D86, FC-08)
+
+Ingest runs a pure verifier (`src/server/integrity.ts`) over every stored run and persists `tampered`, `attested`, `sig_checked` and `integrity_reasons`. Only the sealed prefix (events through `log.sealed`) supplies the verdict; a second `run.completed`, or any verdict-bearing event after `log.sealed`, is TAMPERED. The `log.sealed` kid must equal the signed receipt kid, and with keys configured an unknown kid is TAMPERED.
+
+Display verdicts (`effective_verdict`, mirrored by `ui/src/api.ts`): TAMPERED; UNVERIFIED (a VERIFIED claim that is not attested, or a log redacted before ingest); "VERIFIED (signature not checked)" (attested, but no key in `LOKI_CP_RECEIPT_PUBKEYS` checked the seal signature); VERIFIED (attested and signature-checked). With no keys configured nothing can be plain VERIFIED. Choice for the list filter: `?verdict=VERIFIED` lists signature-checked runs only; `?verdict=VERIFIED (signature not checked)` lists the rest. ALREADY_SATISFIED is a success outcome and needs a seal exactly like VERIFIED (same UNVERIFIED and signature-not-checked rules). Any other verdict on an unattested run shows `<verdict> (unattested)`, so an edited or redacted FAILED or PARTIAL never reads as plain. The Overview VERIFIED tile counts only plain VERIFIED; a separate tile counts signature-not-checked runs. Rows are recomputed at boot in chunks (one transaction each) when attested is NULL or the stored key-set fingerprint (`integrity_key_fp`) differs from the configured one; rows whose events are gone are marked unattested once and not retried.

package/docs/v10/CP-ENTERPRISE-UI.md

@@ -230,13 +230,274 @@ Gap: the server stores events only. Artifacts live in the local repo, and source
 
 Every mutating endpoint: requires the bearer token when the server is not loopback-only, refuses non-JSON bodies, checks Origin against the served host, writes an audit row before acting, and returns the resulting state for optimistic reconciliation.
 
-## 5. Parity checklist (gate for CPE-24)
+## 5. Legacy integration contract (gate for CPE-24)
+
+The legacy dashboard (dashboard/server.py, port 57374, 13194 lines) serves 234 routes (method and path entries after dropping HEAD; routers api_v2 at /api/v2, api_operator at /api/operator, api_start, api_runs_v1 at /api/v1/runs, the /lab and /assets mounts, WS /ws and /ws/collab). Deleting it (CPE-24) must not break a real integration. This section is the contract: one row per route, what consumes it, what the Control Plane offers, and what the shim at packages/control-plane/src/server/legacy/ does with it.
+
+Method. Route list: FastAPI introspection of `dashboard.server.app` (the 234 entries). Consumers: a repo-wide text scan of git-tracked files, then each used route's consumer lines were read by hand. Counted as a consumer: the TypeScript and Python SDKs, vscode-extension (src and the bundled media/loki-dashboard.js webview), autonomy/loki and autonomy/run.sh, web-app, .github/workflows, tests/moat, tests/e2e, tests/integration, scripts/run-dashboard-* (marked "(test)" when a test). Not counted: dashboard/ itself, dashboard-ui/ (the legacy UI is deleted with the server), docs, generated maps, packages/control-plane. The scan matches path text, so single-segment paths (/start, /cost, /trust, /) were checked by hand: every hit was `loki start`, `/api/cost` or `/lab/api/cost`, none a request to that HTML route. Limits: a path built at runtime from parts is invisible to a text scan, and an HTTP verb is inferred from the nearby call text, so a verb on a bundled-JS row is best effort. A route with a consumer is USED, otherwise UNUSED.
+
+Status values: EXISTS (the CP serves it today), PARTIAL (the shim maps it and says what differs), MISSING (a USED route the CP has no data or mechanism for), UNUSED (no consumer). Shim actions: map (answer from CP data), 308 to CP UI (HTML page), 410 with notice (UNUSED, retired), 501 not yet supported (USED but no CP data or mechanism: the shim answers an explicit 501, never a faked success), none (the CP already serves the path).
+
+Counts: map 6, 308 5, 501 77, 410 142, none 4; total 234.
+
+Auth contract (never looser than legacy). Legacy `require_scope` is open when LOKI_ENTERPRISE_AUTH and OIDC are both off, and otherwise answers 401 without a token and 403 on a missing scope. Open in every mode: /health, /.well-known/agent.json, /api/enterprise/status, /api/auth/info, /api/providers/models, /metrics, the docs routes. The shim applies one rule to every route the legacy server guarded: if LOKI_CONTROL_TOKEN is set, require the CP bearer token (401 with www-authenticate otherwise); if no CP token is set but legacy enterprise auth or OIDC is enabled in the environment, fail closed with 401 (the CP has no way to check the legacy `loki_*` tokens); if neither is set, open, matching the legacy default. The CP token carries every scope, which is safe because the shim exposes only read routes and answers 501 or 410 for the rest. 501 and 410 answers are also behind the guard, so an unauthenticated caller learns nothing about a guarded route. The shim never binds a port; mounting it on the CP app keeps hostGuard and the loopback-only action routes exactly as they are.
+
+First hit per process, each route logs one line: `legacy dashboard route <path> is served by the Control Plane; migrate to /v1/...` (mapped and 308 routes). A 501 or 410 route logs the same single line in the words "is not served by the Control Plane (501)" or "is retired (410)".
+
+### 5.1 Parity checklist (gate for CPE-24)
 1. Every row of section 1 marked KEEP or REWORK has its v10 home rendered on real data, proven by a UI test with a fixture run.
 2. Every row of section 3.3 not marked DEFERRED works end to end in tests/e2e (start a fixture run, stream, BLOCKED answer, stop, retry, verify, config write).
 3. Visual parity: screenshots of wordmark, nav, card, KPI, badge, table in light and dark compared against legacy captures (CPE-23).
