loki-mode 10.7.1 → 10.9.1

package/packages/control-plane/src/server/audit.ts

@@ -0,0 +1,15 @@
+// Audit helper: one row per UI-initiated action. Never throws (an audit failure must not break the action) and never stores secrets.
+import type { Db } from "../db/migrate.ts";
+import { actions } from "../db/schema.ts";
+
+export type AuditEntry = { actor?: string; kind: string; target?: string; result: string; detail?: string };
+
+const clip = (s: string | undefined, n: number): string | null => (s === undefined ? null : s.slice(0, n));
+
+/** Records an action. Returns true when the row was written. */
+export function audit(db: Db, e: AuditEntry): boolean {
+  try {
+    db.insert(actions).values({ ts: new Date().toISOString(), actor: e.actor ?? "local", kind: e.kind, target: clip(e.target, 500), result: e.result, detail: clip(e.detail, 2000) }).run();
+    return true;
+  } catch { return false; }
+}

package/packages/control-plane/src/server/auth.ts

@@ -1,6 +1,6 @@
 // Control Plane auth: bearer token on /v1, Host allowlist on loopback (DNS rebinding), bind refusal without a token.
 import { createHash, timingSafeEqual } from "node:crypto";
-import type { MiddlewareHandler } from "hono";
+import type { Context, MiddlewareHandler } from "hono";
 
 const LOOPBACK_BINDS = new Set(["127.0.0.1", "localhost", "::1", "[::1]"]);
 
@@ -9,6 +9,12 @@ export function isLoopbackHost(host: string | undefined | null): boolean {
   return !!host && /^(127\.0\.0\.1|localhost|\[::1\])(:\d+)?$/i.test(host);
 }
 
+/** True when the real socket peer (not the spoofable Host header) is loopback. An unknown peer fails closed. */
+export function peerIsLoopback(c: Context): boolean {
+  const ip = (c.env as { requestIP?: (r: Request) => { address?: string } | null } | undefined)?.requestIP?.(c.req.raw)?.address;
+  return typeof ip === "string" && /^(127\.\d+\.\d+\.\d+|::1|::ffff:127\.\d+\.\d+\.\d+)$/.test(ip);
+}
+
 /** Constant-time check of an Authorization header against the token. Hashing first makes the compare length-safe. */
 export function tokenMatches(header: string | undefined | null, token: string): boolean {
   const m = /^Bearer (.+)$/i.exec(header ?? "");

