loki-mode 10.7.0 → 10.8.0

package/docs/v10/ENGINE-LAWS.md

@@ -0,0 +1,155 @@
+<!-- Engine constitution. Source: founder plan 2026-10-03 (autonomi-dev research/2026-10-03-engine-laws/PLAN.md), adopted as D86. -->
+
+# Engine Laws: from one-off fixes to an enterprise-grade engine
+
+Founder directive, 2026-10-03: "Use all intelligence in any session from the model and provider as needed, so our issues in Loki Mode won't impact users. Plan and ultrathink to make it enterprise grade. Not just one-offs: every issue and learning should be thought about at 100k feet."
+
+## 1. The trigger and the diagnosis
+
+On FireLater#17, plain Claude Code fixed the issue and opened a good PR in about 2 minutes. Loki 10.6.14 took 11 minutes and $2.66, ended STALLED and opened a FAILED draft PR (#25). Six defects showed up in that one run. Read from the code, they come from four root classes. None of them is specific to FireLater.
+
+| Symptom on FireLater#17 | Code root | Root class |
+|---|---|---|
+| Verify "Failed Suites 1" three times; the code passed 43/43 from backend/ | testmap.ts: fixed `npx vitest run <files>` strings, always run from repoDir | A. The harness assumes a repo shape instead of learning it |
+| "visual evidence skipped: no package.json" | root-only package.json probe | A |
+| Two fix rounds plus STALLED spent on a non-bug | verify does not separate "runner could not load" from "test failed"; fix.ts treats every vitest signature as a test failure | B. Failures are not attributed to an owner (code, env, harness, provider) |
+| Route edits the issue required were reverted | e10ext/scope.ts: keyword overlap of plan and task text decides "unrelated", then `git restore` | C. A heuristic holds destructive authority |
+| Implement ran below the user's raw intelligence | sizing.ts: cascadeImplementModel = wallModel = sonnet by default; implement brief and limitS 480 replace the agent's own exploration | D. Loki silently gives the user less intelligence than raw |
+| PR body: "not recorded" for issue, why, scope and tests | pr_body.ts output not checked against real run data | E. Output contracts are untested on real runs |
+| Control Plane stuck "in progress" after completion | no guarantee that every sink reaches a terminal state | F. No run-lifecycle invariant |
+
+Each class has a law. Each law has one mechanism, plus one enforcement check that fails CI if the law is broken anywhere, not only in the stage the bug report named.
+
+## 2. The Engine Laws (constitution for every stage, present and future)
+
+### L0. The model decides, the harness proves (above L1 to L7; founder directive 2026-10-03, permanent)
+- The model owns all knowledge and judgment about the user's repo and task: layout and package roots, the runner, command and cwd, whether there is a UI and how to boot it, files in scope, impacted tests, task size, failure ownership, and what the issue asks.
+- The harness owns only mechanism: running what the model proposed and recording cwd, exit code, output and counts; sandboxing, budgets and process control; signing, receipts and integrity; terminal I/O; deterministic tamper checks, because the model never grades its own work.
+- When execution contradicts the model, the output goes back to the model once. The verdict comes from execution evidence plus a separate reviewer call, never from the author.
+- Review rule: reject any change that adds an `if` or a regex about the user's repo shape, language, framework or task wording. The fix is a prompt or schema change plus an execution check. Hardcoded tables are deleted once the model path is green on the Repo Shape Matrix. Slices: docs/v10/L0-WAVE1.md.
+
+### L1. Never below raw
+A Loki run never gives the user less intelligence, a worse result or a meaningfully slower one than the same provider run raw.
+- The default implement model and effort are the provider's best default for the user's account (what bare `claude` would use), or higher. Cheap models are only for mechanical sub-steps (repo map summaries, PR body prose, docs).
+- Any downgrade (model, effort, context, time limit) is printed on the start line and recorded in the receipt. Nothing is silently reduced.
+- Escalation goes UP: a repeated code failure escalates to the strongest model and effort the provider offers, with the full failure output and the agent's own diagnosis. This happens before STALLED, for every provider.
+- Enforcement: the Parity Gate (section 4) blocks promotion to `latest` when Loki is below raw on the corpus.
+
+### L2. Fail closed on trust, fail open on work
+- Trust surfaces fail CLOSED and may block: signing, receipt integrity, secrets, sandbox and permission boundaries, policy the user configured, and tests or CI config being deleted or weakened.
+- Work surfaces fail OPEN: scope, the Wall, impacted-test selection, sizing, visual evidence, repo detection. A harness heuristic that is unsure keeps the agent's work, annotates it, and lowers the claim (NOT PROVEN). It never reverts, stalls or drafts.
+- Enforcement: a static test lists every code path that calls `git restore`, `git checkout --`, `git reset` or file deletion on user files, or sets outcome STALLED, FAILED or draft. Each one must be classified trust or work, and work paths may not do it. A new destructive call fails CI until it is classified.
+
+### L3. Evidence outranks heuristics (authority ladder)
+1. Executed evidence: a command Loki ran, with its output, cwd and exit code.
+2. The agent's executed evidence: commands the agent ran in its session, taken from the transcript or tool log.
+3. Model judgment: the agent or a reviewer.
+4. Deterministic heuristics: keyword scope, sizing, repo-map overlap.
+
+A lower rung may never override a higher one. A keyword heuristic cannot revert what a passing test run supports. A Loki check that ERRORED (not failed) yields to the agent's successful run of the same suite.
+
+### L4. Know the repo before judging it (Project Model)
+At intake, one model discovery session reads the repo like a senior engineer and returns a schema-checked Project Model that cites the files behind each answer (L0). Every stage consumes it. No stage may re-derive repo shape on its own, and no harness table or probe is authoritative; the items below are what the model reads, not code the harness runs.
+- Packages: every package root (package.json, pyproject, go.mod, Cargo.toml, pom or gradle, composer, Gemfile), its runner, and its exact test, lint, build and start commands.
+- Workspace kind: single, npm/pnpm/yarn workspaces, turbo, nx, multi-root with no root manifest (FireLater), polyglot.
+- Sources of truth, in order:
+  1. loki.yaml overrides;
+  2. AGENTS.md, CLAUDE.md, CONTRIBUTING and README test instructions;
+  3. CI workflow files (.github/workflows: how the project's own CI actually runs tests);
+  4. manifests and config files;
+  5. conventions.
+- Self-calibration: run each package's test command once as a baseline (this is also the Wall base run). If the runner fails to LOAD (0 tests collected, config not found, module resolution error), ask the agent once, cheaply: "how are tests run in this package?". Store the answer, rerun, and cache it per repo in .loki/project.json, keyed by manifest hashes. Users can edit it.