 4. No route under the old dashboard is reachable except the CP-LEGACY redirects (7b701d238).
 5. Lighthouse accessibility at or above 95 on composer, thread, Home; axe zero serious violations.
 
+
+### 5.2 Route contract
+
+| Method and path | Consumers (verified file:line) | CP /v1 equivalent | Status | Shim action |
+|---|---|---|---|---|
+| GET `/openapi.json` | none | none | UNUSED | 410 with notice |
+| GET `/docs` | none | none | UNUSED | 410 with notice |
+| GET `/docs/oauth2-redirect` | none | none | UNUSED | 410 with notice |
+| GET `/redoc` | none | none | UNUSED | 410 with notice |
+| POST `/api/v2/tenants` | sdk/python/loki_mode_sdk/client.py:204, sdk/typescript/src/client.ts:237 | none | MISSING | 501 not yet supported |
+| GET `/api/v2/tenants` | sdk/python/loki_mode_sdk/client.py:191, sdk/typescript/src/client.ts:225 | none | MISSING | 501 not yet supported |
+| GET `/api/v2/tenants/{tenant_id}` | sdk/typescript/src/client.ts:229 | none | MISSING | 501 not yet supported |
+| PUT `/api/v2/tenants/{tenant_id}` | none | none | UNUSED | 410 with notice |
+| DELETE `/api/v2/tenants/{tenant_id}` | sdk/typescript/src/client.ts:241 | none | MISSING | 501 not yet supported |
+| GET `/api/v2/tenants/{tenant_id}/projects` | none | none | UNUSED | 410 with notice |
+| POST `/api/v2/runs` | vscode-extension/media/loki-dashboard.js:9617 | none | MISSING | 501 not yet supported |
+| GET `/api/v2/runs` | sdk/python/loki_mode_sdk/client.py:220, sdk/typescript/src/client.ts:201 | /v1/runs | PARTIAL (ids are source:run strings, not ints; no project_id filter; status maps to running/completed; limit/offset map to limit/cursor) | map |
+| GET `/api/v2/runs/{run_id}` | sdk/python/loki_mode_sdk/client.py:228, sdk/typescript/src/client.ts:205 | /v1/runs/:id | PARTIAL (run_id is source:run (URL-encoded) or a bare run id; legacy integer ids answer 404) | map |
+| POST `/api/v2/runs/{run_id}/cancel` | sdk/python/loki_mode_sdk/client.py:233, sdk/typescript/src/client.ts:209, vscode-extension/media/loki-dashboard.js:9617 | none | MISSING | 501 not yet supported |
+| POST `/api/v2/runs/{run_id}/replay` | sdk/python/loki_mode_sdk/client.py:238, sdk/typescript/src/client.ts:213, vscode-extension/media/loki-dashboard.js:9617 | none | MISSING | 501 not yet supported |
+| GET `/api/v2/runs/{run_id}/timeline` | sdk/python/loki_mode_sdk/client.py:243, sdk/typescript/src/client.ts:217, vscode-extension/media/loki-dashboard.js:9255 | /v1/runs/:id (stages, events) | PARTIAL (phases are CP stages; events carry seq, ts, type, stage only) | map |
+| POST `/api/v2/api-keys` | sdk/python/loki_mode_sdk/client.py:263, sdk/typescript/src/client.ts:178, vscode-extension/media/loki-dashboard.js:10097 | none | MISSING | 501 not yet supported |
+| GET `/api/v2/api-keys` | sdk/python/loki_mode_sdk/client.py:253, sdk/typescript/src/client.ts:170 | none | MISSING | 501 not yet supported |
+| GET `/api/v2/api-keys/{identifier}` | none | none | UNUSED | 410 with notice |
+| PUT `/api/v2/api-keys/{identifier}` | none | none | UNUSED | 410 with notice |
+| DELETE `/api/v2/api-keys/{identifier}` | sdk/typescript/src/client.ts:190, vscode-extension/media/loki-dashboard.js:10097 | none | MISSING | 501 not yet supported |
+| POST `/api/v2/api-keys/{identifier}/rotate` | sdk/python/loki_mode_sdk/client.py:271, sdk/typescript/src/client.ts:186, vscode-extension/media/loki-dashboard.js:10097 | none | MISSING | 501 not yet supported |
+| GET `/api/v2/policies` | none | none | UNUSED | 410 with notice |
+| PUT `/api/v2/policies` | none | none | UNUSED | 410 with notice |
+| POST `/api/v2/policies/evaluate` | none | none | UNUSED | 410 with notice |
+| GET `/api/v2/audit` | sdk/python/loki_mode_sdk/client.py:293, sdk/typescript/src/client.ts:254, vscode-extension/media/loki-dashboard.js:9813 | /v1/audit (added by the shim) | PARTIAL (CP audit is an operator-action log (run removal, prune), not the legacy hash-chained log; resource_type filter answers 400) | map |
+| GET `/api/v2/audit/verify` | tests/moat/p2-honest-verdict.sh:1162 (test), tests/moat/p2-honest-verdict.sh:1258 (test), vscode-extension/media/loki-dashboard.js:9813 | none | MISSING | 501 not yet supported |
+| GET `/api/v2/audit/export` | none | /v1/audit | UNUSED | 410 with notice |
+| GET `/api/operator/runs/{run_id}` | none | /v1/runs/:id | UNUSED | 410 with notice |
+| GET `/api/operator/tests` | none | none | UNUSED | 410 with notice |
+| GET `/api/operator/receipts` | none | none | UNUSED | 410 with notice |
+| GET `/api/operator/releases` | none | none | UNUSED | 410 with notice |
+| GET `/api/operator/phases` | none | none | UNUSED | 410 with notice |
+| GET `/api/operator/workspaces/runs` | none | none | UNUSED | 410 with notice |
+| GET `/api/operator/workspaces/runs/{ws}/{run_id}` | none | none | UNUSED | 410 with notice |
+| GET `/api/onboarding/state` | none | none | UNUSED | 410 with notice |
+| POST `/api/onboarding/provider` | none | none | UNUSED | 410 with notice |
+| POST `/api/onboarding/github` | none | none | UNUSED | 410 with notice |
+| GET `/api/onboarding/repos` | none | none | UNUSED | 410 with notice |
+| POST `/api/onboarding/repo` | none | none | UNUSED | 410 with notice |
