loki-mode 10.7.0 → 10.8.0

package/packages/control-plane/src/db/schema.ts

@@ -49,9 +49,41 @@ export const runs = sqliteTable("runs", {
   conflict: integer("conflict").notNull().default(0),
   groupId: text("group_id"),
   unitId: text("unit_id"),
+  attested: integer("attested"), // EL-FC08b: null = never evaluated (reads as unattested)
+  sigChecked: integer("sig_checked"), // log seal signature verified against a configured key
+  integrityKeyFp: text("integrity_key_fp"), // key-set fingerprint the integrity result was computed under; a change triggers a boot recompute
+  integrityReasons: text("integrity_reasons"), // JSON string[]
 }, (t) => [
   primaryKey({ columns: [t.sourceId, t.runId] }),
   index("runs_started").on(t.startedAt),
   index("runs_verdict").on(t.verdict),
   index("runs_group").on(t.groupId),
 ]);
+
+// Append-only record of destructive operator actions (run removal, prune). Written before the delete runs.
+export const audit = sqliteTable("audit", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  ts: text("ts").notNull(),
+  action: text("action").notNull(),
+  actor: text("actor").notNull(),
+  detail: text("detail", { mode: "json" }).notNull(),
+});
+
+// LOCAL-ONLY: written by local discovery (shipper/discover.ts), never by /v1/ingest. realpath is never returned over the API.
+export const localRepos = sqliteTable("local_repos", {
+  sourceId: text("source_id").primaryKey(),
+  realpath: text("realpath").notNull(),
+  name: text("name").notNull(),
+  discoveredAt: text("discovered_at").notNull(),
+});
+
+// Audit trail of UI-initiated actions (start, stop, retry, resume, answer, config write).
+export const actions = sqliteTable("actions", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  ts: text("ts").notNull(),
+  actor: text("actor").notNull(),
+  kind: text("kind").notNull(),
+  target: text("target"),
+  result: text("result").notNull(),
+  detail: text("detail"),
+}, (t) => [index("actions_ts").on(t.ts)]);

package/packages/control-plane/src/server/app.ts

@@ -4,10 +4,14 @@ import { Hono, type Context } from "hono";
 import { openDb } from "../db/migrate.ts";
 import { ingest } from "./ingest.ts";
 import { defaultAnswerDir, writeAnswer } from "./answer.ts";
-import { listRuns, runDetail } from "./runs.ts";
-import { hostGuard, isLoopbackHost, tokenGuard } from "./auth.ts";
+import { listRuns, recomputeLegacy, runDetail } from "./runs.ts";
+import { hostGuard, isLoopbackHost, peerIsLoopback, tokenGuard } from "./auth.ts";
 import { backfill } from "../shipper/backfill.ts";
-import { planStart, registryRepos, spawnStart } from "./actions.ts";
+import { removeRun } from "../db/prune.ts";
+import type { spawnStart } from "./spawn.ts";
+import { syncLocalRepos } from "./repos.ts";
+import { registerRoutes } from "./routes/index.ts";
+import { legacyShim } from "./legacy/shim.ts";
 
 const MAX_BODY = 1_000_000;
 