package/packages/control-plane/src/server/legacy/routes-audit.ts

@@ -0,0 +1,50 @@
+// CPE24-P2: legacy (port 57374) mappings for audit and checkpoints. Reads share their implementation with routes/checkpoints.ts; the two POSTs
+// keep the /v1 rule (loopback peer, loopback Host, JSON) even though the shim guard already passed, so a token alone never reaches a restore.
+import type { Context } from "hono";
+import type { Db } from "../../db/migrate.ts";
+import { audit } from "../audit.ts";
+import { isLoopbackHost, peerIsLoopback } from "../auth.ts";
+import { auditSummary, createCheckpoint, getCheckpoint, listCheckpoints, parseDays, parseLimit, rollbackCheckpoint, validCheckpointId } from "../routes/checkpoints.ts";
+
+type AuditList = (c: Context) => { err: Response; rows?: undefined } | { err?: undefined; rows: unknown[] };
+
+const BAD_ID = "Invalid checkpoint_id: must be 1-128 chars of alphanumeric, hyphens, and underscores";
+
+export function auditCheckpointMapped(db: Db, repoDir: string, auditList: AuditList): Record<string, (c: Context) => Response | Promise<Response>> {
+  const local = (c: Context) => peerIsLoopback(c) && isLoopbackHost(c.req.header("host")) && (c.req.header("content-type") ?? "").toLowerCase().startsWith("application/json");
+  const refuse = (c: Context) => c.json({ detail: "loopback JSON requests only" }, 403);
+  return {
+    "GET /api/enterprise/audit": (c) => { const r = auditList(c); return r.err ?? c.json(r.rows); },
+    "GET /api/enterprise/audit/summary": (c) => c.json(auditSummary(db, parseDays(c.req.query("days")))),
+    "GET /api/checkpoints": (c) => c.json(listCheckpoints(repoDir, parseLimit(c.req.query("limit")))),
+    "GET /api/checkpoints/{checkpoint_id}": (c) => {
+      const id = c.req.param("checkpoint_id") ?? "";
+      if (!validCheckpointId(id)) return c.json({ detail: BAD_ID }, 400);
+      const m = getCheckpoint(repoDir, id);
+      return m ? c.json(m) : c.json({ detail: "Checkpoint not found" }, 404);
+    },
+    "POST /api/checkpoints": async (c) => {
+      if (!local(c)) return refuse(c);
+      const body = (await c.req.json().catch(() => ({}))) as { message?: unknown };
+      const message = typeof body?.message === "string" ? body.message : "";
+      if (message.length > 500) return c.json({ detail: "message must be at most 500 characters" }, 422);
+      try {
+        const meta = createCheckpoint(repoDir, message);
+        audit(db, { kind: "checkpoint.create", target: String(meta.id), result: "ok", detail: "legacy route" });
+        return c.json(meta, 201);
+      } catch (e) {
+        audit(db, { kind: "checkpoint.create", result: "error", detail: (e as Error).message });
+        return c.json({ detail: "could not create the checkpoint" }, 500);
+      }
+    },
+    "POST /api/checkpoints/{checkpoint_id}/rollback": (c) => {
+      if (!local(c)) return refuse(c);
+      const id = c.req.param("checkpoint_id") ?? "";
+      if (!validCheckpointId(id)) { audit(db, { kind: "checkpoint.rollback", target: id.slice(0, 128), result: "refused", detail: "invalid id (legacy route)" }); return c.json({ detail: BAD_ID }, 400); }
+      const r = rollbackCheckpoint(repoDir, id);
+      if (!r) { audit(db, { kind: "checkpoint.rollback", target: id, result: "refused", detail: "not found (legacy route)" }); return c.json({ detail: "Checkpoint not found" }, 404); }
+      audit(db, { kind: "checkpoint.rollback", target: id, result: r.errors.length ? "partial" : "ok", detail: `restored ${r.restored}; pre-rollback snapshot ${r.pre_rollback_snapshot} (legacy route)` });
+      return c.json({ ...r, message: `Restored ${r.restored} item(s) from ${id}. Prior state saved as ${r.pre_rollback_snapshot} (undo this rollback by restoring it).` });
+    },
+  };
+}

package/packages/control-plane/src/server/legacy/routes-control.ts

@@ -0,0 +1,26 @@
+// CPE24-P4: legacy (port 57374) mappings for session control and the Completion Council. They share the /v1 implementation in
+// routes/session_control.ts (fixed action enum, signal files only, same-origin check, audit row). The shim guard (CP token or loopback peer) has already run.
+import type { Context } from "hono";
+import type { Db } from "../../db/migrate.ts";
+import { councilConvergence, councilReport, councilState, councilTranscripts, councilVerdicts, intQ, runControl } from "../routes/session_control.ts";
+import { lokiDirOf } from "../routes/cost_ledger.ts";
+
+export function controlMapped(db: Db, repoDir: string): Record<string, (c: Context) => Response> {
+  const loki = () => lokiDirOf(repoDir);
+  return {
+    "POST /api/control/pause": (c) => runControl(db, repoDir, "pause", c, "legacy"),
+    "POST /api/control/resume": (c) => runControl(db, repoDir, "resume", c, "legacy"),
+    "POST /api/control/stop": (c) => runControl(db, repoDir, "stop", c, "legacy"),
+    "POST /api/council/force-review": (c) => runControl(db, repoDir, "council-review", c, "legacy"),
+    "GET /api/council/state": (c) => c.json(councilState(loki())),
+    "GET /api/council/verdicts": (c) => { const n = intQ(c.req.query("limit"), 1000); return n === null || n === 0 ? c.json({ detail: "limit must be 1..1000" }, 422) : c.json(councilVerdicts(loki(), n)); },
+    "GET /api/council/convergence": (c) => c.json(councilConvergence(loki())),
+    "GET /api/council/report": (c) => c.json(councilReport(loki())),
+    "GET /api/council/transcripts": (c) => {
+      const limit = intQ(c.req.query("limit"), 200), iterMin = intQ(c.req.query("iter_min"), Number.MAX_SAFE_INTEGER);
+      if (limit === null || limit === 0 || iterMin === null) return c.json({ detail: "limit must be 1..200 and iter_min a non-negative integer" }, 422);
+      const r = councilTranscripts(loki(), { limit, since: c.req.query("since"), iter_min: iterMin });
+      return "error" in r ? c.json({ detail: r.error }, 400) : c.json(r);
+    },
+  };
+}

