loki-mode 10.8.0 → 10.10.1

package/.github/actions/issue-to-pr/action.yml

@@ -10,7 +10,7 @@ branding:
 # must not hold a write token. Run it with `permissions: contents: read,
 # issues: read` and `actions/checkout` with `persist-credentials: false`, upload
 # `outputs.patch`, and push and open the PR from a second job that runs no
-# agent. .github/workflows/loki-issue-to-pr.yml in asklokesh/loki-mode is the
+# agent. docs/examples/loki-issue-to-pr.yml.example in asklokesh/loki-mode is the
 # reference. Earlier versions pushed and opened the PR from the same step that
 # ran the agent; this one does not.
 #
@@ -247,7 +247,7 @@ runs:
         echo "patch=$OUT/loki.patch" >> "$GITHUB_OUTPUT"
         echo "pr_body=$OUT/pr-body.md" >> "$GITHUB_OUTPUT"
 
-        echo "::warning::This action does not open the pull request (Rule of Two). Upload outputs.patch and open the PR from a job that holds the write token and runs no agent; see .github/workflows/loki-issue-to-pr.yml in asklokesh/loki-mode."
+        echo "::warning::This action does not open the pull request (Rule of Two). Upload outputs.patch and open the PR from a job that holds the write token and runs no agent; see docs/examples/loki-issue-to-pr.yml.example in asklokesh/loki-mode."
         if [ -n "$RUN_DIR" ]; then
           echo "Loki 10 receipt under $RUN_DIR/"
         fi

package/README.md

@@ -9,6 +9,12 @@ An autonomous software factory that knows what it is supposed to deliver, and pr
 
 [Website](https://www.autonomi.dev/) | [Documentation](wiki/Home.md) | [Installation](docs/INSTALLATION.md) | [Changelog](CHANGELOG.md)
 
+<!-- generated:facts -->
+The npm badge above tracks the current release; see [CHANGELOG.md](CHANGELOG.md) for release notes.
+
+CLI reference: [docs/CLI-REFERENCE.md](docs/CLI-REFERENCE.md) (generated from the command registry).
+<!-- /generated -->
+
 Loki Mode is a free, source-available autonomous coding agent by [Autonomi](https://www.autonomi.dev/). Hand it a PRD, GitHub issue, OpenAPI doc or one-line brief. It derives a delivery contract (the acceptance criteria), builds against it, and ends with a signed Evidence Receipt that states what was proven and what was not. If the contract cannot be derived, it stops and asks one question instead of guessing.
 
 Before a build counts as done, a review council selects reviewers from a specialist pool (`agents/types.json`, scored by `run.sh:FOCUS_KEYWORDS`). The bundled MCP server exposes 39 tools over stdio (`mcp/server.py`), including `loki_v10_run`, `loki_v10_status` and `loki_v10_verify` to start a Loki 10 run in the background, read its phase, verdict and cost, and verify its receipt (`BLOCKED` runs report their question). Add it with `claude mcp add loki-mode -- python3 -m mcp.server` from the install directory.
@@ -88,7 +94,7 @@ loki owner/repo#123
 
 The v10 engine accepts a quoted multi-word task, a GitHub, GitLab or Jira issue reference, `status`, `verify`, `dashboard`, and other subcommands. Flags (`loki-ts/src/engine10/cli.ts` USAGE): `--no-pr` builds and verifies without opening a pull request, `--deep` requests the deep verify pass and a longer implement budget, `--provider <name>` picks the coding provider, `--max-cost <usd>` sets the per-run cost cap (default $100.00 when an API key is set, no dollar cap on a subscription run where the start line adds `subscription: no dollar cap; usage counts against your plan limits`; or `budgets.per_run` in `loki.yaml`; the flag wins; the start line prints it as `cap $100.00 (default)`; reaching it ends the run BUDGET_STOP, exit 3) (`--json` and `--verbose` are also parsed by the supervisor, see [Quiet output](#quiet-output)). The engine needs Bun; without it the command exits 1 with a message and installation instructions.
 