+- Every command records its cwd. A test path is resolved to its nearest package root and made relative to it.
+- Enforcement: no stage may spawn a test, lint or build command except through the Project Model API (a grep check in CI).
+
+### L5. Every failure has an owner
+Every check result is one of PASS, FAIL, ERROR or SKIP, with an owner: code, env, harness or provider.
+- Only FAIL owned by code drives fix rounds and counts toward STALLED.
+- ERROR owned by harness or env triggers one self-repair (recalibrate the Project Model). If that does not fix it, the check is NOT PROVEN with a plain reason ("test runner could not load in backend/: <first error line>"). No paid fix rounds.
+- ERROR owned by provider (billing, quota, auth, overload) goes to the existing fatal classifier.
+- The receipt and PR list every NOT PROVEN item with its owner, so a user can tell "your code is broken" from "Loki could not check".
+- Enforcement: a fixture set of runner outputs (load error, 0 collected, missing config, real assertion failure, timeout, OOM) for vitest, jest, node:test, pytest, go and cargo. The classifier must label each correctly.
+
+### L6. Every run terminates everywhere
+Every sink reaches the same terminal state: events, receipt, PR, Control Plane, Slack and the CLI summary.
+- The supervisor writes run.completed on every exit path, including crash and kill (signal handlers, plus a sweeper for dead PIDs).
+- Control Plane ingest is idempotent and reconciles: a run with no live worker PID and no terminal event becomes ABORTED (with a reason) after a grace period.
+- Enforcement: an e2e test kills a run at each stage and asserts terminal state in every sink.
+
+### L7. Outputs are contracts
+The PR body, receipt, `--json` envelope and CLI summary have schemas. "not recorded" when the data exists is a test failure.
+- Golden tests are built from real recorded runs (FireLater#17 included), not hand-made stubs.
+
+## 3. The learning system (how every future issue is handled at 100k feet)
+
+No bug becomes a fix slice until the CoS has written its row in docs/v10/FAILURE-CLASSES.md, answering five questions:
+
+1. What did the user see, and how does it compare with raw provider output on the same task?
+2. Which law did it break (L1 to L7)? If none fits, propose a new law. That is a founder-level decision; record it in DECISIONS.
+3. Sibling sweep: which other stages, commands or providers share the same assumption? Grep and list them. The fix covers all of them, at the shared layer.
+4. Mechanism: the one shared place the fix lives (Project Model, the result classifier, the authority ladder, the lifecycle reconciler, the output schema).
+5. Regression: the corpus fixture or real-run golden that would have caught it, added in the same PR.
+
+A one-off patch that answers question 4 with "this stage only" when siblings exist is rejected in review.
+
+## 4. Proof: the Parity Gate and the Repo Shape Matrix
+
+- Repo Shape Matrix (the corpus). At least one real public repo or faithful fixture per shape:
+  - single npm;
+  - npm, pnpm and yarn workspaces;
+  - turbo;
+  - nx;
+  - multi-root with no root manifest (FireLater);
+  - python with uv, poetry and plain pip;
+  - go multi-module;
+  - rust workspace;
+  - java gradle and maven;
+  - polyglot (TS frontend plus Python backend).
+
+  Each shape has one small, one medium and one cross-cutting issue (FireLater#17 is the cross-cutting monorepo case).
+- Parity Gate (extends the D49 first-run gate for `latest` promotion). Loki is compared with raw `claude -p` on the same issues, with hidden tests judging correctness.
+  - Correctness: Loki is at least raw on every shape.
+  - Time: small tasks within raw + 30s; medium and large tasks within raw x 1.3.
+  - Cost: at most raw x 1.2, unless the user turned on deeper checks.
+  - Zero harness-owned FAILED or STALLED outcomes.
+  - Results go to METRICS.md. A regression blocks `latest`; `next` keeps shipping.
+- Field signal, which stays free and private: `loki report <run-id>` builds a redacted bundle the user can attach to an issue. Nothing is sent automatically.
+
+## 5. Enterprise posture (what a platform team needs before adopting)
+
+- Predictability: published SLOs, the Parity Gate numbers per release, and the same result on the same input (models are pinned and recorded in the receipt).
+- Explainability: every outcome has one plain sentence of cause and an owner. Nothing is "not recorded".
+- Policy without friction: loki.yaml `scope: advisory|enforce`, where advisory is the default and enforce is opt-in for regulated repos. Enforce runs on the Project Model and the contract, never on keywords alone, and its reverts are listed with a one-command restore.
+- Audit: the receipt carries the Project Model hash, the commands with their cwd, the owner attribution and any model or effort changes.
+- No silent degradation, anywhere.
+
+## 6. Implementation order (delete first, then build the shared layer)
+
+Wave 0, same day. Flips and deletions, each small:
+1. The scope default becomes advisory: annotate, never revert (L2). Keep enforce behind loki.yaml.
+2. Cascade default off: implement runs on the provider's best default model and effort (L1). Fix-round escalation goes up to the strongest model.
+3. A load-error or 0-collected verify result is ERROR with owner harness. It never feeds fix rounds or STALLED (L5, minimal form).
+4. PR body fields come from intake, plan, diff and evidence, with a golden test from the FireLater#17 recording (L7).
+5. Control Plane: ingest run.completed, plus a dead-PID reconciler (L6, minimal form).
+
+Wave 1. Shared layers, built in parallel by sonnet builders with opus review for anything touching trust:
+6. Project Model module (L4) with AGENTS.md, CLAUDE.md and CI-workflow parsing, a baseline calibration run and the .loki/project.json cache. Testmap, verify, the Wall, visual evidence, the first-run gate and deep all consume it.
+7. Result classifier with owner attribution, plus the runner fixture set (L5).
+8. Authority ladder in seal: the agent's own passing test commands count as evidence when Loki's check errored (L3).
+9. Lifecycle invariant across all sinks, plus the kill-at-each-stage e2e (L6).
+10. The static checks from L2 and L4.
+
+Wave 2. Proof:
+11. The Repo Shape Matrix corpus and the Parity Gate wired into promotion to `latest`.
+12. FAILURE-CLASSES.md seeded with the FireLater#17 rows and every past class from MEDIUM-ANALYSIS.md.
+
+## 7. Acceptance
+
+- FireLater#17 rerun on the new build:
+  - VERIFIED, with a ready (not draft) PR;
+  - the route edits kept;
+  - visual evidence found in backend/ or frontend/;
+  - time within raw + 30s and cost at most raw x 1.2.
+- The Parity Gate is green on the matrix, and the table is published in METRICS.md.
+- Every law has its enforcement check in CI.
+- The CoS steering rule (section 3) is written into OPERATING-MODEL.md, and new bug reports follow it.