package/packages/control-plane/src/server/legacy/routes-memory.ts

@@ -0,0 +1,30 @@
+// CPE24-P3: legacy (port 57374) mappings for memory, context, focus and tasks. Each reads the same source as its /v1 route (routes/memory.ts)
+// and keeps the legacy response shape. The shim's guard (legacyGuard) has already run; POST /api/focus adds the same loopback, JSON and Origin checks as /v1/focus.
+import type { Context } from "hono";
+import { contextTracking, focusInfo, lokiFor, memoryEconomics, memoryEpisode, memoryEpisodes, memoryPatterns, memorySkills, mutationAllowed, setFocus, tasksList } from "../routes/memory.ts";
+
+export function memoryMapped(repoDir: string): Record<string, (c: Context) => Response | Promise<Response>> {
+  const loki = () => lokiFor(repoDir);
+  return {
+    "GET /api/tasks": (c) => {
+      if (c.req.query("project_id") !== undefined) return c.json({ detail: "project_id filter is not supported by the Control Plane" }, 400);
+      return c.json(tasksList(loki(), c.req.query("status")));
+    },
+    "GET /api/memory/episodes": (c) => {
+      const lim = c.req.query("limit") === undefined ? 50 : Number(c.req.query("limit"));
+      return Number.isInteger(lim) && lim >= 1 && lim <= 1000 ? c.json(memoryEpisodes(loki(), lim)) : c.json({ detail: "limit must be 1..1000" }, 422);
+    },
+    "GET /api/memory/episodes/{episode_id}": (c) => { const e = memoryEpisode(loki(), c.req.param("episode_id") ?? ""); return e ? c.json(e) : c.json({ detail: "Episode not found" }, 404); },
+    "GET /api/memory/patterns": (c) => c.json(memoryPatterns(loki())),
+    "GET /api/memory/patterns/{pattern_id}": (c) => { const p = memoryPatterns(loki()).find((x) => x.id === c.req.param("pattern_id")); return p ? c.json(p) : c.json({ detail: "Pattern not found" }, 404); },
+    "GET /api/memory/skills": (c) => c.json(memorySkills(loki())),
+    "GET /api/memory/economics": (c) => c.json(memoryEconomics(loki())),
+    "GET /api/context": (c) => { const r = contextTracking(loki()); return c.json(r.body, r.status); },
+    "POST /api/focus": async (c) => {
+      if (!mutationAllowed(c)) return c.json({ detail: "loopback JSON requests only" }, 403);
+      const body = await c.req.json().catch(() => null);
+      const r = setFocus(repoDir, typeof body === "object" && body !== null ? (body as Record<string, unknown>).project_dir : undefined);
+      return r.ok ? c.json(focusInfo(repoDir)) : c.json({ detail: r.error }, 400);
+    },
+  };
+}

package/packages/control-plane/src/server/legacy/routes-metrics.ts

@@ -0,0 +1,18 @@
+// CPE24-P1: legacy (port 57374) mappings for metrics, cost and fleet spend. Each reads the same source as its /v1 route (routes/metrics.ts,
+// routes/cost_ledger.ts, routes/fleet.ts) and keeps the legacy response shape. The shim's guard (legacyGuard) has already run.
+import type { Context } from "hono";
+import { costSnapshot, costTimeline, lokiDirOf } from "../routes/cost_ledger.ts";
+import { fleetRuns, fleetSummary, parseInactive } from "../routes/fleet.ts";
+import { buildMetricsText } from "../routes/metrics.ts";
+
+export function metricsMapped(repoDir: string): Record<string, (c: Context) => Response> {
+  const inactive = (c: Context) => parseInactive(c.req.query("include_inactive"));
+  return {
+    "GET /api/cost": (c) => c.json(costSnapshot(lokiDirOf(repoDir))),
+    "GET /api/cost/timeline": (c) => c.json(costTimeline(lokiDirOf(repoDir))),
+    "GET /metrics": (c) => c.text(buildMetricsText(repoDir), 200, { "content-type": "text/plain; charset=utf-8" }),
+    // Legacy rows carry the project path; the guarded shim serves only authenticated or loopback callers, like legacy.
+    "GET /api/fleet/runs": (c) => c.json(fleetRuns(inactive(c))),
+    "GET /api/fleet/summary": (c) => c.json(fleetSummary(inactive(c))),
+  };
+}