-**Legacy engine (being removed).** The previous engine still ships in 10.6.6 and is reachable with `LOKI_ENGINE=legacy` or `loki legacy <args>`. `loki start owner/repo#N`, `loki start <issue URL>` and `loki start "<multi-word task>"` run on Loki 10, the same as `loki owner/repo#N` and `loki "<task>"`; `loki start ./prd.md`, a flag-first call and a one-word start stay on the legacy engine. For many issues use `loki backlog owner/repo --all|--label X|--issues N,N` (many issues, N in parallel, each on a `loki/backlog-N` worktree branch) instead. Legacy removal is planned and resumes on 2026-10-07; see [docs/v10/LEGACY-REMOVAL.md](docs/v10/LEGACY-REMOVAL.md). Sections below marked "legacy" describe features that run only on that engine.
+**Legacy engine (being removed).** Migration note: the previous engine is being removed and has no engine switch; use `loki "<task>"` and `loki owner/repo#N`. `loki start owner/repo#N`, `loki start <issue URL>` and `loki start "<multi-word task>"` run on Loki 10, the same as `loki owner/repo#N` and `loki "<task>"`; `loki start ./prd.md`, a flag-first call and a one-word start stay on the legacy engine. For many issues use `loki backlog owner/repo --all|--label X|--issues N,N` (many issues, N in parallel, each on a `loki/backlog-N` worktree branch) instead. Legacy removal is planned and resumes on 2026-10-07; see [docs/v10/LEGACY-REMOVAL.md](docs/v10/LEGACY-REMOVAL.md). Sections below marked "legacy" describe features that run only on that engine.
 
 ### The state machine
 
@@ -154,7 +160,7 @@ The run cap is 900s (2700s with `--deep`, `DEFAULT_CAP_S` and `DEEP_CAP_S` in `t
 
 A finished run prints a short summary (see [Quiet output](#quiet-output), which also shows an example) whose `NOT PROVEN` line is never empty by omission: deep checks deferred to the deep-verify pass are always listed there.
 
-`loki status [run-id]` and `loki verify [run-id]` are built on the v10 path (bare `loki verify` follows the newest run, v10 or legacy). `loki dashboard` and `loki status` reach the v10 commands with `LOKI_ENGINE=v10`. Two-way Slack (`loki slack serve`) is on by default and documented in [docs/slack.md](docs/slack.md); outbound notifications use `LOKI_SLACK_WEBHOOK_URL`.
+`loki status [run-id]` and `loki verify [run-id]` are built on the v10 path (bare `loki verify` follows the newest run, v10 or legacy). Two-way Slack (`loki slack serve`) is on by default and documented in [docs/slack.md](docs/slack.md); outbound notifications use `LOKI_SLACK_WEBHOOK_URL`.
 
 ## Run from Jira or Linear
 
@@ -182,7 +188,7 @@ On by default; set `LOKI_CONTRACT=0` to turn it off. It does nothing unless `.lo
 
 Both run on your own GitHub Actions minutes; there is no hosted service.
 