@@ -18,6 +22,7 @@ const defaultUiDir = () => [join(import.meta.dir, "../../ui/dist"), join(import.
 export function createApp(opts: { dbPath: string; uiDir?: string; answerDir?: string; token?: string; loopbackOnly?: boolean; repoDir?: string; startBin?: string; spawnImpl?: typeof spawnStart }) {
   const uiDir = opts.uiDir ?? defaultUiDir();
   const { db, sqlite } = openDb(opts.dbPath);
+  recomputeLegacy(db);
   let ready = true;
   const answerDir = opts.answerDir ?? defaultAnswerDir();
   const app = new Hono();
@@ -71,13 +76,8 @@ export function createApp(opts: { dbPath: string; uiDir?: string; answerDir?: st
   // Machine-touching actions exist ONLY on a loopback-bound server (otherwise they are never registered: 404).
   // Each request must also come from a loopback peer (the real socket address, not the spoofable Host header; unknown peer fails closed) and carry JSON (blocks cross-site form posts).
   const act = opts.loopbackOnly ? app : new Hono();
-  const peerIsLoopback = (c: Context): boolean => {
-    const ip = (c.env as { requestIP?: (r: Request) => { address?: string } | null } | undefined)?.requestIP?.(c.req.raw)?.address;
-    return typeof ip === "string" && /^(127\.\d+\.\d+\.\d+|::1|::ffff:127\.\d+\.\d+\.\d+)$/.test(ip);
-  };
   const local = (c: Context) => peerIsLoopback(c) && isLoopbackHost(c.req.header("host")) && (c.req.header("content-type") ?? "").toLowerCase().startsWith("application/json");
   const repoDir = opts.repoDir ?? process.cwd();
-  const inflight = new Set<string>();
   act.post("/v1/import", async (c) => {
     if (!local(c)) return c.json({ error: "loopback JSON requests only" }, 403);
     const r = await backfill({
@@ -87,21 +87,26 @@ export function createApp(opts: { dbPath: string; uiDir?: string; answerDir?: st
     });
     return c.json({ runs: r.runs, sent: r.sent, failed: r.failed });
   });
-  act.get("/v1/repos", (c) => peerIsLoopback(c) ? c.json({ repos: [...new Set<string>([repoDir, ...registryRepos()])] }) : c.json({ error: "loopback only" }, 403));
-  act.post("/v1/start", async (c) => {
-    if (!local(c)) return c.json({ error: "loopback JSON requests only" }, 403);
-    const text = await c.req.text();
-    if (text.length > 20_000) return c.json({ error: "body too large" }, 413);
-    let body: unknown;
-    try { body = JSON.parse(text); } catch { return c.json({ error: "invalid JSON" }, 400); }
-    const plan = planStart(body, [repoDir, ...registryRepos()], opts.startBin);
-    if (!plan.ok) return c.json({ error: plan.error }, 400);
-    if (inflight.has(plan.cwd)) return c.json({ error: "a run is already starting or running in this repo" }, 409);
-    inflight.add(plan.cwd);
-    const r = await (opts.spawnImpl ?? spawnStart)(plan.argv, plan.cwd, () => inflight.delete(plan.cwd));
-    if ("error" in r) { inflight.delete(plan.cwd); return c.json({ error: r.error }, 500); }
-    return c.json({ ok: true, pid: r.pid, command: plan.argv.slice(1).join(" ") });
+  // Remove one run (and its events). Loopback-only like /v1/start (never registered on a non-loopback server); bearer via tokenGuard when a token is set. JSON content type blocks cross-site form posts;
+  // a browser Origin must match the host this server is served on. Absent Origin (curl, the CLI) is allowed. The audit row is written inside the delete transaction, before the rows go.
+  act.delete("/v1/runs/:source/:run", async (c) => {
+    if (!peerIsLoopback(c) || !isLoopbackHost(c.req.header("host"))) return c.json({ error: "loopback only" }, 403);
+    if (!(c.req.header("content-type") ?? "").toLowerCase().startsWith("application/json")) return c.json({ error: "content-type must be application/json" }, 400);
+    const origin = c.req.header("origin");
+    if (origin !== undefined) {
+      let oh = "";
+      try { oh = new URL(origin).host.toLowerCase(); } catch { /* refused below */ }
+      if (!oh || oh !== (c.req.header("host") ?? "").toLowerCase()) return c.json({ error: "origin not allowed" }, 403);
+    }
+    const source = c.req.param("source"), run = c.req.param("run");
+    const r = removeRun(sqlite, source, run);
+    if (!r) return c.json({ error: "run not found" }, 404);
+    const left = (sqlite.query("select count(*) n from runs").get() as { n: number }).n;
+    return c.json({ ok: true, removed: r, remaining_runs: left });
   });
+  // Local discovery fills local_repos (never /v1/ingest). GET /v1/repos (names only, loopback guard) is mounted by routes/index.ts.
+  syncLocalRepos(db, repoDir);
+  registerRoutes({ app, act, db, repoDir, token: opts.token, peerIsLoopback, local, startBin: opts.startBin, spawnImpl: opts.spawnImpl, answerDir });
   // :id is `source:run` (run ids never contain a colon)
   app.get("/v1/runs/:id", (c) => {
     const id = c.req.param("id");
@@ -109,6 +114,9 @@ export function createApp(opts: { dbPath: string; uiDir?: string; answerDir?: st
     return i < 0 ? c.json({ error: "id must be source:run" }, 404) : detail(c, id.slice(0, i), id.slice(i + 1));
   });
 