package/packages/control-plane/src/server/legacy/routes.ts

@@ -0,0 +1,237 @@
+// GENERATED from docs/v10/CP-ENTERPRISE-UI.md section 5.2 (one row per legacy dashboard route that the shim answers).
+// test/server/legacy-shim.test.ts asserts this table and the doc table agree. Regenerate both together, never one alone.
+export type LegacyAction = "map" | "308" | "410" | "501";
+export interface LegacyRoute { method: string; path: string; action: LegacyAction; open: boolean; migrate: string }
+
+export const LEGACY_ROUTES: readonly LegacyRoute[] = [
+  { method: "GET", path: "/openapi.json", action: "410", open: true, migrate: "" },
+  { method: "GET", path: "/docs", action: "410", open: true, migrate: "" },
+  { method: "GET", path: "/docs/oauth2-redirect", action: "410", open: true, migrate: "" },
+  { method: "GET", path: "/redoc", action: "410", open: true, migrate: "" },
+  { method: "POST", path: "/api/v2/tenants", action: "410", open: false, migrate: "no tenants: local single user" },
+  { method: "GET", path: "/api/v2/tenants", action: "410", open: false, migrate: "no tenants: local single user" },
+  { method: "GET", path: "/api/v2/tenants/{tenant_id}", action: "410", open: false, migrate: "no tenants: local single user" },
+  { method: "PUT", path: "/api/v2/tenants/{tenant_id}", action: "410", open: false, migrate: "" },
+  { method: "DELETE", path: "/api/v2/tenants/{tenant_id}", action: "410", open: false, migrate: "no tenants: local single user" },
+  { method: "GET", path: "/api/v2/tenants/{tenant_id}/projects", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/v2/runs", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/v2/runs", action: "map", open: false, migrate: "/v1/runs" },
+  { method: "GET", path: "/api/v2/runs/{run_id}", action: "map", open: false, migrate: "/v1/runs/:id" },
+  { method: "POST", path: "/api/v2/runs/{run_id}/cancel", action: "501", open: false, migrate: "" },
+  { method: "POST", path: "/api/v2/runs/{run_id}/replay", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/v2/runs/{run_id}/timeline", action: "map", open: false, migrate: "/v1/runs/:id" },
+  { method: "POST", path: "/api/v2/api-keys", action: "410", open: false, migrate: "CP bearer token set by env (LOKI_CONTROL_TOKEN)" },
+  { method: "GET", path: "/api/v2/api-keys", action: "410", open: false, migrate: "CP bearer token set by env (LOKI_CONTROL_TOKEN)" },
+  { method: "GET", path: "/api/v2/api-keys/{identifier}", action: "410", open: false, migrate: "" },
+  { method: "PUT", path: "/api/v2/api-keys/{identifier}", action: "410", open: false, migrate: "" },
+  { method: "DELETE", path: "/api/v2/api-keys/{identifier}", action: "410", open: false, migrate: "CP bearer token set by env (LOKI_CONTROL_TOKEN)" },
+  { method: "POST", path: "/api/v2/api-keys/{identifier}/rotate", action: "410", open: false, migrate: "CP bearer token set by env (LOKI_CONTROL_TOKEN)" },
+  { method: "GET", path: "/api/v2/policies", action: "410", open: false, migrate: "" },
+  { method: "PUT", path: "/api/v2/policies", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/v2/policies/evaluate", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/v2/audit", action: "map", open: false, migrate: "/v1/audit" },
+  { method: "GET", path: "/api/v2/audit/verify", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/v2/audit/export", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/operator/runs/{run_id}", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/operator/tests", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/operator/receipts", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/operator/releases", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/operator/phases", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/operator/workspaces/runs", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/operator/workspaces/runs/{ws}/{run_id}", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/onboarding/state", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/onboarding/provider", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/onboarding/github", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/onboarding/repos", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/onboarding/repo", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/backlog/issues", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/backlog/run", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/backlog/status", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/v1/runs", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/v1/runs/{run_id}", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/v1/runs", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/v1/runs/{run_id}/stop", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/start", action: "308", open: false, migrate: "/" },
+  { method: "MOUNT", path: "/lab", action: "308", open: true, migrate: "/" },
+  { method: "GET", path: "/api/providers/models", action: "410", open: true, migrate: "" },
+  { method: "GET", path: "/.well-known/agent.json", action: "map", open: true, migrate: "/v1/runs" },
+  { method: "GET", path: "/api/status", action: "map", open: false, migrate: "/v1/runs" },
+  { method: "GET", path: "/api/projects", action: "501", open: false, migrate: "" },