+| GET `/api/backlog/issues` | none | none | UNUSED | 410 with notice |
+| POST `/api/backlog/run` | none | none | UNUSED | 410 with notice |
+| GET `/api/backlog/status` | none | none | UNUSED | 410 with notice |
+| GET `/api/v1/runs` | none | /v1/runs | UNUSED | 410 with notice |
+| GET `/api/v1/runs/{run_id}` | none | /v1/runs/:id | UNUSED | 410 with notice |
+| POST `/api/v1/runs` | none | /v1/runs | UNUSED | 410 with notice |
+| POST `/api/v1/runs/{run_id}/stop` | none | none | UNUSED | 410 with notice |
+| GET `/start` | none | CP UI (/) | EXISTS | 308 to CP UI |
+| MOUNT `/lab` | none | CP UI (/) | EXISTS | 308 to CP UI |
+| GET `/health` | autonomy/loki:1929, autonomy/loki:7760, autonomy/run.sh:19293 (+10) | /health | EXISTS (CP /health answers {service, pid, install_path}, not the legacy body; CLI discovery relies on that identity, so the shim never overrides it) | none (CP /health serves) |
+| GET `/api/providers/models` | none | none | UNUSED | 410 with notice |
+| GET `/.well-known/agent.json` | .github/workflows/integrity-audit.yml:114, .github/workflows/integrity-audit.yml:115 | none (static card) | PARTIAL (static card from shim constants; capabilities the CP cannot back (streaming, enterprise rbac/multi-tenant) are false) | map |
+| GET `/api/status` | autonomy/loki:15601, autonomy/run.sh:19357, autonomy/run.sh:19541 (+10) | /v1/runs (derived) | PARTIAL (status, version, uptime, active_sessions, phase, provider only; no running_agents, pending_tasks, iteration, complexity, mode, current_task (CP has no such data, fields omitted)) | map |
+| GET `/api/projects` | sdk/python/loki_mode_sdk/client.py:166, sdk/typescript/src/client.ts:127, tests/moat/p7-no-fabricated-data.sh:446 (test) | none | MISSING | 501 not yet supported |
+| POST `/api/projects` | sdk/python/loki_mode_sdk/client.py:184, sdk/typescript/src/client.ts:139, tests/moat/p7-no-fabricated-data.sh:437 (test) (+1) | none | MISSING | 501 not yet supported |
+| GET `/api/projects/{project_id}` | sdk/python/loki_mode_sdk/client.py:174, sdk/typescript/src/client.ts:131 | none | MISSING | 501 not yet supported |
+| PUT `/api/projects/{project_id}` | vscode-extension/media/loki-dashboard.js:496 | none | MISSING | 501 not yet supported |
+| DELETE `/api/projects/{project_id}` | vscode-extension/media/loki-dashboard.js:496 | none | MISSING | 501 not yet supported |
+| GET `/api/tasks` | sdk/python/loki_mode_sdk/tasks.py:30, sdk/typescript/src/client.ts:150 | none | MISSING | 501 not yet supported |
+| POST `/api/tasks` | sdk/python/loki_mode_sdk/tasks.py:56, sdk/typescript/src/client.ts:162, vscode-extension/media/loki-dashboard.js:496 | none | MISSING | 501 not yet supported |
+| GET `/api/tasks/{task_id}` | sdk/python/loki_mode_sdk/tasks.py:38, sdk/typescript/src/client.ts:154, vscode-extension/src/views/dashboardWebview.ts:168 | none | MISSING | 501 not yet supported |
+| PUT `/api/tasks/{task_id}` | sdk/python/loki_mode_sdk/tasks.py:71, vscode-extension/media/loki-dashboard.js:496 | none | MISSING | 501 not yet supported |
+| DELETE `/api/tasks/{task_id}` | vscode-extension/media/loki-dashboard.js:496 | none | MISSING | 501 not yet supported |
+| POST `/api/tasks/{task_id}/move` | vscode-extension/media/loki-dashboard.js:496 | none | MISSING | 501 not yet supported |
+| WS `/ws` | vscode-extension/media/loki-dashboard.js:496 | none | MISSING | 501 not yet supported |
+| GET `/api/registry/projects` | none | none | UNUSED | 410 with notice |
+| POST `/api/registry/projects` | vscode-extension/media/loki-dashboard.js:496 | none | MISSING | 501 not yet supported |
+| GET `/api/registry/projects/{identifier}` | none | none | UNUSED | 410 with notice |
+| DELETE `/api/registry/projects/{identifier}` | none | none | UNUSED | 410 with notice |
+| GET `/api/registry/projects/{identifier}/health` | none | none | UNUSED | 410 with notice |
+| POST `/api/registry/projects/{identifier}/access` | none | none | UNUSED | 410 with notice |
+| GET `/api/registry/discover` | none | none | UNUSED | 410 with notice |
+| POST `/api/registry/sync` | vscode-extension/media/loki-dashboard.js:496 | none | MISSING | 501 not yet supported |
+| GET `/api/registry/tasks` | none | none | UNUSED | 410 with notice |
+| GET `/api/registry/learnings` | none | none | UNUSED | 410 with notice |
+| GET `/api/fleet/runs` | tests/moat/p7-no-fabricated-data.sh:4637 (test), tests/moat/p7-no-fabricated-data.sh:4706 (test), tests/moat/p7-no-fabricated-data.sh:4710 (test) (+1) | /v1/fleet/runs (CPE24-P1) | PARTIAL (reads the same .loki or registry source; unmeasured values are null with a not-measured marker) | map |
+| GET `/api/fleet/summary` | tests/moat/p7-no-fabricated-data.sh:4637 (test), tests/moat/p7-no-fabricated-data.sh:4695 (test), tests/moat/p7-no-fabricated-data.sh:4696 (test) (+1) | /v1/fleet/summary (CPE24-P1) | PARTIAL (reads the same .loki or registry source; unmeasured values are null with a not-measured marker) | map |
+| GET `/api/fleet/runs/{identifier}` | none | none | UNUSED | 410 with notice |
+| POST `/api/focus` | autonomy/run.sh:24831, web-app/server.py:2744 | none | MISSING | 501 not yet supported |
+| GET `/api/focus` | none | none | UNUSED | 410 with notice |