+  // Legacy dashboard paths (CPE-24) are answered by the shim; mounted before the SPA fallback so index.html never shadows them.
+  app.route("/", legacyShim({ db, token: opts.token, repoDir }));
+
   // Static UI with SPA fallback. Registered last so /v1, /health and /ready always win.
   app.get("*", (c) => {
     let p: string;

package/packages/control-plane/src/server/audit.ts

@@ -0,0 +1,15 @@
+// Audit helper: one row per UI-initiated action. Never throws (an audit failure must not break the action) and never stores secrets.
+import type { Db } from "../db/migrate.ts";
+import { actions } from "../db/schema.ts";
+
+export type AuditEntry = { actor?: string; kind: string; target?: string; result: string; detail?: string };
+
+const clip = (s: string | undefined, n: number): string | null => (s === undefined ? null : s.slice(0, n));
+
+/** Records an action. Returns true when the row was written. */
+export function audit(db: Db, e: AuditEntry): boolean {
+  try {
+    db.insert(actions).values({ ts: new Date().toISOString(), actor: e.actor ?? "local", kind: e.kind, target: clip(e.target, 500), result: e.result, detail: clip(e.detail, 2000) }).run();
+    return true;
+  } catch { return false; }
+}

package/packages/control-plane/src/server/auth.ts

@@ -1,6 +1,6 @@
 // Control Plane auth: bearer token on /v1, Host allowlist on loopback (DNS rebinding), bind refusal without a token.
 import { createHash, timingSafeEqual } from "node:crypto";
-import type { MiddlewareHandler } from "hono";
+import type { Context, MiddlewareHandler } from "hono";
 
 const LOOPBACK_BINDS = new Set(["127.0.0.1", "localhost", "::1", "[::1]"]);
 
@@ -9,6 +9,12 @@ export function isLoopbackHost(host: string | undefined | null): boolean {
   return !!host && /^(127\.0\.0\.1|localhost|\[::1\])(:\d+)?$/i.test(host);
 }
 
+/** True when the real socket peer (not the spoofable Host header) is loopback. An unknown peer fails closed. */
+export function peerIsLoopback(c: Context): boolean {
+  const ip = (c.env as { requestIP?: (r: Request) => { address?: string } | null } | undefined)?.requestIP?.(c.req.raw)?.address;
+  return typeof ip === "string" && /^(127\.\d+\.\d+\.\d+|::1|::ffff:127\.\d+\.\d+\.\d+)$/.test(ip);
+}
+
 /** Constant-time check of an Authorization header against the token. Hashing first makes the compare length-safe. */
 export function tokenMatches(header: string | undefined | null, token: string): boolean {
   const m = /^Bearer (.+)$/i.exec(header ?? "");