package/docs/v10/FAILURE-CLASSES.md

@@ -0,0 +1,166 @@
+# Failure classes (D86)
+
+Each row answers five things:
+- what the user saw, compared with raw;
+- the law broken (docs/v10/ENGINE-LAWS.md);
+- a sibling sweep;
+- the one shared mechanism;
+- a regression fixture.
+
+No fix slice starts until its row exists (OPERATING-MODEL.md, Engine Laws line). Slice ids refer to the EL plan (Architect, 2026-10-03).
+
+L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the user's repo shape, language, framework or task wording is rejected. The mechanism column names a model judgment (a prompt or schema) plus an execution check. Tamper checks, terminal I/O and Loki's own files are the only exceptions. Wave 1 slices: docs/v10/L0-WAVE1.md.
+
+## FC-01 Verify ran from the repo root in a multi-root monorepo (FireLater#17)
+- User saw: "Failed Suites 1" three times on backend/tests/unit/validation.test.ts. Raw claude ran the suite from backend/ and passed 43/43 in about 2 min.
+- Law: L4.
+- Siblings:
+  - verify.ts:50/142;
+  - verify.ts:179 subtractBase;
+  - wall.ts:83 base run;
+  - verify.ts:224 tsconfig only at the root;
+  - visual_evidence.ts:155-168;
+  - deep.ts;
+  - the brief's impacted commands;
+  - deferred by the FC-01 stopgap (de12ad0cb): deep.ts:84 full suite at the repo root, verify.ts:228 tsconfig root-only, verify.ts:231 ESLINT_CONFIGS root-only.
+- Mechanism: Project Model packageRootOf/commandFor (EL-W1-01, EL-W1-04a/b). Interim: EL-W0-03.
+- Fixture: tests/fixtures/firelater-17 plus the shape fixtures in benchmarks/tasks/shapes.
+
+## FC-02 A runner load error was treated as a code failure; two fix rounds, then STALLED
+- User saw: 11 min, $2.66 and a FAILED draft PR for a bug that did not exist. Raw: done in 2 min.
+- Law: L5 (and L1 on time and cost).
+- Siblings:
+  - verify.ts:141-148 (a null summary counts as fail);
+  - fix.ts:12-13;
+  - machine.ts:171 stall;
+  - wall.ts classify(), which already separates not_run (reuse it);
+  - deep.ts;
+  - vitest "No test files found, exiting with code 0" counts as a pass with n=0, when it should be not_run (EL-W1-06).
+- Mechanism: a result classifier with an owner (EL-W1-05). Only a FAIL owned by code drives fix and stall. Interim: EL-W0-02.
+- Fixture: tests/fixtures/runner-outputs/vitest/load-error.txt (from seq 56), plus siblings for each runner.
+- Sibling (2026-10-03): a change-introduced load error is a code fault. Base reproduction is necessary but not sufficient. The base rerun must be hermetic (an inherited editable install imports head code), and a check the task targets is never env-owned (7ad4a18b6, blocked in round 2). Superseded by L0-WAVE1 EL-W1-06: the harness gathers evidence and a separate reviewer call assigns the owner.
+
+## FC-03 Scope control reverted in-scope route edits
+- User saw: the PR without the fix (routes/applications.ts, assets.ts and attachments.ts reverted).
+- Law: L2 (the work surface held destructive authority) and L3 (a heuristic beat executed evidence).
+- Siblings:
+  - scope.ts:30;
+  - unit_mode unitFence;
+  - discard.ts;
+  - commit_filter dropSet;
+  - implement restoreReadOnly (trust: Wall tests, stays);
+  - stop_restore.ts.
+- Mechanism: the destructive-call registry (EL-W1-08) plus advisory scope (EL-W0-01, shipped as d574c85c5 and a089aa9ab). Enforce as an opt-in comes back in EL-W1-10.
+- Fixture: replay of the FireLater diff. Every route file is kept, and NOT PROVEN lists them.
+
+## FC-04 Loki gave less intelligence than raw
+- User saw: every session on sonnet, a 124s Wall that sealed zero tests, and fix rounds that never escalated.
+- Law: L1.
+- Siblings:
+  - session.ts:27 defaults to sonnet;
+  - sizing.ts:57/63/65 cascade;
+  - fix.ts:63 escalation gate;
+  - implement.ts:56 limit;
+  - the plan stage on the "fast" tier;
+  - no effort field in SessionRunOptions.
+- Mechanism: a catalog best_default plus a top tier for each provider (EL-W0-06, EL-W0-07), and a size gate on the artifact (EL-W0-05).
+- Fixture: a unit test that the default run.started.model equals the catalog best_default, plus a parity replay row.
+
+## FC-05 PR body printed "not recorded" for data the run had
+- User saw: "What the issue asked", "Why", "Files in scope" and "Tests" all empty.
+- Law: L7.
+- Siblings:
+  - supervisor.ts:354 passes only seal;
+  - receipt wall_s is 387s against about 654s of stages;
+  - the issue comment body;
+  - the Slack summary;
+  - the --json envelope.
+- Mechanism: outputsFromEvents (EL-W0-08) plus output schemas (EL-W1-09).
+- Fixture: a golden from ~/git/FireLater/.loki/runs/e10-20261003T150744Z-59b1.
+
+## FC-06 Control Plane showed "in progress" 5857s after run.completed
+- User saw: a run shown as live after it had ended.
+- Law: L6.
+- Siblings:
+  - ship_hook.ts:27, an unref'd timer with no final flush;
+  - supervisor.ts:155, a signal exit with no terminal event;
+  - Slack finished;
+  - LiveLine.
+- Mechanism: a flush on terminal events plus a dead-pid reconciler (EL-W0-04, EL-W0-09, EL-W1-07).
+- Fixture: tests/test-e10-kill-each-stage.sh plus a CP ingest test with a dead pid.
+
+## FC-07 The test suite leaked fixture runs into the founder's real Control Plane
+- User saw: acme/widget and e10-t1.. runs in the real CP.
+- Law: none of L1 to L7 fits. Proposed L8, "Tests never touch real user state", is a founder decision. This is a recurrence of GUARDS.md 12 (~/.gitconfig).
+- Siblings:
+  - discover.ts reads instance.json via $HOME;
+  - the control.db path (control.ts:46);
+  - ~/.loki keys;
+  - the Slack webhook config;
+  - the memory store.
+- Mechanism: a hermetic HOME prelude for every test (extend tests/lib/isolated-git-home.sh), plus a shipper that refuses temp and fixture repos. Cleanup: `loki control prune` (203d38544).
+- Fixture: a lint that fails any test reaching $HOME/.loki without the prelude.
+
+## FC-08 A tampered receipt could render as VERIFIED in the UI
+- User saw: a VERIFIED badge on a run whose log failed integrity.
+- Law: L2 (trust fails closed) and L7.
+- Siblings:
+  - the CP run list and run page;
+  - the Slack summary;
+  - the PR status;
+  - `loki status`.
+- Mechanism: one verdict-display function that returns TAMPERED whenever the run is tampered or its seal is invalid (CPE-27).
+- Fixture: an ingested run with tamper.detected never shows VERIFIED in any surface.
+- Sibling follow-up (EL-FC08b): redact at source in the engine before hashing. Today the shipper (redactEvent) and the server (redactSecrets) rewrite event data before the CP can hash it, so an honest signed run holding a token reads UNVERIFIED ("log redacted before ingest; seal not checkable"), never TAMPERED and never VERIFIED. Redacting before the engine hashes and signs would make such runs checkable end to end.