+| DELETE `/api/focus` | none | none | UNUSED | 410 with notice |
+| GET `/api/session/model` | none | none | UNUSED | 410 with notice |
+| POST `/api/session/model` | vscode-extension/media/loki-dashboard.js:496 | none | MISSING | 501 not yet supported |
+| GET `/api/running-projects` | none | none | UNUSED | 410 with notice |
+| POST `/api/control/start` | vscode-extension/media/loki-dashboard.js:496, vscode-extension/src/api/client.ts:257, vscode-extension/src/extension.ts:580 | none | MISSING | 501 not yet supported |
+| GET `/api/control/builds/{execution_id}` | none | none | UNUSED | 410 with notice |
+| GET `/api/control/builds/{execution_id}/proof` | none | none | UNUSED | 410 with notice |
+| POST `/api/control/builds/{execution_id}/stop` | none | none | UNUSED | 410 with notice |
+| POST `/api/running-projects/stop` | none | none | UNUSED | 410 with notice |
+| POST `/api/fleet/runs/{identifier}/retry` | none | none | UNUSED | 410 with notice |
+| POST `/api/fleet/runs/{identifier}/cancel` | none | none | UNUSED | 410 with notice |
+| GET `/api/enterprise/status` | none | none | UNUSED | 410 with notice |
+| GET `/api/auth/info` | none | none | UNUSED | 410 with notice |
+| POST `/api/enterprise/tokens` | none | none | UNUSED | 410 with notice |
+| GET `/api/enterprise/tokens` | none | none | UNUSED | 410 with notice |
+| DELETE `/api/enterprise/tokens/{identifier}` | none | none | UNUSED | 410 with notice |
+| GET `/api/enterprise/audit` | none | none | UNUSED | 410 with notice |
+| GET `/api/enterprise/audit/summary` | none | none | UNUSED | 410 with notice |
+| GET `/api/compliance` | none | none | UNUSED | 410 with notice |
+| GET `/api/memory/summary` | none | none | UNUSED | 410 with notice |
+| GET `/api/memory/episodes` | vscode-extension/src/views/memoryViewProvider.ts:152 | none | MISSING | 501 not yet supported |
+| GET `/api/memory/episodes/{episode_id}` | vscode-extension/src/views/dashboardWebview.ts:204, vscode-extension/src/views/memoryViewProvider.ts:215 | none | MISSING | 501 not yet supported |
+| GET `/api/memory/patterns` | vscode-extension/src/views/memoryViewProvider.ts:151 | none | MISSING | 501 not yet supported |
+| GET `/api/memory/patterns/{pattern_id}` | vscode-extension/src/views/dashboardWebview.ts:186, vscode-extension/src/views/memoryViewProvider.ts:197 | none | MISSING | 501 not yet supported |
+| GET `/api/memory/skills` | vscode-extension/src/views/memoryViewProvider.ts:153 | none | MISSING | 501 not yet supported |
+| GET `/api/memory/skills/{skill_id}` | none | none | UNUSED | 410 with notice |
+| GET `/api/memory/economics` | tests/moat/p7-no-fabricated-data.sh:4638 (test), tests/moat/p7-no-fabricated-data.sh:4749 (test), tests/moat/p7-no-fabricated-data.sh:4750 (test) (+2) | none | MISSING | 501 not yet supported |
+| POST `/api/memory/consolidate` | vscode-extension/media/loki-dashboard.js:496 | none | MISSING | 501 not yet supported |
+| POST `/api/memory/retrieve` | vscode-extension/media/loki-dashboard.js:496 | none | MISSING | 501 not yet supported |
+| GET `/api/memory/index` | none | none | UNUSED | 410 with notice |
+| GET `/api/memory/timeline` | none | none | UNUSED | 410 with notice |
+| GET `/api/memory/files` | none | none | UNUSED | 410 with notice |
+| GET `/api/memory/file` | none | none | UNUSED | 410 with notice |
+| GET `/api/memory/search` | none | none | UNUSED | 410 with notice |
+| GET `/api/memory/stats` | none | none | UNUSED | 410 with notice |
+| GET `/api/learning/metrics` | tests/moat/p7-no-fabricated-data.sh:4638 (test), tests/moat/p7-no-fabricated-data.sh:4752 (test) | none | MISSING | 501 not yet supported |
+| GET `/api/learning/trends` | none | none | UNUSED | 410 with notice |
+| GET `/api/learning/signals` | none | none | UNUSED | 410 with notice |
+| GET `/api/learning/aggregation` | none | none | UNUSED | 410 with notice |
+| POST `/api/learning/aggregate` | vscode-extension/media/loki-dashboard.js:496 | none | MISSING | 501 not yet supported |
+| GET `/api/learning/preferences` | none | none | UNUSED | 410 with notice |
+| GET `/api/learning/errors` | none | none | UNUSED | 410 with notice |
+| GET `/api/learning/success` | none | none | UNUSED | 410 with notice |
+| GET `/api/learning/tools` | none | none | UNUSED | 410 with notice |
+| POST `/api/control/pause` | vscode-extension/media/loki-dashboard.js:496, vscode-extension/src/api/client.ts:277, vscode-extension/src/extension.ts:703 | none | MISSING | 501 not yet supported |
+| POST `/api/control/resume` | vscode-extension/media/loki-dashboard.js:496, vscode-extension/src/api/client.ts:285, vscode-extension/src/extension.ts:743 | none | MISSING | 501 not yet supported |
+| POST `/api/control/stop` | vscode-extension/media/loki-dashboard.js:496, vscode-extension/src/api/client.ts:269, vscode-extension/src/extension.ts:651 | none | MISSING | 501 not yet supported |
+| GET `/api/cost` | tests/moat/p7-no-fabricated-data.sh:4637 (test), tests/moat/p7-no-fabricated-data.sh:4646 (test), tests/moat/p7-no-fabricated-data.sh:4647 (test) (+3) | /v1/cost/snapshot (CPE24-P1) | PARTIAL (reads the same .loki or registry source; unmeasured values are null with a not-measured marker) | map |