-- Issue to PR: copy `.github/workflows/loki-issue-to-pr.yml` into your repository. Label an issue `loki`, or comment `/loki` as an owner, member or collaborator, and it runs `loki owner/repo#N` (the Loki 10 engine) and opens a pull request with an evidence receipt. The agent job holds a read-only token; a separate publish job opens the PR. Set `ANTHROPIC_API_KEY` in repository secrets.
+- Issue to PR: copy `docs/examples/loki-issue-to-pr.yml.example` to `.github/workflows/loki-issue-to-pr.yml` in your repository. Label an issue `loki`, or comment `/loki` as an owner, member or collaborator, and it runs `loki owner/repo#N` (the Loki 10 engine) and opens a pull request with an evidence receipt. The agent job holds a read-only token; a separate publish job opens the PR. Set `ANTHROPIC_API_KEY` in repository secrets.
 - Nightly backlog: copy `examples/loki-nightly-backlog.yml` into `.github/workflows/`. Its `schedule:` trigger runs `loki backlog owner/repo --label loki`, one Loki 10 run per labeled open issue:
 
 ```yaml
@@ -310,7 +316,7 @@ The URL comes from `LOKI_CONTROL_URL`, else `http://127.0.0.1:${LOKI_CONTROL_POR
 
 Answering a BLOCKED run: when a run stops on a spec conflict, its run page shows the question and an answer box. Submitting posts to `POST /v1/runs/<source>/<run>/answer` (JSON `{"answer": "..."}`, up to 4000 characters, loopback only) and writes `~/.loki/control/answers/<source>/<run>.answer.txt` (override the directory with `LOKI_CONTROL_ANSWER_DIR`). The page prints the resume command, `loki answer <run>`, which starts a fresh run carrying the task, the question and that file's text (or pass `--text "..."` yourself; with no run id it picks the newest BLOCKED run). A run that is not BLOCKED exits 2.
 
-Set `LOKI_CONTROL_DEFAULT=1` (off by default) to make `loki dashboard`, `loki dashboard start` and `loki dashboard open` start the Control Plane instead of the old dashboard. The old dashboard is unchanged when the flag is unset.
+The Control Plane is the only UI. `loki dashboard`, `loki dashboard start` and `loki dashboard open` open it (starting `loki control serve` if none is running). The classic dashboard UI and its port 57374 are removed in 10.8; see [docs/control-plane-migration.md](docs/control-plane-migration.md) for the route mapping and what is not yet available.
 
 Container, Helm and ECS deployment: [docs/control-plane-container.md](docs/control-plane-container.md).
 
@@ -588,7 +594,7 @@ Legacy engine, being removed (these run on the previous engine; `loki --help` st
 | `loki stop`, `pause`, `resume` | Control a legacy run |
 | `loki steer "<note>"` | Nudge a legacy run (needs `LOKI_PROMPT_INJECTION=1`) |
 | `loki why`, `loki next` | Explain or continue a legacy run |
-| `loki dashboard` | Operations UI server (`start\|stop\|status\|url\|open`) |
+| `loki dashboard` | Open the Control Plane UI (see [docs/control-plane-migration.md](docs/control-plane-migration.md)) |
 | `loki review`, `loki test`, `loki analyze`, `loki memory`, `loki failover`, `loki enterprise`, `loki import`, `loki ci` | Review, test generation, codebase analysis, memory, failover, enterprise, issue import, CI gate |
 | `loki modernize heal <path>` | Legacy system healing |
 

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: An autonomous software factory that knows what it is supposed to deliver, and proves it did. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v10.8.0
+# Loki Mode v10.10.1
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the legacy engine, which still ships and is being removed (`loki start owner/repo#N` still routes to it; prefer `loki owner/repo#N`).
 
@@ -195,6 +195,16 @@ This protocol governs **skill module** loading -- task-scoped instruction files
 
 ---
 
+## Command list
+
+<!-- generated:commands -->