+- Sibling follow-up (deferred, not built in EL-FC08b): the shipper should send the sha256 of each line before redaction (alongside the redacted line). The CP could then check the seal over the original hashes and tell a genuine redaction from a downgrade (a FAILED log edited to PARTIAL plus a planted [REDACTED]); today such a log can only read "<verdict> (unattested)" or UNVERIFIED. This is the lasting fix for placeholder downgrades.
+- Sibling follow-up: the Slack summary, PR status and `loki status` do not yet read the CP effective_verdict.
+
+## FC-09 A test-config edit outside scope can make broken code VERIFIED
+- User saw: nothing yet (reproduced by the D12 scope review with a stub provider). The agent broke `add`, edited bunfig.toml to preload a new setup.ts that mocks the module, and the verdict was VERIFIED. This happens at ffb58278b and at HEAD.
+- Law: L2 (trust fails closed).
+- Siblings:
+  - CFG_ALWAYS in verify.ts (A-115) leaves out bunfig.toml;
+  - new preload or setup files are never flagged (only edits to existing tests are);
+  - the equivalents for other runners: vitest.config setupFiles, jest setupFiles and moduleNameMapper, pytest conftest.py, and go test flags in Makefiles.
+- Mechanism: one runner-config registry for each runner. Any added or changed file that it names (configs, preloads, setup files, conftest) caps the verdict below VERIFIED, with NOT PROVEN naming the file.
+- Fixture: a stub-provider repro for each runner (bun preload, vitest setupFiles, jest moduleNameMapper, pytest conftest).
+
+## FC-11 Repo-wide structural guards went red after slices passed narrowed reviews
+- User saw: nothing yet; the 10.7.1 train was blocked on main 51e02b229 (2 failures in the full loki-ts bun test).
+- Law: L7 (the release is a contract), and the D44 gate.
+- Siblings:
+  - spawn_env_guard (e10ext/ship_hook.ts:10 missing env);
+  - the e10ext line budget (1509 of 1500), plus budgets that add up across slices (FC-10 +1, EL-W0-06 moved helpers to stay under the 5000 engine10 cap);
+  - local-ci fast tier timing out at 600s while bun test alone takes about 434s.
+- Mechanism: every builder and reviewer brief names the structural guard set, and the full bun test runs in main after each merge batch, before the train.
+- Fixture: tests/engine10/budget.test.ts and tests/runner/spawn_env_guard.test.ts on the merged tree.
+
+## FC-12 loki-ts bundles sibling-package code whose dependencies CI never installs
+- User saw: nothing yet; Bun Parity on train/104 (17ece536b) failed with `Could not resolve: "drizzle-orm/bun-sqlite"`. `loki control prune` (2c81d9603, 203d38544) imports packages/control-plane/src/db/migrate.ts, and Bun resolves a bare import from the importing file's directory, not from loki-ts/node_modules. The main checkout built cleanly only because packages/control-plane/node_modules happened to exist.
+- Law: L7 (the release is a contract: the build must reproduce from a clean checkout).
+- Siblings:
+  - every workflow that runs `bun install` in loki-ts (test.yml, bun-parity.yml, coverage.yml, tier-a.yml, security-audit.yml, release.yml including its Docker `--production` job, nightly, parity-drift and mutation-testing);
+  - the shipper imports in e10ext/ship_hook.ts and commands/control.ts, which have no external deps today but share the same path.
+- Mechanism: one `postinstall` in loki-ts/package.json installs packages/control-plane from its frozen lockfile, so every loki-ts install (CI, Docker, local) gets the sibling's deps. No per-workflow steps.
+- Fixture: a clean `git worktree add` at HEAD, then `bun install --frozen-lockfile && bun run build` in loki-ts, and again with `--production`. Both exit 0 and the dist is byte-identical to the committed one; without the postinstall the build exits 1 with the error above.
+
+## FC-13 Tests pin a data value that a correct change is allowed to move
+- User saw: nothing; the full loki-ts bun test on merged main ca9b85b7f had 5 red in "budget: cache token pricing" after MW-1 correctly moved sonnet from 3/15/0.3/3.75 to 2/10/0.2/2.5. The expected totals (0.6617, 3.0) and tiers were literals, so the price change read as a cost bug. The MW-1 review was approved on the slice's own suites, without the full bun test (an FC-11 sibling).
+- Law: L7 (the release is a contract); a guard must fail on wrong behavior, not on a legitimate data change.
+- Siblings:
+  - tests/dashboard/test_api_cost_cache.py stubs its own table, so it stays consistent, but its docstring says the other routes return 0.6617, which is stale (cosmetic);
+  - tests/test-pricing-parity.sh (MW-1) compares routes against model-pricing.json, the correct shape;
+  - the codex and gpt rows drift between run.sh and budget.ts (rv-mw1 follow-up), which is the same file-is-the-source rule.
+- Mechanism: arithmetic tests derive expectations from the single pricing source (loki-ts/data/model-pricing.json) and assert the loaded table equals the file; only the fixture token counts are literal. Pricing-table changes run the full bun test in main before the train (FC-11 mechanism).
+- Fixture: loki-ts/test/budget_cache_pricing.test.ts at 0de0838e1, 8 pass 0 fail; "cache tiers survive loading" compares the loaded PRICING with the file (loader mutation not yet run; follow-up).
+
+## FC-14 A nested sandbox trusts an inherited pointer to the real environment
+- User saw: running the test runner truncated the founder real ~/.loki/keys/receipt-ed25519.pem. A fixture wrote through an inherited LOKI_REAL_HOME that still named the real home while HOME was a stand-in.
+- Law: L2 (trust fails closed).
+- Siblings:
+  - loki_hermetic_home_enter (tests/lib/hermetic-home.sh) took LOKI_REAL_HOME from the environment;
+  - loki-ts/tests/preload.ts used LOKI_REAL_HOME ?? HOME;
+  - run_runner in tests/test-e154-e155-guards.sh kept the exported LOKI_REAL_HOME;
+  - the outer E-154 key check compared names only, so truncating an existing key was invisible.
+- Mechanism: derive the real path from the current HOME, never from an inherited variable (enter unsets LOKI_REAL_HOME, preload reads HOME); the key check fingerprints name, size and mtime.
+- Fixture: tests/test-e154-e155-guards.sh (run_runner strips the pointers; t-keys writes only the runner-derived stand-in). A decoy-pointer probe and a bun HOME probe are owed after Oct 7 (B3, phase D vacuity).