+| GET `/api/budget` | tests/e2e/dashboard-evidence-panels.mjs:73 (test), tests/moat/p7-no-fabricated-data.sh:4637 (test), tests/moat/p7-no-fabricated-data.sh:4650 (test) (+3) | none | MISSING | 501 not yet supported |
+| GET `/api/cost/timeline` | tests/moat/p7-no-fabricated-data.sh:4637 (test), tests/moat/p7-no-fabricated-data.sh:4652 (test), tests/moat/p7-no-fabricated-data.sh:4653 (test) (+15) | /v1/cost/timeline (CPE24-P1) | PARTIAL (reads the same .loki or registry source; unmeasured values are null with a not-measured marker) | map |
+| GET `/api/trust/trajectory` | none | none | UNUSED | 410 with notice |
+| GET `/api/gate-policy` | none | none | UNUSED | 410 with notice |
+| GET `/api/pricing` | none | none | UNUSED | 410 with notice |
+| GET `/api/council/state` | none | none | UNUSED | 410 with notice |
+| GET `/api/council/verdicts` | none | none | UNUSED | 410 with notice |
+| GET `/api/council/convergence` | none | none | UNUSED | 410 with notice |
+| GET `/api/council/report` | none | none | UNUSED | 410 with notice |
+| POST `/api/council/force-review` | vscode-extension/media/loki-dashboard.js:496, vscode-extension/media/loki-dashboard.js:4312 | none | MISSING | 501 not yet supported |
+| GET `/api/council/transcripts` | vscode-extension/media/loki-dashboard.js:12426 | none | MISSING | 501 not yet supported |
+| GET `/api/council/transcripts/{iteration_id}` | none | none | UNUSED | 410 with notice |
+| GET `/api/context` | tests/moat/p7-no-fabricated-data.sh:4638 (test), tests/moat/p7-no-fabricated-data.sh:4745 (test), tests/moat/p7-no-fabricated-data.sh:4746 (test) (+3) | none | MISSING | 501 not yet supported |
+| GET `/api/notifications` | none | none | UNUSED | 410 with notice |
+| GET `/api/notifications/triggers` | none | none | UNUSED | 410 with notice |
+| PUT `/api/notifications/triggers` | vscode-extension/media/loki-dashboard.js:496, vscode-extension/media/loki-dashboard.js:6802 | none | MISSING | 501 not yet supported |
+| POST `/api/notifications/{notification_id}/acknowledge` | none | none | UNUSED | 410 with notice |
+| POST `/api/notifications/{notification_id}/unacknowledge` | none | none | UNUSED | 410 with notice |
+| GET `/api/checkpoints` | vscode-extension/src/views/checkpointProvider.ts:108, vscode-extension/src/views/checkpointProvider.ts:134 | none | MISSING | 501 not yet supported |
+| GET `/api/checkpoints/{checkpoint_id}` | none | none | UNUSED | 410 with notice |
+| POST `/api/checkpoints` | vscode-extension/media/loki-dashboard.js:5960 | none | MISSING | 501 not yet supported |
+| POST `/api/checkpoints/{checkpoint_id}/rollback` | vscode-extension/media/loki-dashboard.js:5960 | none | MISSING | 501 not yet supported |
+| GET `/api/agents` | none | none | UNUSED | 410 with notice |
+| POST `/api/agents/{agent_id}/kill` | vscode-extension/media/loki-dashboard.js:4312 | none | MISSING | 501 not yet supported |
+| POST `/api/agents/{agent_id}/pause` | vscode-extension/media/loki-dashboard.js:4312 | none | MISSING | 501 not yet supported |
+| POST `/api/agents/{agent_id}/resume` | vscode-extension/media/loki-dashboard.js:4312 | none | MISSING | 501 not yet supported |
+| GET `/api/logs` | none | none | UNUSED | 410 with notice |
+| POST `/api/collab/join` | none | none | UNUSED | 410 with notice |
+| POST `/api/collab/leave` | none | none | UNUSED | 410 with notice |
+| GET `/api/collab/users` | none | none | UNUSED | 410 with notice |
+| GET `/api/collab/users/{user_id}` | none | none | UNUSED | 410 with notice |
+| POST `/api/collab/users/{user_id}/heartbeat` | none | none | UNUSED | 410 with notice |
+| POST `/api/collab/users/{user_id}/cursor` | none | none | UNUSED | 410 with notice |
+| POST `/api/collab/users/{user_id}/status` | none | none | UNUSED | 410 with notice |
+| GET `/api/collab/presence` | none | none | UNUSED | 410 with notice |
+| GET `/api/collab/file/{file_path:path}` | none | none | UNUSED | 410 with notice |
+| GET `/api/collab/state` | none | none | UNUSED | 410 with notice |
+| GET `/api/collab/state/value` | none | none | UNUSED | 410 with notice |
+| POST `/api/collab/operation` | none | none | UNUSED | 410 with notice |
+| POST `/api/collab/sync` | none | none | UNUSED | 410 with notice |
+| GET `/api/collab/history` | none | none | UNUSED | 410 with notice |
+| WS `/ws/collab` | none | none | UNUSED | 410 with notice |
+| GET `/api/collab/status` | none | none | UNUSED | 410 with notice |
+| GET `/api/secrets/status` | none | none | UNUSED | 410 with notice |
+| GET `/api/github/status` | none | none | UNUSED | 410 with notice |
+| GET `/api/github/tasks` | none | none | UNUSED | 410 with notice |
+| GET `/api/github/sync-log` | none | none | UNUSED | 410 with notice |
+| GET `/api/health/processes` | none | none | UNUSED | 410 with notice |
+| GET `/metrics` | autonomy/loki:29162, tests/e2e/webapp-admin-honesty.mjs:271 (test), tests/e2e/webapp-receipt-panel.mjs:54 (test) (+2) | /v1/metrics (CPE24-P1) | PARTIAL (reads the same .loki or registry source; unmeasured values are null with a not-measured marker) | map |
+| GET `/api/checklist` | none | none | UNUSED | 410 with notice |
+| GET `/api/usage` | none | none | UNUSED | 410 with notice |
+| GET `/api/checklist/summary` | none | none | UNUSED | 410 with notice |