package/packages/control-plane/src/server/integrity.ts

@@ -0,0 +1,147 @@
+// EL-FC08b (D86, FC-08, L2): integrity of an INGESTED event log, run on every rebuild of a run's projection.
+// Pure: no db. The same checks `loki verify` makes on events.jsonl (loki-ts/src/engine10/verify_cmd.ts: checkEventLog, checkLogSeal),
+// restated over stored envelopes. Option taken for sharing: a CP-local module plus test/server/integrity-parity.test.ts, which runs both
+// implementations over the same fixtures, including signed ones (unknown kid, mismatched kid, appended run.completed), so they cannot drift.
+// TAMPERED means positive evidence of forgery. A log the CP cannot check (redacted before ingest) is UNVERIFIED, never TAMPERED and never VERIFIED.
+import { createHash, createPublicKey, verify, type KeyObject } from "node:crypto";
+import { readFileSync } from "node:fs";
+import type { EventEnvelope } from "../../../../loki-ts/src/engine10/types.ts";
+
+export interface RunIntegrity {
+  /** Positive evidence of forgery, loss or edit. Always shown as TAMPERED. */
+  tampered: boolean;
+  /** A VERIFIED claim backed by a signed receipt.sealed and a sealing line, with a log that could be checked. False means unattested (shown UNVERIFIED). */
+  attested: boolean;
+  /** The sealing line's signature was verified against a configured public key. False: shape and hash chain only. */
+  sig_checked: boolean;
+  reasons: string[];
+}
+export type KeyResolver = ((kid: string) => KeyObject | undefined) & { configured?: boolean; fingerprint?: string };
+export interface IntegrityOpts {
+  pubkeyFor?: KeyResolver;
+  /** At least one key is configured: an unknown kid is then TAMPERED, as in the engine's checkLogSeal. Defaults to pubkeyFor.configured. */
+  keysConfigured?: boolean;
+}
+
+const SHA = /^[0-9a-f]{64}$/;
+const SEAL_LINE = "log.sealed";
+const REDACTED = /\[REDACTED(?::[A-Z_]+)?\]/;
+export const REDACTED_NOTE = "log redacted before ingest; seal not checkable";
+export const UNCHECKED_SIG = "VERIFIED (signature not checked)";
+export const UNATTESTED_SUFFIX = " (unattested)";
+/** Outcomes that claim success: each needs a signed seal, exactly like VERIFIED. */
+export const SUCCESS_VERDICTS: ReadonlySet<string> = new Set(["VERIFIED", "ALREADY_SATISFIED"]);
+const normVerdict = (v: string | null | undefined): string | null => (typeof v === "string" ? v.trim().toUpperCase() : null);
+
+/** Same derivation as loki-ts/src/engine10/stages/seal.ts kidOf (parity-tested). */
+export const kidOf = (pub: KeyObject): string => createHash("sha256").update(`{"crv":"Ed25519","kty":"OKP","x":"${pub.export({ format: "jwk" }).x}"}`).digest("base64url");
+
+/** Public keys from LOKI_CP_RECEIPT_PUBKEYS (colon-separated PEM files, like `loki verify` retired keys), by kid. Unreadable files are skipped. */
+export function pubkeysFromEnv(env: Record<string, string | undefined> = process.env): KeyResolver {
+  const keys = (env["LOKI_CP_RECEIPT_PUBKEYS"] ?? "").split(":").map((f) => f.trim()).filter(Boolean).flatMap((f) => {
+    try { return [createPublicKey(readFileSync(f))]; } catch { return []; }
+  });
+  const fn: KeyResolver = (kid) => keys.find((k) => kidOf(k) === kid);
+  fn.configured = keys.length > 0;
+  fn.fingerprint = createHash("sha256").update(keys.map(kidOf).sort().join(",")).digest("hex").slice(0, 16); // identifies the key set a row was judged under
+  return fn;
+}
+
+// The engine writes JSON.stringify(envelope) in this key order, so a stored envelope re-serialises to the bytes it was hashed as.
+const line = (e: EventEnvelope): string => JSON.stringify({ v: e.v, seq: e.seq, ts: e.ts, run: e.run, type: e.type, stage: e.stage, data: e.data });
+const verdictOf = (e: EventEnvelope | undefined): string | null => (typeof e?.data["verdict"] === "string" ? e.data["verdict"].trim().toUpperCase() : null);
+
+/** Events up to and including the sealing line (the authenticated prefix); everything when the run has none. Lines after it are unauthenticated. */
+export function sealedPrefix<T extends { type: string }>(evs: readonly T[]): T[] {
+  const i = evs.findIndex((e) => e.type === SEAL_LINE);
+  return i < 0 ? [...evs] : evs.slice(0, i + 1);
+}
+
+export function verifyRunIntegrity(evs: readonly EventEnvelope[], opts: IntegrityOpts = {}): RunIntegrity {
+  const bad: string[] = [], notes: string[] = [];
+  const doneAt = evs.findIndex((e) => e.type === "run.completed");
+  const sealedAt = evs.map((e, i) => (e.type === "receipt.sealed" ? i : -1)).filter((i) => i >= 0);
+  const finalised = doneAt >= 0 || sealedAt.length > 0;
+  const lines = evs.map(line);
+  const keysConfigured = opts.keysConfigured ?? opts.pubkeyFor?.configured ?? false;
+  let sigChecked = false;
+
+  if (finalised) { // a live run may still be missing a batch; once it claims an end, every seq must be present
+    const gap = evs.findIndex((e, i) => e.seq !== i);
+    if (gap >= 0) bad.push(`event log has a seq gap, duplicate or missing start at position ${gap} (seq ${evs[gap]!.seq})`);
+  }
+  if (evs.some((e) => e.type === "tamper.detected")) bad.push("the supervisor detected events.jsonl being modified during the run");