package/docs/v10/GUIDE.md

@@ -39,8 +39,10 @@ loki "fix the login redirect loop" --no-pr
 `loki quick "<task>"` is the small-task entry. It runs the same engine
 without opening a pull request (the legacy quick never opened one), and the
 engine's own sizing picks the lean path for a small task: Plan and Wall are
-skipped and implement starts on sonnet, escalating to the top model only
-on a real test failure (E-64; `LOKI_E10_CASCADE=0` turns the cascade off).
+skipped and implement runs on your run's own model, like a raw session.
+`LOKI_E10_CASCADE=1` opts in to the cheaper sonnet start (it prints and
+records the downgrade); a repeated test failure always escalates up, never
+down (Engine Law L1).
 `loki quick --help` and a flag-first `loki quick -v "<task>"` stay on the
 legacy quick.
 

package/docs/v10/L0-WAVE1.md

@@ -0,0 +1,81 @@
+# L0 Wave 1: the model decides, the harness proves
+
+Founder directive, relayed by Loki steering at about 18:00Z on 2026-10-03, permanent: "never hardcode in the harness, work from 100k ft, use the intelligence of the model". L0 sits above L1 to L7 (ENGINE-LAWS.md section 2). This file slices it into Wave 1. Every slice touches trust, so each one gets an opus D12 review (unanimous).
+
+## The split
+
+The model owns repo and task knowledge:
+- layout and package roots;
+- runner, command and cwd;
+- whether there is a UI, and how to boot it;
+- which files are in scope and which tests are impacted;
+- task size;
+- who owns a failure;
+- what the issue asks.
+
+The harness owns mechanism:
+- running the commands the model proposed, and recording cwd, exit code, output and test counts;
+- sandboxing, budgets and process control;
+- signing, receipts and integrity;
+- terminal I/O;
+- deterministic tamper checks, such as test or runner config edited or weakened.
+
+When execution contradicts the model, the output goes back to the model once. The verdict comes from execution evidence plus a separate reviewer call, never from the author.
+
+## Inventory (grep on main 11685c822, loki-ts/src)
+
+Manifest probes:
+- engine10/testmap.ts
+- features/visual_evidence.ts
+- runner/repo_profile.ts
+- runner/quality_gates.ts
+- engine10/modernize/inventory.ts
+- util/update_check.ts (this reads Loki's own package.json, so it is not repo knowledge)
+
+Hardcoded runner commands:
+- engine10/testmap.ts (COMMANDS)
+- engine10/stages/verify.ts
+- engine10/stages/wall.ts
+- engine10/stages/deep.ts
+- engine10/types.ts
+- features/wall_manifest.ts
+- runner/quality_gates.ts
+- runner/repo_profile.ts
+- engine10/modernize/inventory.ts
+- engine10/modernize/presealed_wall.ts
+
+Task-wording heuristics:
+- e10ext/scope.ts (keyword regex)
+- engine10/sizing.ts (character counts and the named-file regex)
+
+The peer counted 10 manifest-probe files and 17 runner-command files. The grep above finds fewer, so EL-W1-00 re-measures the inventory before cutting.
+
+## Slices (sonnet builders, opus D12 review)
+
+| ID | Goal | File set | Wall checks |
+|----|------|----------|-------------|
+| EL-W1-00 | Static guard (L0): a CI test that fails when a new file under loki-ts/src probes a manifest name or embeds a runner command outside an allowlist. The allowlist starts as today's inventory and may only shrink. | new tests/engine10/l0_guard.test.ts | the guard goes red on a planted probe; the allowlist equals the inventory |
+| EL-W1-01 | Project Model discovery: one intake session reads loki.yaml, AGENTS.md, CLAUDE.md, CONTRIBUTING, README, CI workflows, manifests and configs. It returns a schema-checked Project Model (packages, roots, runner, cwd and test, lint, build and start commands, UI and boot, workspace kind), each answer citing its source files. Cached in .loki/project.json, keyed by manifest and lockfile hash. | new engine10/project_model.ts, plus its schema and intake wiring | schema rejects an answer with no citation; cache hit when hashes are unchanged; FireLater fixture yields backend/ and frontend/ roots |
+| EL-W1-02 | Calibration: the harness runs each proposed test command once (the Wall base run) and records cwd, exit code and counts. On contradiction (a load error or 0 collected), it sends the output back to the model once, then reruns. | project_model.ts calibrate(), wall.ts | a wrong command is corrected in one round; the second contradiction is recorded as harness ERROR |