+| GET `/api/prd-observations` | none | none | UNUSED | 410 with notice |
+| GET `/api/checklist/waivers` | none | none | UNUSED | 410 with notice |
+| POST `/api/checklist/waivers` | vscode-extension/media/loki-dashboard.js:496 | none | MISSING | 501 not yet supported |
+| DELETE `/api/checklist/waivers/{item_id}` | vscode-extension/media/loki-dashboard.js:496 | none | MISSING | 501 not yet supported |
+| GET `/api/council/gate` | tests/moat/p7-no-fabricated-data.sh:4638 (test), tests/moat/p7-no-fabricated-data.sh:4760 (test), tests/moat/p7-no-fabricated-data.sh:4762 (test) (+1) | none | MISSING | 501 not yet supported |
+| GET `/api/app-runner/status` | none | none | UNUSED | 410 with notice |
+| GET `/api/app-runner/logs` | none | none | UNUSED | 410 with notice |
+| GET `/api/app-runner/errors` | none | none | UNUSED | 410 with notice |
+| POST `/api/control/app-restart` | vscode-extension/media/loki-dashboard.js:496 | none | MISSING | 501 not yet supported |
+| POST `/api/control/app-stop` | vscode-extension/media/loki-dashboard.js:496 | none | MISSING | 501 not yet supported |
+| GET `/api/playwright/results` | none | none | UNUSED | 410 with notice |
+| GET `/api/playwright/screenshot` | none | none | UNUSED | 410 with notice |
+| GET `/api/failures` | none | none | UNUSED | 410 with notice |
+| GET `/api/prompt-versions` | none | none | UNUSED | 410 with notice |
+| POST `/api/prompt-optimize` | autonomy/loki:17793, vscode-extension/media/loki-dashboard.js:7581 | none | MISSING | 501 not yet supported |
+| MOUNT `/assets` | none | UI static assets | EXISTS (vite output under ui/dist/assets) | none (CP UI serves it) |
+| GET `/api/activity` | vscode-extension/media/loki-dashboard.js:8596 | none | MISSING | 501 not yet supported |
+| GET `/api/session-diff` | none | none | UNUSED | 410 with notice |
+| POST `/api/activity` | none | none | UNUSED | 410 with notice |
+| GET `/favicon.svg` | none | UI static asset | EXISTS (the CP UI serves its own favicon from ui/dist) | none (CP UI serves it) |
+| GET `/cost` | none | CP UI (/) | EXISTS | 308 to CP UI |
+| GET `/trust` | none | CP UI (/) | EXISTS | 308 to CP UI |
+| GET `/` | none | CP UI (/) | EXISTS | 308 to CP UI |
+| GET `/api/quality-score` | none | none | UNUSED | 410 with notice |
+| GET `/api/quality-score/history` | none | none | UNUSED | 410 with notice |
+| POST `/api/quality-scan` | autonomy/loki:23927, vscode-extension/media/loki-dashboard.js:7832 | none | MISSING | 501 not yet supported |
+| GET `/api/quality-report` | autonomy/loki:23994 | none | MISSING | 501 not yet supported |
+| GET `/api/migration/list` | vscode-extension/media/loki-dashboard.js:8173 | none | MISSING | 501 not yet supported |
+| POST `/api/migration/start` | none | none | UNUSED | 410 with notice |
+| GET `/api/migration/{migration_id}/status` | vscode-extension/media/loki-dashboard.js:8173 | none | MISSING | 501 not yet supported |
+| GET `/api/migration/{migration_id}/plan` | none | none | UNUSED | 410 with notice |
+| GET `/api/migration/{migration_id}/features` | none | none | UNUSED | 410 with notice |
+| GET `/api/migration/{migration_id}/seams` | none | none | UNUSED | 410 with notice |
+| POST `/api/migration/{migration_id}/advance` | none | none | UNUSED | 410 with notice |
+| POST `/api/migration/{migration_id}/start-phase` | none | none | UNUSED | 410 with notice |
+| GET `/api/managed/events` | vscode-extension/media/loki-dashboard.js:11965 | none | MISSING | 501 not yet supported |
+| GET `/api/managed/status` | tests/integration/test_dashboard_api_smoke.sh:105 (test), tests/integration/test_dashboard_api_smoke.sh:106 (test), vscode-extension/media/loki-dashboard.js:11965 | none | MISSING | 501 not yet supported |
+| GET `/api/managed/memory_versions/{memory_id}` | none | none | UNUSED | 410 with notice |
+| GET `/api/findings/{iteration}` | none | none | UNUSED | 410 with notice |
+| GET `/api/quality/architecture` | none | none | UNUSED | 410 with notice |
+| GET `/api/learnings` | tests/e2e/dashboard-evidence-panels.mjs:72 (test) | none | MISSING | 501 not yet supported |
+| GET `/api/escalations` | vscode-extension/media/loki-dashboard.js:12356 | none | MISSING | 501 not yet supported |
+| GET `/api/escalations/{filename}` | none | none | UNUSED | 410 with notice |
+| GET `/api/phases` | none | none | UNUSED | 410 with notice |
+| GET `/api/proofs` | tests/e2e/dashboard-evidence-panels.mjs:71 (test), tests/e2e/webapp-receipt-panel.mjs:75 (test), tests/e2e/webapp-receipt-panel.mjs:84 (test) | none | MISSING | 501 not yet supported |
+| GET `/api/proofs/summary` | tests/e2e/webapp-receipt-panel.mjs:76 (test) | none | MISSING | 501 not yet supported |
+| GET `/api/proofs/{run_id}` | tests/moat/p2-honest-verdict.sh:1251 (test) | none | MISSING | 501 not yet supported |
+| GET `/api/proofs/{run_id}/html` | none | none | UNUSED | 410 with notice |
+| GET `/api/spec` | none | none | UNUSED | 410 with notice |
+| GET `/api/spec/history` | none | none | UNUSED | 410 with notice |
+| GET `/api/wiki` | none | none | UNUSED | 410 with notice |
+| GET `/api/wiki/{section}` | none | none | UNUSED | 410 with notice |