+  const firstSeal = evs.findIndex((e) => e.type === SEAL_LINE);
+  if (firstSeal >= 0 && evs.slice(firstSeal + 1).some((e) => e.type === "run.completed" || e.type === "receipt.sealed" || typeof e.data["verdict"] === "string")) bad.push("a verdict-bearing event after log.sealed is unauthenticated");
+  if (evs.filter((e) => e.type === "run.completed").length > 1) bad.push("more than one run.completed (a verdict appended after the seal is unauthenticated)");
+
+  // Hash problems are tamper evidence unless a redaction placeholder explains the changed bytes.
+  const hashBad: string[] = [];
+  const redacted = REDACTED.test(JSON.stringify(doneAt >= 0 ? evs.slice(0, doneAt + 2).map((e) => e.data) : evs.map((e) => e.data)));
+
+  for (const i of sealedAt) {
+    const d = evs[i]!.data;
+    if (typeof d["receipt_sha256"] !== "string" || !SHA.test(d["receipt_sha256"])) hashBad.push(`receipt.sealed at seq ${evs[i]!.seq} has no valid receipt_sha256`);
+    const bound = d["events_sha256"]; // optional on the event: the engine keeps it in receipt.json, which the CP never sees
+    if (typeof bound === "string") {
+      const h = createHash("sha256");
+      let ok = false;
+      for (const l of lines) { if (h.copy().digest("hex") === bound) { ok = true; break; } h.update(l + "\n"); }
+      if (!ok && h.digest("hex") === bound) ok = true;
+      if (!ok) hashBad.push("receipt.sealed events_sha256 does not match any prefix of the ingested log");
+    }
+  }
+
+  const sealLines = evs.map((e, i) => (e.type === SEAL_LINE ? i : -1)).filter((i) => i >= 0);
+  if (sealLines.some((i) => i !== doneAt + 1)) bad.push(`${SEAL_LINE} is not the line right after run.completed`);
+  const ls = doneAt >= 0 && evs[doneAt + 1]?.type === SEAL_LINE ? evs[doneAt + 1]!.data : null;
+  const signedSeals = sealedAt.map((i) => evs[i]!.data).filter((d) => d["signed"] === true);
+  const signedReceipt = signedSeals.length > 0;
+  if (ls) {
+    const sha = createHash("sha256").update(lines.slice(0, doneAt + 1).join("\n") + "\n").digest("hex");
+    const sig = typeof ls["sig"] === "string" ? Buffer.from(ls["sig"], "base64url") : null;
+    const kid = ls["kid"];
+    if (ls["tampered"] !== false) bad.push(`${SEAL_LINE} line records a tamper or is malformed`);
+    else if (typeof kid !== "string" || !sig || sig.length !== 64) hashBad.push(`${SEAL_LINE} line is malformed or records a tamper`);
+    else {
+      if (signedSeals.some((d) => typeof d["kid"] === "string" && d["kid"] !== kid)) hashBad.push(`${SEAL_LINE} kid differs from the receipt kid`);
+      if (ls["events_sha256"] !== sha) hashBad.push(`${SEAL_LINE} events_sha256 does not match the ingested log`);
+      else {
+        const pub = opts.pubkeyFor?.(kid);
+        if (pub) { sigChecked = true; if (!verify(null, Buffer.from(`${sha}:false`), pub, sig)) bad.push(`${SEAL_LINE} signature does not verify`); }
+        else if (keysConfigured) bad.push(`${SEAL_LINE} kid ${kid} has no configured public key`);
+      }
+    }
+  } else if (signedReceipt && doneAt >= 0) bad.push(`signed receipt but no ${SEAL_LINE} line after run.completed`);
+
+  let unverifiable = false;
+  if (hashBad.length > 0) {
+    if (redacted) { unverifiable = true; sigChecked = false; notes.push(REDACTED_NOTE); } else bad.push(...hashBad);
+  }
+
+  // A VERIFIED claim (first run.completed only) needs a receipt sealed before it, for the same verdict.
+  let claimsVerified = false;
+  const claimed = doneAt >= 0 ? verdictOf(evs[doneAt]) : null;
+  if (claimed !== null && SUCCESS_VERDICTS.has(claimed)) {
+    claimsVerified = true;
+    const before = sealedAt.filter((i) => i < doneAt);
+    if (before.length === 0) bad.push(`run.completed claims ${claimed} but no receipt.sealed precedes it`);
+    else if (!before.some((i) => verdictOf(evs[i]) === claimed)) bad.push(`run.completed claims ${claimed} but the sealed receipt does not`);
+  }
+
+  const tampered = bad.length > 0;
+  const attested = !tampered && !unverifiable && (!claimsVerified || (signedReceipt && ls !== null));
+  return { tampered, attested, sig_checked: sigChecked && !tampered, reasons: [...bad, ...notes] };
+}
+
+/** The one display verdict (FC-08). TAMPERED when the log failed integrity. When it is not attested, a success claim shows UNVERIFIED and any other verdict carries an
+ *  "(unattested)" marker. An attested success whose seal no key checked shows "<verdict> (signature not checked)"; plain VERIFIED only for a signature-checked run.
+ *  sig_checked undefined (older captures) reads as checked. */
+export function effectiveVerdict(r: { verdict: string | null; tampered: boolean; attested?: boolean; sig_checked?: boolean }): string | null {
+  if (r.tampered) return "TAMPERED";
+  const v = normVerdict(r.verdict);
+  if (v === null) return r.verdict;
+  if (r.attested === false) return SUCCESS_VERDICTS.has(v) ? "UNVERIFIED" : `${r.verdict}${UNATTESTED_SUFFIX}`;
+  if (SUCCESS_VERDICTS.has(v)) return r.sig_checked === false ? `${v} (signature not checked)` : v;
+  return r.verdict;
+}