+Commands (generated from `loki-ts/src/cli/registry.ts`; full reference in `docs/CLI-REFERENCE.md`):
+
+`version`, `status`, `doctor`, `provider`, `memory`, `rollback`, `proof`, `wiki`, `control`, `kpis`, `report`, `trust`, `crash`, `contract`, `start`, `slack`, `answer`, `engine10`, `help`, `quick`, `quickstart`, `init`, `template`, `verify`, `keys`, `review`, `dashboard`, `config`, `mcp`, `acp`, `stop`, `pause`, `resume`, `why`, `next`, `logs`, `ship`, `deploy`, `import`, `github`, `issue`, `ci`, `modernize`, `share`, `assets`, `export`, `notify`, `tour`, `welcome`, `onboard`, `setup-skill`, `self-update`, `remote`, `cockpit`, `code`, `context`, `secrets`, `api`, `sandbox`, `docker`, `web`, `preview`, `telemetry`, `syslog`, `explain`, `docs`, `test`, `bench`, `voice`, `own`, `secure`, `compliance`, `enterprise`, `projects`, `audit`, `cost`, `metrics`, `sentrux`, `magic`
+<!-- /generated -->
+
+---
+
 ## Invocation
 
 **Legacy entry point (v6.84.0, being removed; for Loki 10 use `loki "<task>"` or `loki owner/repo#N`):** `loki start [SPEC|ISSUE-REF]` auto-detects whether the input is a PRD file, an issue URL, an issue number, or another spec format (e.g. OpenAPI). No need to pick between `loki start` and `loki run` -- the single command handles all cases.
@@ -473,4 +483,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v10.8.0 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v10.10.1 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-10.8.0
+10.10.1

package/autonomy/lib/proof-generator.py

@@ -2406,6 +2406,7 @@ def generate(args):
                 job_id=str(redacted.get("run_id") or ""),
                 run_id=str(redacted.get("run_id") or ""),
                 receipt_hash=digest,
+                verification=verification,
             )
             if _tok:
                 verification["attestation"] = _tok

package/autonomy/loki

@@ -918,7 +918,7 @@ import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, sys, hashlib, urllib.request
 sys.path.insert(0, sys.argv[3])
 try:
-    from receipt_jwt import verify_attestation, _CRYPTO_AVAILABLE
+    from receipt_jwt import verify_attestation, check_seal_meta, _CRYPTO_AVAILABLE
 except ImportError:
     sys.exit(1)          # -> "" : cannot check, never a verdict
 proof = json.load(open(sys.argv[1]))
@@ -966,10 +966,14 @@ if not ok:
 # receipt. Recompute the digest the same way the receipt records it (with
 # `verification` stripped) and require the signed claim to match, or a valid
 # token lifted from a different run would vouch for these bytes.
-proof.pop("verification", None)
+_vmeta = proof.pop("verification", None)
 canon = json.dumps(proof, sort_keys=True, separators=(",", ":")).encode()
-print("ok" if claims.get("receipt_sha256") == hashlib.sha256(canon).hexdigest()
-      else "bad")
+if claims.get("receipt_sha256") != hashlib.sha256(canon).hexdigest():
+    print("bad"); sys.exit(0)
+# seal.v2: the verification.* metadata (scope, algo, attestation_kid, ...) is
+# inside the signature; a token that signs different metadata is refused. A
+# legacy seal.v1 token still verifies (its metadata is simply unsigned).
+print("ok" if check_seal_meta(tok, claims, _vmeta)[0] != "bad" else "bad")
 PY
 }
 
@@ -1052,7 +1056,7 @@ import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, sys, os, hashlib, urllib.request
 sys.path.insert(0, sys.argv[3])
 try:
-    from receipt_jwt import verify_attestation, _CRYPTO_AVAILABLE
+    from receipt_jwt import verify_attestation, check_seal_meta, _CRYPTO_AVAILABLE
 except ImportError:
     sys.exit(1)                      # "" : cannot check
 try:
@@ -1117,10 +1121,32 @@ if not ok:
 # A verifying signature is not enough: it must attest to THESE bytes. Recompute
 # the digest the way the receipt records it, so a token lifted from another run
 # cannot vouch for this one.
-proof.pop("verification", None)