+| POST `/api/wiki/ask` | vscode-extension/media/loki-dashboard.js:12595 | none | MISSING | 501 not yet supported |
+| GET `/{full_path:path}` | none | SPA fallback | EXISTS (CP app.get("*") serves the SPA and 404s missing assets) | none (CP UI serves it) |
+
+### 5.3 Notes for the deletion gate
+
+- Test consumers that block deleting the legacy routes (they run the Python app in process, so they need the routes or a rewrite): tests/moat/p2-honest-verdict.sh (GET /api/proofs/{run_id}, GET /api/v2/audit/verify) and tests/moat/p7-no-fabricated-data.sh (/api/status, /api/projects, /api/cost, /api/budget, /api/cost/timeline, /api/fleet/runs, /api/fleet/summary, /api/context, /api/memory/economics, /api/learning/metrics, /api/council/gate, /metrics). tests/e2e/dashboard-evidence-panels.mjs and webapp-receipt-panel.mjs read /api/proofs, /api/proofs/summary, /api/learnings, /api/budget. None of these may be weakened or added to tests/moat/pending.txt; CPE-24 must port the property each one proves before the route goes.
+- Corrections to the inventory hints: tests/moat/p5-sovereignty.sh does not call /api/enterprise/status or /api/enterprise/tokens (it runs `loki start`, matched by the text `/start`); autonomy/loki does not call /api/control/start or /api/control/stop on the dashboard; the VS Code extension requests `/status`, which the legacy server never served (its catch-all answered HTML), so it is not a row.
+- /api/memory/* and /api/learning/* are consumed by the VS Code memory view (src/views/memoryViewProvider.ts, dashboardWebview.ts) and the bundled webview, and p7 reads /api/memory/economics and /api/learning/metrics, so those that appear USED above are not deletable on the UI alone.
+- /health: the CP /health identity ({service: "loki-control"}) is relied on by CLI discovery. Callers that probe the legacy /health body at port 57374 (autonomy/loki, autonomy/run.sh, web-app) need either a migrated probe or a separate listener; the shim does not add one.
+
 ## 6. STEP 2 slice plan
 
 Rules: one writer per file; UI pages register through ui/src/pages/registry.ts and server routes through src/server/routes/index.ts, both CREATED with stubs for every planned page and route by CPE-02 and CPE-03, so later slices only fill their own stub files. Wall checks run from packages/control-plane. HIGH = opus D12 review.
@@ -251,7 +512,7 @@ Rules: one writer per file; UI pages register through ui/src/pages/registry.ts a
 | CPE-06 | Run thread view: stage messages, live log, diff, evidence, receipt, NOT PROVEN, cost, PR, BLOCKED reply prompt, Details drawer; replaces Live.tsx | ui/src/pages/run/**, ui/src/Live.tsx (delete), test/ui/run.test.tsx | `bun test test/ui/run.test.tsx` (fixture run renders every section; missing cost shows "not measured") | 02, 04, 05 | MEDIUM |
 | CPE-07 | Start-run endpoint POST /v1/runs | src/server/routes/start.ts, src/server/spawn.ts, test/server/start.test.ts | `bun test test/server/start.test.ts` (unknown repo, shell metacharacters, unknown flag, missing token, bad Origin all refused; argv exact) | 03 | HIGH |
 | CPE-08 | New run composer: one input, chips, Cmd+Enter, optimistic session row, empty state | ui/src/pages/compose/**, test/ui/compose.test.tsx | `bun test test/ui/compose.test.tsx` | 02, 07 | MEDIUM |
-| CPE-09 | Run control: supervisor writes <run>/run.pid (pid, start time, argv); stop, retry, resume endpoints | loki-ts/src/engine10/run_pid.ts, loki-ts/src/engine10/supervisor.ts, src/server/routes/control.ts, test/server/control.test.ts, loki-ts/tests/engine10/run_pid.test.ts | `bun test test/server/control.test.ts` and `cd loki-ts && bun test tests/engine10/run_pid.test.ts` (stale pid, reused pid, other run's pid refused) | 03 | HIGH |
+| CPE-09 | Run control: supervisor writes <run>/run.pid (pid, start time, argv); stop, retry, resume endpoints | loki-ts/src/util/run_pid.ts, loki-ts/src/engine10/supervisor.ts, src/server/routes/control.ts, test/server/control.test.ts, loki-ts/tests/engine10/run_pid.test.ts | `bun test test/server/control.test.ts` and `cd loki-ts && bun test tests/engine10/run_pid.test.ts` (stale pid, reused pid, other run's pid refused) | 03 | HIGH |
 | CPE-10 | Run control UI: Stop (confirm), Retry, Resume with optimistic state and rollback | ui/src/pages/run-controls/** (mounted in the run header slot CPE-06 provides), test/ui/controls.test.tsx | `bun test test/ui/controls.test.tsx` | 06, 09 | LOW |
 | CPE-11 | Runs table page with filters and group rollup | ui/src/pages/runs/**, test/ui/runs.test.tsx | `bun test test/ui/runs.test.tsx` | 02 | LOW |
 | CPE-12 | Home: /v1/stats plus KPI tiles, recent runs, BLOCKED inbox | src/server/routes/stats.ts, ui/src/pages/home/**, test/server/stats.test.ts, test/ui/home.test.tsx | `bun test test/server/stats.test.ts test/ui/home.test.tsx` (numbers equal a hand-folded fixture) | 02, 03 | MEDIUM |

package/docs/v10/DECISIONS.md

@@ -673,3 +673,44 @@ Source: the founder's words, relayed by the peer session (autonomi-dev-76) at 14
 1. 10.7.0 ships the LOKI_SPEED default flip with the D82-FIXREDS fix. D82-WALL0 is reverted for 10.7.0 because it fails the engine e2e done run (the stub writes no Wall file, so the run seals FAILED); it returns in 10.7.1 with the e2e stub writing a Wall check.