package/packages/control-plane/src/server/legacy/routes-metrics.ts

@@ -0,0 +1,18 @@
+// CPE24-P1: legacy (port 57374) mappings for metrics, cost and fleet spend. Each reads the same source as its /v1 route (routes/metrics.ts,
+// routes/cost_ledger.ts, routes/fleet.ts) and keeps the legacy response shape. The shim's guard (legacyGuard) has already run.
+import type { Context } from "hono";
+import { costSnapshot, costTimeline, lokiDirOf } from "../routes/cost_ledger.ts";
+import { fleetRuns, fleetSummary, parseInactive } from "../routes/fleet.ts";
+import { buildMetricsText } from "../routes/metrics.ts";
+
+export function metricsMapped(repoDir: string): Record<string, (c: Context) => Response> {
+  const inactive = (c: Context) => parseInactive(c.req.query("include_inactive"));
+  return {
+    "GET /api/cost": (c) => c.json(costSnapshot(lokiDirOf(repoDir))),
+    "GET /api/cost/timeline": (c) => c.json(costTimeline(lokiDirOf(repoDir))),
+    "GET /metrics": (c) => c.text(buildMetricsText(repoDir), 200, { "content-type": "text/plain; charset=utf-8" }),
+    // Legacy rows carry the project path; the guarded shim serves only authenticated or loopback callers, like legacy.
+    "GET /api/fleet/runs": (c) => c.json(fleetRuns(inactive(c))),
+    "GET /api/fleet/summary": (c) => c.json(fleetSummary(inactive(c))),
+  };
+}