+_vmeta = proof.pop("verification", None)
 canon = json.dumps(proof, sort_keys=True, separators=(",", ":")).encode()
-print("ok" if claims.get("receipt_sha256") == hashlib.sha256(canon).hexdigest()
-      else "bad")
+if claims.get("receipt_sha256") != hashlib.sha256(canon).hexdigest():
+    print("bad"); sys.exit(0)
+# seal.v2: the verification.* metadata (scope, algo, attestation_kid, ...) is
+# inside the signature; a token that signs different metadata is refused. A
+# legacy seal.v1 token still verifies (its metadata is simply unsigned).
+print("ok" if check_seal_meta(tok, claims, _vmeta)[0] != "bad" else "bad")
+PY
+}
+
+# Prints "legacy" when the receipt's attestation is a seal.v1 token (the
+# verification.* metadata is NOT inside the signature), else nothing. Callers
+# append "metadata not signed (legacy seal.v1)" to a VERIFIED line.
+loki_proof_seal_legacy() {
+    python3 -E - "$1" "${_LOKI_SCRIPT_DIR}" 2>/dev/null <<'PY' || true
+import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
+import json, sys
+sys.path.insert(0, sys.argv[2])
+from receipt_jwt import _b64url_decode
+try:
+    tok = json.load(open(sys.argv[1]))["verification"]["attestation"]
+    claims = json.loads(_b64url_decode(tok.split(".")[1]))
+    print("legacy" if "seal" not in claims else "")
+except Exception:
+    print("")
 PY
 }
 
@@ -2032,12 +2058,11 @@ cmd_ui() {
             LOKI_DASHBOARD_CORS="http://localhost:$port,http://127.0.0.1:$port" \
             cmd_dashboard_start --host 127.0.0.1 --port "$port" >&2 || return 1
     fi
-    local url="http://127.0.0.1:${port}/start"
-    if [ "${LOKI_HEADLESS:-0}" = "1" ] || [ "${1:-}" = "--no-open" ]; then
-        echo "$url"
-    else
-        loki_open_url "$url" || echo "$url"
-    fi
+    # The classic server is API-only; the UI is the Control Plane.
+    local url="http://127.0.0.1:${port}"
+    echo "loki: the classic dashboard at $url serves the API only (the browser UI moved to the Control Plane)." >&2
+    echo "loki: start the Control Plane UI with: loki ui (needs bun)" >&2
+    echo "$url"
 }
 
 # Tight newcomer landing for the bare `loki` invocation (no args).
@@ -3915,18 +3940,9 @@ cmd_start() {
                 # + cockpit, honoring the card's "open dashboard" promise. The
                 # cockpit hint is printed by _loki_start_handoff for the Both path.
                 args+=("--bg")
-                # Open the URL the runner PUBLISHES for the port it actually bound
-                # or reused (it walks past refused ports); never guess the default
-                # 57374, which may be a foreign or stale dashboard. stdout must
-                # stay unredirected: loki_open_url checks the TTY.
-                local _dfile="${PWD}/.loki/dashboard/url"
-                rm -f "$_dfile" 2>/dev/null
-                (
-                    for _ in $(seq 1 120); do
-                        if [ -s "$_dfile" ]; then loki_open_url "$(head -1 "$_dfile")" 2>/dev/null; exit 0; fi
-                        sleep 0.5
-                    done
-                ) &
+                # The browser UI is the Control Plane; open it (guarded by
+                # loki_open_url: no-op headless and in tests).
+                ( LOKI_UI_NO_CLASSIC=1 cmd_ui 2>/dev/null || true ) &
                 ;;
             launch-bg-watch)
                 # Watch (cockpit only) detaches without opening the browser.
@@ -7561,7 +7577,7 @@ cmd_dashboard_help() {
     echo "  loki dashboard start --tls-cert cert.pem --tls-key key.pem"
     echo "  loki dashboard status                 # Check if running"
     echo "  loki dashboard url --format json      # Get URL as JSON"
-    echo "  loki dashboard open                   # Open in browser"
+    echo "  loki dashboard open                   # Print the Control Plane hint (no browser)"
     echo "  loki dashboard stop                   # Stop server"