+  { method: "POST", path: "/api/projects", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/projects/{project_id}", action: "501", open: false, migrate: "" },
+  { method: "PUT", path: "/api/projects/{project_id}", action: "501", open: false, migrate: "" },
+  { method: "DELETE", path: "/api/projects/{project_id}", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/tasks", action: "map", open: false, migrate: "/v1/tasks" },
+  { method: "POST", path: "/api/tasks", action: "410", open: false, migrate: "no v10 task queue; read-only GET /v1/tasks" },
+  { method: "GET", path: "/api/tasks/{task_id}", action: "410", open: false, migrate: "no v10 task queue; read-only GET /v1/tasks" },
+  { method: "PUT", path: "/api/tasks/{task_id}", action: "410", open: false, migrate: "no v10 task queue; read-only GET /v1/tasks" },
+  { method: "DELETE", path: "/api/tasks/{task_id}", action: "410", open: false, migrate: "no v10 task queue; read-only GET /v1/tasks" },
+  { method: "POST", path: "/api/tasks/{task_id}/move", action: "410", open: false, migrate: "no v10 task queue; read-only GET /v1/tasks" },
+  { method: "WS", path: "/ws", action: "410", open: true, migrate: "SSE at GET /v1/stream" },
+  { method: "GET", path: "/api/registry/projects", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/registry/projects", action: "410", open: false, migrate: "repos are discovered locally; GET /v1/repos" },
+  { method: "GET", path: "/api/registry/projects/{identifier}", action: "410", open: false, migrate: "" },
+  { method: "DELETE", path: "/api/registry/projects/{identifier}", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/registry/projects/{identifier}/health", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/registry/projects/{identifier}/access", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/registry/discover", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/registry/sync", action: "410", open: false, migrate: "repos are discovered locally; GET /v1/repos" },
+  { method: "GET", path: "/api/registry/tasks", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/registry/learnings", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/fleet/runs", action: "map", open: false, migrate: "/v1/fleet/runs" },
+  { method: "GET", path: "/api/fleet/summary", action: "map", open: false, migrate: "/v1/fleet/summary" },
+  { method: "GET", path: "/api/fleet/runs/{identifier}", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/focus", action: "map", open: false, migrate: "/v1/focus" },
+  { method: "GET", path: "/api/focus", action: "410", open: false, migrate: "" },
+  { method: "DELETE", path: "/api/focus", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/session/model", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/session/model", action: "410", open: false, migrate: "no mid-run model switch; start a new run with another model (POST /v1/runs)" },
+  { method: "GET", path: "/api/running-projects", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/control/start", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/control/builds/{execution_id}", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/control/builds/{execution_id}/proof", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/control/builds/{execution_id}/stop", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/running-projects/stop", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/fleet/runs/{identifier}/retry", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/fleet/runs/{identifier}/cancel", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/enterprise/status", action: "410", open: true, migrate: "" },
+  { method: "GET", path: "/api/auth/info", action: "410", open: true, migrate: "" },
+  { method: "POST", path: "/api/enterprise/tokens", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/enterprise/tokens", action: "410", open: false, migrate: "" },
+  { method: "DELETE", path: "/api/enterprise/tokens/{identifier}", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/enterprise/audit", action: "map", open: false, migrate: "/v1/audit" },
+  { method: "GET", path: "/api/enterprise/audit/summary", action: "map", open: false, migrate: "/v1/audit/summary" },
+  { method: "GET", path: "/api/compliance", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/memory/summary", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/memory/episodes", action: "map", open: false, migrate: "/v1/memory/episodes" },
+  { method: "GET", path: "/api/memory/episodes/{episode_id}", action: "map", open: false, migrate: "/v1/memory/episodes/{id}" },
+  { method: "GET", path: "/api/memory/patterns", action: "map", open: false, migrate: "/v1/memory/patterns" },
+  { method: "GET", path: "/api/memory/patterns/{pattern_id}", action: "map", open: false, migrate: "/v1/memory/patterns/{id}" },
+  { method: "GET", path: "/api/memory/skills", action: "map", open: false, migrate: "/v1/memory/skills" },
+  { method: "GET", path: "/api/memory/skills/{skill_id}", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/memory/economics", action: "map", open: false, migrate: "/v1/memory/economics" },
+  { method: "POST", path: "/api/memory/consolidate", action: "410", open: false, migrate: "read-only GET /v1/memory/*" },
+  { method: "POST", path: "/api/memory/retrieve", action: "410", open: false, migrate: "read-only GET /v1/memory/*" },