 2. The quiet-mode LiveLine moves from engine10/output.ts to e10ext/liveline.ts: it is presentation, and core was 5026 lines against the D29 5,000 cap. The cap is unchanged.
 3. Control Plane settings API (CPE-14): shell command fields (workspaces.*.integration.command, workspaces.*.repos[].setup) are read-only over HTTP and return 422; they are edited in loki.yaml directly. A browser must never be able to plant a command the engine later runs.
+
+## D85 (2026-10-03 16:30Z, CoS per D68/D69): train/102 reds fixed in place, not dropped
+1. train/102 Tests failed on registration and pin defects only: acp missing from help and completions, merge missing from zsh completion, `loki web --port` skipping the port validator after CP-LEGACY, a ProcessEnv type lost in CP-INGEST watch.ts, and the E-123 gitleaks baseline count after the reviewed Sentry fixture fingerprint.
+2. Dropping ACP, merge, CP-LEGACY and CP-INGEST would remove four headline 10.7.0 features and needs four reverts plus a dist rebuild, which is slower and riskier than five one-line registration fixes. The peer's "drop, do not fix forward" rule targets behaviour regressions; these are wiring gaps. Fixed in d9704dfc4 and every failing suite was rerun locally green before train/103.
+3. `loki web` routes to the Control Plane only in its bare form (optionally --no-open); any other flag reaches the classic validator.
+
+## D86 (2026-10-03 17:00Z, founder via the steering session, CoS records): Engine Laws are the engine constitution
+1. Merges the steering session's earlier "D76" message (harness never worse than raw) with its later "ENGINE LAWS" directive. The label clashed with our D76, so both are recorded here under one number.
+2. Trigger: FireLater#17. Plain claude took about 2 min; Loki took 11 min and $2.66 and ended in a FAILED draft. Root causes are classes, not one-offs:
+   - testmap runs fixed commands from repoDir;
+   - scope.ts reverts edits on keyword overlap;
+   - sizing.ts cascade pins implement to sonnet;
+   - verify has no ERROR versus FAIL split;
+   - pr_body prints "not recorded" over real data;
+   - there is no terminal-state invariant across sinks.
+3. docs/v10/ENGINE-LAWS.md (L1 to L7) is binding for every stage, present and future:
+   - L1 never below raw;
+   - L2 fail closed on trust, fail open on work;
+   - L3 the authority ladder;
+   - L4 the Project Model;
+   - L5 every failure has an owner;
+   - L6 every run terminates everywhere;
+   - L7 outputs are contracts.
+4. Steering rule, added to OPERATING-MODEL.md: no bug becomes a fix slice until it has a row in docs/v10/FAILURE-CLASSES.md. Each row answers what the user saw against raw, the law broken, a sibling sweep, the one shared mechanism, and a regression fixture. Reviewers reject stage-only patches when siblings exist.
+5. Sequencing:
+   - Wave 0 ships in 10.7.1, with five builders in flight plus a cascade-off builder and a PR-body golden builder:
+     - scope becomes advisory;
+     - the cascade is off and escalation goes up only;
+     - a load error or zero tests collected becomes harness ERROR, with no fix rounds and a ready PR;
+     - a golden PR body;
+     - run.completed ingest plus a reconciler.
+   - Waves 1 and 2 go to the next train. Wave 1 covers the Project Model, the result classifier, the authority ladder in seal, a lifecycle e2e and static checks. Wave 2 covers the Repo Shape Matrix and the Parity Gate against raw `claude -p`, gating latest.
+   - An opus Architect is checking the plan against the code and slicing it into EL-W0/W1/W2 rows.
+6. Acceptance: a FireLater#17 rerun ends VERIFIED with a ready PR, the route edits kept, within raw plus 30s and at most 1.2x raw cost. The real-model legs stay parked until the founder provides keys (FOUNDER-QUEUE 15/16). The parity leg runs once keys exist; until then, recorded replays gate.
+
+## D87 (2026-10-03 19:00Z, founder via the steering session, CoS records): parallel lanes today, usage stop raised to 95%
+1. For today this supersedes the one-lane governor, the 81% weekly stop and the 85% floor. Up to 4 sonnet builders run in separate worktrees, and opus D12 reviews only HIGH slices.
+2. Hard stop: no new dispatch at 95% of the weekly limit. The last 5% is reserved for releases, smoke checks and steering, because 100% stops everything, this session included, until Oct 7 12:59 ET.
+3. Never hold completed work. Every green slice ships on the next train, and nobody pushes during a running release.
+4. Usage readings are logged hourly in usage-readings.tsv from direct /usage readings. The pulse weekly projection is not used as a governor input while it reads 450%+.
+5. Order: 10.7.1, then 10.8.0 (UI, CPE-24 if green, else 10.8.1), then MW-1 to MW-3, which replace mods M0 to M3 per the research in autonomi-dev/research/2026-10-03-claude-mods, then EL-W1.