package/packages/control-plane/src/server/legacy/routes.ts

@@ -0,0 +1,237 @@
+// GENERATED from docs/v10/CP-ENTERPRISE-UI.md section 5.2 (one row per legacy dashboard route that the shim answers).
+// test/server/legacy-shim.test.ts asserts this table and the doc table agree. Regenerate both together, never one alone.
+export type LegacyAction = "map" | "308" | "410" | "501";
+export interface LegacyRoute { method: string; path: string; action: LegacyAction; open: boolean; migrate: string }
+
+export const LEGACY_ROUTES: readonly LegacyRoute[] = [
+  { method: "GET", path: "/openapi.json", action: "410", open: true, migrate: "" },
+  { method: "GET", path: "/docs", action: "410", open: true, migrate: "" },
+  { method: "GET", path: "/docs/oauth2-redirect", action: "410", open: true, migrate: "" },
+  { method: "GET", path: "/redoc", action: "410", open: true, migrate: "" },
+  { method: "POST", path: "/api/v2/tenants", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/v2/tenants", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/v2/tenants/{tenant_id}", action: "501", open: false, migrate: "" },
+  { method: "PUT", path: "/api/v2/tenants/{tenant_id}", action: "410", open: false, migrate: "" },
+  { method: "DELETE", path: "/api/v2/tenants/{tenant_id}", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/v2/tenants/{tenant_id}/projects", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/v2/runs", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/v2/runs", action: "map", open: false, migrate: "/v1/runs" },
+  { method: "GET", path: "/api/v2/runs/{run_id}", action: "map", open: false, migrate: "/v1/runs/:id" },
+  { method: "POST", path: "/api/v2/runs/{run_id}/cancel", action: "501", open: false, migrate: "" },
+  { method: "POST", path: "/api/v2/runs/{run_id}/replay", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/v2/runs/{run_id}/timeline", action: "map", open: false, migrate: "/v1/runs/:id" },
+  { method: "POST", path: "/api/v2/api-keys", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/v2/api-keys", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/v2/api-keys/{identifier}", action: "410", open: false, migrate: "" },
+  { method: "PUT", path: "/api/v2/api-keys/{identifier}", action: "410", open: false, migrate: "" },
+  { method: "DELETE", path: "/api/v2/api-keys/{identifier}", action: "501", open: false, migrate: "" },
+  { method: "POST", path: "/api/v2/api-keys/{identifier}/rotate", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/v2/policies", action: "410", open: false, migrate: "" },
+  { method: "PUT", path: "/api/v2/policies", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/v2/policies/evaluate", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/v2/audit", action: "map", open: false, migrate: "/v1/audit" },
+  { method: "GET", path: "/api/v2/audit/verify", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/v2/audit/export", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/operator/runs/{run_id}", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/operator/tests", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/operator/receipts", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/operator/releases", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/operator/phases", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/operator/workspaces/runs", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/operator/workspaces/runs/{ws}/{run_id}", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/onboarding/state", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/onboarding/provider", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/onboarding/github", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/onboarding/repos", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/onboarding/repo", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/backlog/issues", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/backlog/run", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/backlog/status", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/v1/runs", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/v1/runs/{run_id}", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/v1/runs", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/v1/runs/{run_id}/stop", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/start", action: "308", open: false, migrate: "/" },
+  { method: "MOUNT", path: "/lab", action: "308", open: true, migrate: "/" },
+  { method: "GET", path: "/api/providers/models", action: "410", open: true, migrate: "" },
+  { method: "GET", path: "/.well-known/agent.json", action: "map", open: true, migrate: "/v1/runs" },
+  { method: "GET", path: "/api/status", action: "map", open: false, migrate: "/v1/runs" },
+  { method: "GET", path: "/api/projects", action: "501", open: false, migrate: "" },
+  { method: "POST", path: "/api/projects", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/projects/{project_id}", action: "501", open: false, migrate: "" },
+  { method: "PUT", path: "/api/projects/{project_id}", action: "501", open: false, migrate: "" },
+  { method: "DELETE", path: "/api/projects/{project_id}", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/tasks", action: "501", open: false, migrate: "" },
+  { method: "POST", path: "/api/tasks", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/tasks/{task_id}", action: "501", open: false, migrate: "" },
+  { method: "PUT", path: "/api/tasks/{task_id}", action: "501", open: false, migrate: "" },
+  { method: "DELETE", path: "/api/tasks/{task_id}", action: "501", open: false, migrate: "" },
+  { method: "POST", path: "/api/tasks/{task_id}/move", action: "501", open: false, migrate: "" },
+  { method: "WS", path: "/ws", action: "501", open: true, migrate: "" },
+  { method: "GET", path: "/api/registry/projects", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/registry/projects", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/registry/projects/{identifier}", action: "410", open: false, migrate: "" },
+  { method: "DELETE", path: "/api/registry/projects/{identifier}", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/registry/projects/{identifier}/health", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/registry/projects/{identifier}/access", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/registry/discover", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/registry/sync", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/registry/tasks", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/registry/learnings", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/fleet/runs", action: "map", open: false, migrate: "/v1/fleet/runs" },
+  { method: "GET", path: "/api/fleet/summary", action: "map", open: false, migrate: "/v1/fleet/summary" },
+  { method: "GET", path: "/api/fleet/runs/{identifier}", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/focus", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/focus", action: "410", open: false, migrate: "" },
+  { method: "DELETE", path: "/api/focus", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/session/model", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/session/model", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/running-projects", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/control/start", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/control/builds/{execution_id}", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/control/builds/{execution_id}/proof", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/control/builds/{execution_id}/stop", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/running-projects/stop", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/fleet/runs/{identifier}/retry", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/fleet/runs/{identifier}/cancel", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/enterprise/status", action: "410", open: true, migrate: "" },
+  { method: "GET", path: "/api/auth/info", action: "410", open: true, migrate: "" },
+  { method: "POST", path: "/api/enterprise/tokens", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/enterprise/tokens", action: "410", open: false, migrate: "" },
+  { method: "DELETE", path: "/api/enterprise/tokens/{identifier}", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/enterprise/audit", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/enterprise/audit/summary", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/compliance", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/memory/summary", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/memory/episodes", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/memory/episodes/{episode_id}", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/memory/patterns", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/memory/patterns/{pattern_id}", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/memory/skills", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/memory/skills/{skill_id}", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/memory/economics", action: "501", open: false, migrate: "" },
+  { method: "POST", path: "/api/memory/consolidate", action: "501", open: false, migrate: "" },