 }
 
@@ -7789,7 +7805,7 @@ cmd_dashboard_start() {
         # a second port.
         echo -e "${DIM}Want to submit a spec in the browser? Open the 'Lab' tab in this dashboard.${NC}"
         echo ""
-        echo -e "Open in browser: ${CYAN}loki dashboard open${NC}"
+        echo -e "Control Plane UI: ${CYAN}loki ui${NC}"
         echo -e "Check status:    ${CYAN}loki dashboard status${NC}"
         echo -e "Stop server:     ${CYAN}loki dashboard stop${NC}"
     else
@@ -7907,7 +7923,7 @@ cmd_dashboard_status() {
         fi
 
         echo ""
-        echo -e "Open in browser: ${CYAN}loki dashboard open${NC}"
+        echo -e "Control Plane UI: ${CYAN}loki ui${NC}"
         echo -e "Stop server:     ${CYAN}loki dashboard stop${NC}"
     else
         echo -e "${YELLOW}Status: Not running (stale PID file)${NC}"
@@ -8040,14 +8056,10 @@ cmd_dashboard_open() {
 
     local url="${scheme}://${host}:${port}"
 
-    echo -e "${GREEN}Opening dashboard: $url${NC}"
-
-    # Open in browser (cross-platform, guarded: no-op in tests/CI/non-TTY)
-    if ! loki_open_url "$url" 2>/dev/null; then
-        echo ""
-        echo "Browser not opened (headless, test, or no opener)."
-        echo "Please open in browser: $url"
-    fi
+    # The legacy browser UI was removed; this server is API-only. Never open a
+    # browser here: point at the Control Plane instead.
+    echo -e "${YELLOW}The dashboard server at $url serves the API only; the browser UI is now the Control Plane.${NC}"
+    echo -e "Open the Control Plane with: ${CYAN}loki ui${NC}"
 }
 
 # Welcome opener (the "magic opener"). Shows a branded welcome page in the
@@ -18401,8 +18413,7 @@ print(json.dumps({'id': manifest.id, 'dir': str(pipeline.migration_dir)}))
 
                     sleep 2
                     if kill -0 "$migrate_dashboard_pid" 2>/dev/null; then
-                        echo -e "  Dashboard:   ${CYAN}${url_scheme}://127.0.0.1:${dashboard_port}/${NC}"
-                        loki_open_url "${url_scheme}://127.0.0.1:${dashboard_port}/" 2>/dev/null || true
+                        echo -e "  Dashboard API: ${CYAN}${url_scheme}://127.0.0.1:${dashboard_port}/${NC} (UI: loki ui)"
                         echo ""
                     else
                         echo -e "  ${YELLOW}Dashboard failed to start (check logs)${NC}"
@@ -37675,7 +37686,11 @@ print(json.dumps(json.load(open(os.environ['LOKI_PROOF_JSON'])), indent=2))
                 _pv_att="$(loki_proof_attestation_check "$pj" "$_pv_jwks")"
                 case "$_pv_att" in
                     ok)
-                        echo "attestation: VERIFIED against ${_pv_jwks}" >&2
+                        if [ "$(loki_proof_seal_legacy "$pj")" = "legacy" ]; then
+                            echo "attestation: VERIFIED against ${_pv_jwks} (metadata not signed (legacy seal.v1): scope, algo and attestation_kid are not covered by the signature)" >&2
+                        else
+                            echo "attestation: VERIFIED against ${_pv_jwks}" >&2
+                        fi
                         echo "  Proven: these bytes were signed by the holder of a key in that set." >&2
                         echo "  NOT proven: that the code is correct. A receipt records which checks ran." >&2
                         _pv_attestation_field="VERIFIED"

package/autonomy/receipt_jwt.py

@@ -265,8 +265,49 @@ def build_jwks(private_key=None, retired_public_keys=None) -> dict:
     return {"keys": keys}
 
 
+SEAL_V2 = "seal.v2"
+
+
+def seal_meta(verification, kid):
+    """The verification.* metadata a seal.v2 token signs.
+
+    Every key of `verification` except the token itself and attestation_kid
+    (which is replaced by the signing kid, so a forged kid can never match).
+    Any extra key a forger adds (for example gpg_signature) changes this dict