+  { method: "GET", path: "/api/memory/index", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/memory/timeline", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/memory/files", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/memory/file", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/memory/search", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/memory/stats", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/learning/metrics", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/learning/trends", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/learning/signals", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/learning/aggregation", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/learning/aggregate", action: "410", open: false, migrate: "read-only GET /v1/memory/patterns" },
+  { method: "GET", path: "/api/learning/preferences", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/learning/errors", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/learning/success", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/learning/tools", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/control/pause", action: "map", open: false, migrate: "/v1/control/pause" },
+  { method: "POST", path: "/api/control/resume", action: "map", open: false, migrate: "/v1/control/resume" },
+  { method: "POST", path: "/api/control/stop", action: "map", open: false, migrate: "/v1/control/stop" },
+  { method: "GET", path: "/api/cost", action: "map", open: false, migrate: "/v1/cost/snapshot" },
+  { method: "GET", path: "/api/budget", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/cost/timeline", action: "map", open: false, migrate: "/v1/cost/timeline" },
+  { method: "GET", path: "/api/trust/trajectory", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/gate-policy", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/pricing", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/council/state", action: "map", open: false, migrate: "/v1/council/state" },
+  { method: "GET", path: "/api/council/verdicts", action: "map", open: false, migrate: "/v1/council/verdicts" },
+  { method: "GET", path: "/api/council/convergence", action: "map", open: false, migrate: "/v1/council/convergence" },
+  { method: "GET", path: "/api/council/report", action: "map", open: false, migrate: "/v1/council/report" },
+  { method: "POST", path: "/api/council/force-review", action: "map", open: false, migrate: "/v1/control/council-review" },
+  { method: "GET", path: "/api/council/transcripts", action: "map", open: false, migrate: "/v1/council/transcripts" },
+  { method: "GET", path: "/api/council/transcripts/{iteration_id}", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/context", action: "map", open: false, migrate: "/v1/context" },
+  { method: "GET", path: "/api/notifications", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/notifications/triggers", action: "410", open: false, migrate: "" },
+  { method: "PUT", path: "/api/notifications/triggers", action: "410", open: false, migrate: "GET /v1/notifications (derived from events)" },
+  { method: "POST", path: "/api/notifications/{notification_id}/acknowledge", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/notifications/{notification_id}/unacknowledge", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/checkpoints", action: "map", open: false, migrate: "/v1/checkpoints" },
+  { method: "GET", path: "/api/checkpoints/{checkpoint_id}", action: "map", open: false, migrate: "/v1/checkpoints/{id}" },
+  { method: "POST", path: "/api/checkpoints", action: "map", open: false, migrate: "/v1/checkpoints" },
+  { method: "POST", path: "/api/checkpoints/{checkpoint_id}/rollback", action: "map", open: false, migrate: "/v1/checkpoints/{id}/rollback" },
+  { method: "GET", path: "/api/agents", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/agents/{agent_id}/kill", action: "410", open: false, migrate: "POST /v1/control/stop" },
+  { method: "POST", path: "/api/agents/{agent_id}/pause", action: "410", open: false, migrate: "POST /v1/control/stop (v10 has no pause)" },
+  { method: "POST", path: "/api/agents/{agent_id}/resume", action: "410", open: false, migrate: "POST /v1/control/resume" },
+  { method: "GET", path: "/api/logs", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/collab/join", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/collab/leave", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/collab/users", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/collab/users/{user_id}", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/collab/users/{user_id}/heartbeat", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/collab/users/{user_id}/cursor", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/collab/users/{user_id}/status", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/collab/presence", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/collab/file/{file_path:path}", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/collab/state", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/collab/state/value", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/collab/operation", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/collab/sync", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/collab/history", action: "410", open: false, migrate: "" },