+  { method: "POST", path: "/api/memory/retrieve", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/memory/index", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/memory/timeline", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/memory/files", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/memory/file", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/memory/search", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/memory/stats", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/learning/metrics", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/learning/trends", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/learning/signals", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/learning/aggregation", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/learning/aggregate", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/learning/preferences", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/learning/errors", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/learning/success", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/learning/tools", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/control/pause", action: "501", open: false, migrate: "" },
+  { method: "POST", path: "/api/control/resume", action: "501", open: false, migrate: "" },
+  { method: "POST", path: "/api/control/stop", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/cost", action: "map", open: false, migrate: "/v1/cost/snapshot" },
+  { method: "GET", path: "/api/budget", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/cost/timeline", action: "map", open: false, migrate: "/v1/cost/timeline" },
+  { method: "GET", path: "/api/trust/trajectory", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/gate-policy", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/pricing", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/council/state", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/council/verdicts", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/council/convergence", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/council/report", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/council/force-review", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/council/transcripts", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/council/transcripts/{iteration_id}", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/context", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/notifications", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/notifications/triggers", action: "410", open: false, migrate: "" },
+  { method: "PUT", path: "/api/notifications/triggers", action: "501", open: false, migrate: "" },
+  { method: "POST", path: "/api/notifications/{notification_id}/acknowledge", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/notifications/{notification_id}/unacknowledge", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/checkpoints", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/checkpoints/{checkpoint_id}", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/checkpoints", action: "501", open: false, migrate: "" },
+  { method: "POST", path: "/api/checkpoints/{checkpoint_id}/rollback", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/agents", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/agents/{agent_id}/kill", action: "501", open: false, migrate: "" },
+  { method: "POST", path: "/api/agents/{agent_id}/pause", action: "501", open: false, migrate: "" },
+  { method: "POST", path: "/api/agents/{agent_id}/resume", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/logs", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/collab/join", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/collab/leave", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/collab/users", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/collab/users/{user_id}", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/collab/users/{user_id}/heartbeat", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/collab/users/{user_id}/cursor", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/collab/users/{user_id}/status", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/collab/presence", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/collab/file/{file_path:path}", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/collab/state", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/collab/state/value", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/collab/operation", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/collab/sync", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/collab/history", action: "410", open: false, migrate: "" },
+  { method: "WS", path: "/ws/collab", action: "410", open: true, migrate: "" },
+  { method: "GET", path: "/api/collab/status", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/secrets/status", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/github/status", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/github/tasks", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/github/sync-log", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/health/processes", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/metrics", action: "map", open: false, migrate: "/v1/metrics" },
+  { method: "GET", path: "/api/checklist", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/usage", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/checklist/summary", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/prd-observations", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/checklist/waivers", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/checklist/waivers", action: "501", open: false, migrate: "" },
+  { method: "DELETE", path: "/api/checklist/waivers/{item_id}", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/council/gate", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/app-runner/status", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/app-runner/logs", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/app-runner/errors", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/control/app-restart", action: "501", open: false, migrate: "" },
+  { method: "POST", path: "/api/control/app-stop", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/playwright/results", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/playwright/screenshot", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/failures", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/prompt-versions", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/prompt-optimize", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/activity", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/session-diff", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/activity", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/cost", action: "308", open: false, migrate: "/" },
+  { method: "GET", path: "/trust", action: "308", open: false, migrate: "/" },
+  { method: "GET", path: "/", action: "308", open: false, migrate: "/" },
+  { method: "GET", path: "/api/quality-score", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/quality-score/history", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/quality-scan", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/quality-report", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/migration/list", action: "501", open: false, migrate: "" },
+  { method: "POST", path: "/api/migration/start", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/migration/{migration_id}/status", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/migration/{migration_id}/plan", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/migration/{migration_id}/features", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/migration/{migration_id}/seams", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/migration/{migration_id}/advance", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/migration/{migration_id}/start-phase", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/managed/events", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/managed/status", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/managed/memory_versions/{memory_id}", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/findings/{iteration}", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/quality/architecture", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/learnings", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/escalations", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/escalations/{filename}", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/phases", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/proofs", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/proofs/summary", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/proofs/{run_id}", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/proofs/{run_id}/html", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/spec", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/spec/history", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/wiki", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/wiki/{section}", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/wiki/ask", action: "501", open: false, migrate: "" },
+];