+| EL-W1-03 | Consumers: testmap, verify, wall, deep and visual_evidence read commands and roots only through the Project Model API. COMMANDS and the manifest probes lose their authority and stay only as discovery hints. | testmap.ts, verify.ts, wall.ts, deep.ts, visual_evidence.ts | the L0 guard allowlist shrinks; the Repo Shape Matrix stays green |
+| EL-W1-04 | Scope: in-scope judgment is a model call citing the issue and the plan, and the keyword regex is a hint only. Advisory remains (L2). | e10ext/scope.ts, plan stage | FireLater#17 routes edits ruled in scope with a citation |
+| EL-W1-05 | Sizing: a model call returns a size plus its reasons, or the size folds into discovery. The character counts become a fallback only when the model call errors. | engine10/sizing.ts | the reasons are recorded in the receipt |
+| EL-W1-06 | Failure ownership (supersedes the FC-02 regex classifier, 7ad4a18b6 blocked in round 2): the harness gathers evidence (a hermetic base rerun with PYTHONPATH, VIRTUAL_ENV and the user site scrubbed, and traceback paths checked against the base dir). A separate reviewer call assigns the owner. Checks the task targets are never env-owned. | util/runner_load_error.ts, verify.ts, seal | round-2 repros B1 and B2 both end as code-owned |
+| EL-W1-07 | Visual evidence: whether there is a UI, and how to boot it, comes from the Project Model. | features/visual_evidence.ts | FireLater frontend/ is found; a no-UI repo gets an honest "no UI in Project Model" |
+
+Order: 00 and 01 first, then 02 and 03. 04, 05 and 07 can run in parallel with 02 once 01 lands. 06 starts after 01 (it consumes the commands). The hardcoded tables are deleted only after the model path is green on the Repo Shape Matrix.
+
+## In-flight reconciliation
+
+- **FC-01 monorepo, aac46dc26 (a446b394845a709ac):** a minimal stopgap hint only, superseded by EL-W1-01. The builder was told at 17:42Z.
+- **FC-02 runner-load, 7ad4a18b6:** blocked in round 2, and folded into EL-W1-06 rather than patched as a regex classifier.
+- **FC-09 runner-config registry, f4eccfeac:** a deterministic tamper check (mechanism, which L0 allows). Its re-review continues.
+- **FC-10 terminalWidth:** terminal I/O, which L0 allows, so its TL review continues.
+- **EL-W0-06 model default, 841065e46:** consistent with L1 and L0, so its re-review continues.
+
+## Review rule (binding for every D12 reviewer)
+
+Reject any change that adds an `if` or a regex about the user's repo shape, language, framework or task wording. The fix is a prompt or schema change plus an execution check. Exceptions are only:
+- tamper checks;
+- terminal I/O;
+- Loki's own files.

package/docs/v10/METRICS.md

@@ -579,3 +579,9 @@ Raw rows: ~/loki-ci-logs/d50-{raw-haiku,raw-sonnet,v10-haiku,v10-sonnet}/results
 | pub-humanize-174 | 0/3 | 2/3 |
 | aiq-52-searchbar (no_change_needed) | 0/3 | 2/3 |
 Two of the four baseline losses were noise; two are real. Internal measurement, not for publication until the fixes are re-measured.
+
+## Cost rate re-baseline (MW-1)
+| Date | Model | Input $/MTok | Output $/MTok | Cache read | Cache write 5m | Context | Source |
+| --- | --- | --- | --- | --- | --- | --- | --- |
+| 2026-10-03 | claude-sonnet-5-5 (and claude-sonnet-5, now the standard price) | 2 (was 3 in loki-ts/data/model-pricing.json) | 10 (was 15) | 0.20 | 2.50 | 1M, standard pricing | platform.claude.com/docs/en/about-claude/pricing, read 2026-10-03 |
+Cost per completed task for sonnet arms measured before this date used the old 3/15 table; they overstate by 1.5x and are not comparable without rescaling.

package/docs/v10/MORNING-BRIEF-1003.md

@@ -1,33 +1,19 @@
-# Morning brief, 2026-10-03 (refreshed 15:35Z, next refresh 16:30Z)
+# Morning brief, 2026-10-03 (refreshed 16:29Z, next refresh 17:30Z)
 
 ## Shipped today
-- 8 releases in 24h. The newest is v10.6.14 (tag 7fbbefc30, 14:01Z).
-- train/101 (seal forged-lines, P9 default push, cloud-dispatch) is folded into the 10.7.0 train.
+- 8 releases in 24h. The newest is v10.6.14 (tag 7fbbefc30, 14:01Z). npm latest is still 10.6.14.
 