+  { method: "WS", path: "/ws/collab", action: "410", open: true, migrate: "" },
+  { method: "GET", path: "/api/collab/status", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/secrets/status", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/github/status", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/github/tasks", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/github/sync-log", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/health/processes", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/metrics", action: "map", open: false, migrate: "/v1/metrics" },
+  { method: "GET", path: "/api/checklist", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/usage", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/checklist/summary", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/prd-observations", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/checklist/waivers", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/checklist/waivers", action: "410", open: false, migrate: "plan.json and receipt claims in GET /v1/runs/:id" },
+  { method: "DELETE", path: "/api/checklist/waivers/{item_id}", action: "410", open: false, migrate: "plan.json and receipt claims in GET /v1/runs/:id" },
+  { method: "GET", path: "/api/council/gate", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/app-runner/status", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/app-runner/logs", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/app-runner/errors", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/control/app-restart", action: "410", open: false, migrate: "evidence in GET /v1/runs/:source/:run/artifact/*" },
+  { method: "POST", path: "/api/control/app-stop", action: "410", open: false, migrate: "evidence in GET /v1/runs/:source/:run/artifact/*" },
+  { method: "GET", path: "/api/playwright/results", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/playwright/screenshot", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/failures", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/prompt-versions", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/prompt-optimize", action: "410", open: false, migrate: "verify stage: POST /v1/runs/:source/:run/verify" },
+  { method: "GET", path: "/api/activity", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/session-diff", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/activity", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/cost", action: "308", open: false, migrate: "/" },
+  { method: "GET", path: "/trust", action: "308", open: false, migrate: "/" },
+  { method: "GET", path: "/", action: "308", open: false, migrate: "/" },
+  { method: "GET", path: "/api/quality-score", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/quality-score/history", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/quality-scan", action: "410", open: false, migrate: "verify stage: POST /v1/runs/:source/:run/verify" },
+  { method: "GET", path: "/api/quality-report", action: "410", open: false, migrate: "verify stage: POST /v1/runs/:source/:run/verify" },
+  { method: "GET", path: "/api/migration/list", action: "501", open: false, migrate: "" },
+  { method: "POST", path: "/api/migration/start", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/migration/{migration_id}/status", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/migration/{migration_id}/plan", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/migration/{migration_id}/features", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/migration/{migration_id}/seams", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/migration/{migration_id}/advance", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/migration/{migration_id}/start-phase", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/managed/events", action: "410", open: false, migrate: "managed memory dropped; GET /v1/runs/:source/:run/events" },
+  { method: "GET", path: "/api/managed/status", action: "410", open: false, migrate: "managed memory dropped; GET /v1/runs" },
+  { method: "GET", path: "/api/managed/memory_versions/{memory_id}", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/findings/{iteration}", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/quality/architecture", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/learnings", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/escalations", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/escalations/{filename}", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/phases", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/proofs", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/proofs/summary", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/proofs/{run_id}", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/proofs/{run_id}/html", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/spec", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/spec/history", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/wiki", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/wiki/{section}", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/wiki/ask", action: "410", open: false, migrate: "wiki deleted; no replacement" },
+];