+    and so fails the comparison in check_seal_meta.
+    """
+    meta = {k: v for k, v in (verification or {}).items()
+            if k not in ("attestation", "attestation_kid")}
+    meta["attestation_kid"] = kid
+    return meta
+
+
+def check_seal_meta(token, claims, verification):
+    """Bind verification.* metadata to a verified token. Returns (status, why).
+
+    status is "v2" (metadata signed and matching), "legacy" (seal.v1 token: the
+    metadata is NOT signed, the caller must say so), or "bad" (a seal.v2 token
+    whose signed metadata differs from what the receipt now shows).
+    """
+    if not isinstance(claims, dict) or "seal" not in claims:
+        return "legacy", "metadata not signed (legacy seal.v1)"
+    if claims.get("seal") != SEAL_V2:
+        return "bad", "unknown seal version"
+    try:
+        kid = json.loads(_b64url_decode(token.split(".")[0])).get("kid", "")
+    except Exception:
+        return "bad", "malformed token"
+    if not isinstance(verification, dict):
+        return "bad", "verification block missing"
+    if verification.get("attestation_kid") != kid:
+        return "bad", "attestation_kid differs from the signing kid"
+    if claims.get("meta") != seal_meta(verification, kid):
+        return "bad", "verification metadata differs from the signed metadata"
+    return "v2", ""
+
+
 def sign_attestation(private_key, kid, *, job_id, run_id, receipt_hash,
-                     submitter="", issued_at=None, issuer=""):
+                     submitter="", issued_at=None, issuer="", verification=None):
     """Return a compact JWT binding a receipt hash to a job identity.
 
     The signed claims are what gpg could never carry: WHICH job produced this
@@ -294,6 +335,10 @@ def sign_attestation(private_key, kid, *, job_id, run_id, receipt_hash,
     # Optional claims are omitted rather than emitted empty: a present-but-blank
     # `sub` reads as "an anonymous submitter was recorded" instead of "no
     # submitter identity was available".
+    if verification is not None:
+        # seal.v2: the verification.* metadata is inside the signature.
+        payload["seal"] = SEAL_V2
+        payload["meta"] = seal_meta(verification, kid)
     if submitter:
         payload["sub"] = submitter
     if issuer:

package/autonomy/run.sh

@@ -5553,7 +5553,7 @@ except Exception:
 # prompt over IPC; it is left untouched here) explicitly to route around
 # this. The boundary is a CI job that holds
 # no write token and no SSH agent while the agent runs (see
-# .github/workflows/loki-issue-to-pr.yml).
+# docs/examples/loki-issue-to-pr.yml.example).
 #===============================================================================
 _LOKI_WITHHELD_TOKENS=""
 _LOKI_GIT_CONFIG_COUNT_UNSUPPORTED=""

package/autonomy/telemetry.sh

@@ -168,7 +168,7 @@ _loki_known_command() {
     case "${1:-}" in
         --help|--version|-h|-v|agent|analyze|api|assets\
         |audit|bench|checkpoint|ci|cleanup|cluster|cockpit|code\
-        |completions|compliance|compound|config|context|control|cost|council|cp\
+        |completion|completions|compliance|compound|config|context|control|cost|council|cp\
         |crash|ctx|dashboard|demo|deploy|docker|docs|doctor\
         |dogfood|enterprise|explain|export|failover|github|grill|handoff\
         |heal|help|import|init|internal|issue|kpis|logs\

package/autonomy/trigger-server.py

@@ -1069,6 +1069,7 @@ class WebhookHandler(http.server.BaseHTTPRequestHandler):
         token = sign_attestation(
             self.signing_key, self.signing_kid,
             job_id=job_id, run_id=run_id, receipt_hash=receipt_hash,
+            verification=verification,
         )
         if not token:
             return proof

package/autonomy/tui.sh

@@ -24,7 +24,11 @@ TUI_HAS_COLOR=false
 TUI_COLS=80
 if [ -t 1 ]; then