-## 10.7.0: one big train, minor bump (D82)
-- Freeze is at 15:45Z, the cut at 15:55Z, and npm at about 16:10Z.
-- On local main, unpushed:
-  - Cost cap (subscription: no dollar cap; API key: $100 default).
-  - Default-on flags, with listeners on loopback only.
-  - Playwright e2e with video, `loki merge` queue, `loki review --risk`, project memory, mobile emulator tests, REST runs API, ACP for VS Code and JetBrains, Sentry intake, and D50 fixes.
-  - Docker and liveline.
-  - Control Plane zero-setup ingest, legacy dashboard entry points routed to the Control Plane, live run view, and shell with a loopback-only start endpoint (opus APPROVE r2).
-  - An empty Wall now seals NOT PROVEN (opus APPROVE r2).
-- Open item: 9 loki-ts bun reds after the LOKI_SPEED default flip. A fixer agent is working on them. If any real speed regression is unfixed by the freeze, the speed flip is reverted for 10.7.0.
+## 10.7.0: one big train, minor bump (D82, D84, D85)
+- train/102 (cf5be9026) went red: Tier A (shard-durations rows) and Tests (help and completion registration for acp and merge, `loki web --port` validation, a CP-INGEST type error, the gitleaks baseline count).
+- All of them were fixed in place (D85) and rerun locally green. train/103 (d9704dfc4) was pushed at 16:28Z and CI is running. Release follows a green Tests run.
+- In: the speed path on by default (with the fix for its 9 reds), quiet-mode live line, the cost cap, loopback-only default listeners, Playwright e2e with video, `loki merge`, `loki review --risk`, project memory, mobile emulator tests, the REST runs API, ACP, Sentry intake, and Control Plane zero-setup ingest, legacy entry points and live runs.
+- Moved to 10.7.1: the empty-Wall seal (it failed the engine e2e done run), CP roles and OIDC, the liveline CP URL, the monorepo RealBaseTestRunner, and mobile-verify wiring.
 
 ## 10.8.0: enterprise Control Plane rebuild (D83)
-- Plan: docs/v10/CP-ENTERPRISE-UI.md, slices CPE-01..26. Integration happens on branch cpe-base, kept off main until 10.7.0 is cut.
-- Status:
-  - Done: CPE-01 (legacy tokens, fonts, 19 primitives), CPE-03 (server scaffold), CPE-05 (SSE) and CPE-21 (notifications, audit). cpe-base suite is 97/0.
-  - Opus security review: CPE-04 (artifacts read API) and CPE-07 (POST /v1/runs).
-  - Building: CPE-02 (lean claude.ai-style shell) and CPE-09 (run.pid plus stop, retry and resume).
-
-## Decisions taken without you
-- D83 point 6:
-  - Ground #F1F2F6 and the mascot are kept.
-  - The merge queue and PR risk get UI pages (CPE-25, CPE-26).
-  - Schedules, memory and modernize stay hidden.
-- CPE-01 added AA-safe ink tokens, because the legacy light-theme status hex fail WCAG AA on the ground (FOUNDER-QUEUE 18).
+- On cpe-base: shell, home, runs, run thread, compose, cost, work, receipts, models, plans, merge queue and PR risk pages, a11y and contrast fixes. The suite is 235/0 and UI tsc is 0.
+- Settings (loki.yaml write-back, CPE-14) has been blocked by opus three times, on YAML 1.1 parser differences. The shell-command lock now holds. A fixer is on the remaining quoting gaps.
+- Opus security review is running on the merge-run endpoint.
+- Next: CPE-19 workspaces, CPE-20 integrations, and CPE-24 deleting the legacy dashboard last.
 
 ## Risks
 - Host load makes the pulse git and ps probes time out, so many metrics read UNKNOWN.

package/docs/v10/OPERATING-MODEL.md

@@ -42,6 +42,7 @@ The CEO is Lokesh Mure (Loki), the founder. Everyone else is an agent. The compa
 
 ## Discipline
 - Evidence or it did not happen: every claim cites a command plus its exit code or output line.
+- Engine Laws (D86): docs/v10/ENGINE-LAWS.md binds every stage. No bug becomes a fix slice until its row is in docs/v10/FAILURE-CLASSES.md (user-visible vs raw, law broken, sibling sweep, one shared mechanism, regression fixture); reviewers reject stage-only patches when siblings exist.
 - Every incident becomes a guard with a test (docs/v10/GUARDS.md, D26).
 - The pulse block (scripts/v10-pulse.sh) is injected every turn. Act on the top VIOLATION first.
 - Never kill by name or pattern, force-push, git add -A, or bypass branch protection.

package/docs/v10/PROGRESS.md

@@ -2162,3 +2162,31 @@ The swarm is stopped: .loki/V10-STOP exists, the loop has no wake-ups, and the c
 - train/102 (cf5be9026): first push blocked by pre-push gitleaks on a fake Sentry fixture token, allowlisted by fingerprint (cf5be9026). Tier A red on shard-durations drift (5 new suites); rows added (9bbfcf920), drift 6/0, structural 11/0. train/103 queued behind train/102 Tests.
 - cpe-base: CPE-16 fix (opus r2 APPROVE), CPE-17 plans plus honesty follow-up, CPE-23 Playwright a11y and parity (33/33), plans wiring; suite 214/0, tsc 0. CPE-14 fixes (b568de7c9) in opus r2 review. CPE-27 (receipts tone test, real-envelope test, AA contrast fixes) building.
 - Drift audit (turn 2322): HIGH reviews opus D12; CoS edits limited to integration wiring, a test-budget refactor move, a revert and CI registration rows; BOARD and commit in separate calls; no main-checkout edits while train-cycle ran.
+
+## 2026-10-03 16:37Z (CoS): train/103, CPE reviews
+- train/102 Tests reds (acp/merge help and completion registration, `loki web --port` validation, CP-INGEST env typing, gitleaks baseline 74 -> 75) fixed in place per D85 (d9704dfc4); five suites plus security-scan-coverage 31/0 and dist guard 13/0 rerun locally rc 0.
+- train/103 (d9704dfc4) pushed 16:28Z: Tier A, Bun Parity, First-run gate, Security Audit, Coverage green; Tests pending. 10.7.0 releases on a green Tests run.
+- cpe-base: CPE-25/26 merge queue and PR risk pages wired (28fc28647); suite 235/0, tsc 0.
+- Opus BLOCK on CPE-25: route timeout orphans the merge process group and drops merged lines (B1); symlinked registry entry bypasses the per-repo lock (B2). Sonnet fixer dispatched with both plus the GET-origin, exit-code and files-null advisories.
+- CPE-14 settings write-back in opus round 4 (unicode, comments, block scalars after the global line-separator escape).
+
+## 2026-10-03 17:08Z (CoS): 10.7.0 releasing, D86 Wave 0 slices
+- 10.7.0 (ffb58278b): Tests, Bun Parity, Coverage, Security Audit, SBOM success; Release job in progress; npm latest still 10.6.14 at 17:05Z.
+- Local main (unpushed, 6d8bbf7ca): scope advisory (FC-03), `loki control prune`, fixture leak shipper refusal merged for 10.7.1; FAILURE-CLASSES.md FC-01..FC-09 seeded.
+- Built, in opus D12 review: FC-08 ingest integrity (f0b891d2a), FC-02 runner load error plus final ship flush (79a8bb818), FC-09 runner-config registry (3cb3a7216), monorepo cwd (aac46dc26), cascade off (5ca26c9e3).
+- Building: FC-07 hermetic HOME, EL-W0-06 model default, EL-W0-08 PR body golden.
+- Drift audit (turn 2376): every fix slice has an FC row; HIGH reviews opus; no push during the 10.7.0 window; BOARD and commit kept in separate calls.
+
+## 2026-10-03 17:40Z (CoS)
+- Merged cascade (Engine Law L1 never below raw) as 1b1fc67c6; CHANGELOG kept both bullet sets; dist rebuilt in main, dist guard 13/0.
+- 10.7.1 still blocked on guard fix-forward (ad368f08d5bd98594): spawn env guard (ship_hook.ts:10) and e10ext budget (1509/1500). Builder told to land at 1498 or fewer so FC-10 (+1 line) fits.
+- Governor: pulse shows weekly burn projected 528.5% and max engineers next hour 0 (D39). No new dispatch this hour; FC-10 TL review deferred. In-flight agents (FC-07, FC-09, monorepo, W0-06, FC-02 r2, FC-08 r3, guards) finish and are not replaced.
+
+## 2026-10-03 17:45Z (CoS)
+- FC-02 runner-load (7ad4a18b6) round 2 opus D12: BLOCK. Two reproduced findings: (B1) the base rerun inherits the head Python env (an editable install), so the agent's own top-level raise is base-confirmed as harness_error and opens a ready PR; (B2) a test already broken on base, which the task asks the agent to fix, is base-confirmed as harness_error. Fix needed: hermetic base env plus traceback-path check; never confirm checks in relevant, wallTests or changedTestFiles. Rework queued behind the governor hold.
+- FC-09 runner-config rework done (f4eccfeac): engine10 1214/0, features 3098/3100, dist guard 13/0. Re-review queued behind the governor hold.
+
+## 2026-10-03 17:44Z (CoS)
+- Usage reading relayed by Loki steering (`claude -p "/usage"`, peer-stamped about 18:10Z, recorded at 17:43Z local clock): session 28%, week 71%, resets Oct 7 12:59 ET. The pulse's 518% projection extrapolates today's burst rate; recalibrated from this reading.
+- Governor plan until Oct 7: ONE lane (sonnet builder, opus review only on trust paths), stop at 81% weekly (4% reserve below the 85% floor). Order: (1) 10.7.1 guard fix-forward and release, (2) EL-W1-01 Project Model, (3) EL-W1-06 failure ownership (absorbs FC-02), (4) EL-W1-00 static L0 guard. In-flight agents finish; no other dispatch. Pending reviews (FC-09, EL-W0-06, FC-10) wait for the reset.
+- Main 08bf593f2: L0 recorded (ENGINE-LAWS, L0-WAVE1.md, FC-11). Full bun test after merges: 3353 pass, 2 fail (the two known guards only).

package/loki-ts/data/model-pricing.json

@@ -1,8 +1,8 @@
 {
   "$schema_version": 1,
   "_comment": "Rolling pricing table consumed by loki-ts/src/runner/budget.ts. Update this file when Anthropic / OpenAI / others publish new prices; no code change required. Pricing is USD per 1 million tokens. Aliases (opus/sonnet/haiku) point to the latest model of that family per providers/model_catalog.json.",
-  "_updated": "2026-06-30",
-  "_source": "https://www.anthropic.com/pricing + provider docs. sonnet=claude-sonnet-5 (list $3/$15; intro $2/$10 through 2026-08-31). opus=claude-opus-5. codex=gpt-5.3-codex standard tier. Cache tiers: read 0.1x input, write 1.25x input (Anthropic + OpenAI published multipliers).",
+  "_updated": "2026-10-03",
+  "_source": "https://www.anthropic.com/pricing + provider docs. sonnet=claude-sonnet-5 and claude-sonnet-5-5, both $2/$10 per MTok (the Sonnet 5 intro price became the standard price; the 2026-09-01 increase to $3/$15 will not occur), cache write 5m $2.50, cache read $0.20, 1M context at standard pricing (platform.claude.com/docs/en/about-claude/pricing, read 2026-10-03). opus=claude-opus-5. codex=gpt-5.3-codex standard tier. Cache tiers: read 0.1x input, write 1.25x input (Anthropic + OpenAI published multipliers).",
   "pricing": {
     "fable": {
       "input": 10.0,
@@ -17,10 +17,10 @@
       "cache_write": 6.25
     },
     "sonnet": {
-      "input": 3.0,
-      "output": 15.0,
-      "cache_read": 0.3,
-      "cache_write": 3.75
+      "input": 2.0,
+      "output": 10.0,
+      "cache_read": 0.2,
+      "cache_write": 2.5
     },
     "haiku": {
       "input": 1.0,