     TUI_HAS_COLOR=true
-    TUI_COLS=$(tput cols 2>/dev/null || echo 80)
+    # FC-10: tput can print 0 or nothing on a pty with no size; fall back to COLUMNS, then 80
+    TUI_COLS=$(tput cols 2>/dev/null || true)
+    case "$TUI_COLS" in '' | *[!0-9]*) TUI_COLS="${COLUMNS:-80}" ;; esac
+    case "$TUI_COLS" in '' | *[!0-9]*) TUI_COLS=80 ;; esac
+    [ "$TUI_COLS" -ge 40 ] || TUI_COLS=80
 fi
 
 # Unicode box drawing (degrade to ASCII if terminal doesn't support)

package/bin/loki

@@ -115,6 +115,17 @@ else
     exec "$BASH_CLI" "$@"
 fi
 
+# Shell completions install themselves: once per VERSION, on the first interactive
+# run after an install or upgrade (stamp: ~/.loki/completions-version). Never needed
+# by the user; skipped under CI, LOKI_NO_COMPLETIONS=1 and non-TTY stdout. Failure
+# is silent and never blocks the command.
+if [ -t 1 ] && [ -z "${CI:-}" ] && [ "${LOKI_NO_COMPLETIONS:-}" != "1" ] \
+   && [ "${1:-}" != "completion" ] && [ "${1:-}" != "__complete" ] \
+   && [ "$(cat "${HOME}/.loki/completions-version" 2>/dev/null)" != "$(cat "$REPO_ROOT/VERSION" 2>/dev/null)" ] \
+   && command -v bun >/dev/null 2>&1; then
+    bun "$BUN_CLI" completion --auto </dev/null || true
+fi
+
 # v7.88.1 covert-path fix (council cF_r2 + cG_r2 sentinel edge): under on-by-default
 # diagnostics, NO telemetry may egress before the user has seen a disclosure once.
 # The cmd_start welcome only shows on `loki start`, so a first `loki version`/`doctor`
@@ -567,7 +578,7 @@ fi
 # Two-token routes (provider show/list, memory list/index) match on the first
 # token only; the Bun dispatcher handles subcommand routing internally.
 case "${1:-}" in
-    version|--version|-v|status|stats|doctor|provider|memory|rollback|internal|kpis|trust|proof|receipt|wiki|crash|control|contract|slack|answer)
+    version|--version|-v|status|stats|doctor|provider|memory|rollback|internal|kpis|trust|proof|receipt|wiki|crash|control|contract|slack|answer|completion|__complete)
         # v7.5.2: rollback added (wires loki-ts/src/commands/rollback.ts).
         # v7.5.3: internal added for autonomy/run.sh phase1-hooks calls.
         # v7.5.28: kpis added (Phase K MVP: read-only KPI snapshot).

package/bin/loki-postinstall.js

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+// npm postinstall: install shell completions. Must never fail the install.
+try {
+  const { spawnSync } = require("node:child_process");
+  const path = require("node:path");
+  if (!process.env.CI && process.env.LOKI_NO_COMPLETIONS !== "1") {
+    spawnSync(path.join(__dirname, "loki"), ["completion", "--postinstall"], { stdio: "ignore", timeout: 20000 });
+  }
+} catch (e) {
+  // ignore: completions are a convenience
+}
+process.exit(0);

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "10.8.0"
+__version__ = "10.10.1"
 
 # Expose the control app for easy import
 try:

package/dashboard/api_phases.py

@@ -1,6 +1,6 @@
 """Read-only phase history for a run, derived from real `phase_change` events.
 
-WHY THIS EXISTS. dashboard-ui/components/loki-session-timeline.js SYNTHESIZED
+WHY THIS EXISTS. The legacy dashboard session timeline (removed in CPE-24) SYNTHESIZED
 its timeline. It took a scalar status (uptime, current phase, iteration count),
 rotated a fixed list `['planning','building','testing','reviewing']`, and gave
 each invented segment a randomized duration:

package/dashboard/api_start.py

@@ -37,7 +37,6 @@ from . import auth
 logger = logging.getLogger(__name__)
 router = APIRouter(tags=["start"])
 
-START_HTML = os.path.join(os.path.dirname(os.path.abspath(__file__)), "static", "start.html")
 _LOKI_BIN = os.path.join(os.path.dirname(os.path.dirname(os.path.abspath(__file__))), "bin", "loki")
 _REPO_RE = re.compile(r"^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$")
 _TOKEN_RE = re.compile(r"^[A-Za-z0-9_\-]{10,255}$")