loki-mode 10.8.0 → 10.10.1

package/dashboard/server.py

@@ -1149,14 +1149,8 @@ app.add_middleware(
     allow_headers=["Content-Type", "Authorization", "X-Requested-With"],
 )
 
-# RESPONSE COMPRESSION. Measured, not assumed: the served dashboard bundle
-# (dashboard/static/index.html) is 779,725 bytes raw and 150,341 gzipped --
-# an 81% reduction. Until now only CORS and the collab WS auth middleware were
-# registered, so every dashboard load shipped the full 780KB.
-#
-# That single fact is the most plausible cause of "the dashboard feels slow":
-# it is not a rendering problem, it is 630KB of avoidable transfer on first
-# paint, and it costs one middleware to fix.
+# RESPONSE COMPRESSION. Large JSON API payloads compress well, and it costs one
+# middleware. (The legacy single-file UI bundle that motivated it was removed.)
 #
 # minimum_size=1024 leaves small JSON responses uncompressed, where the CPU
 # round-trip outweighs the saving. GZipMiddleware is stdlib-backed and does
@@ -1360,16 +1354,12 @@ else:
     app.include_router(api_operator_router)
 
 # D51 Phase A: first-run onboarding + backlog API and its /start page.
-from .api_start import router as api_start_router, START_HTML as _START_HTML
+from .api_start import router as api_start_router
 app.include_router(api_start_router)
 from .api_runs_v1 import router as api_runs_v1_router
 app.include_router(api_runs_v1_router)
 
 
-@app.get("/start", include_in_schema=False, dependencies=[Depends(auth.require_scope("read"))])
-async def serve_start_page():
-    return FileResponse(_START_HTML, media_type="text/html")
-
 
 # Phase Merge-4: Mount Purple Lab FastAPI app under /lab/ so it appears as a
 # sidebar entry in Dashboard. Same `app` is also wrapped by `standalone_app`
@@ -11579,49 +11569,11 @@ def optimize_prompts(sessions: int = 10, dry_run: bool = True):
 
 from fastapi.responses import FileResponse, HTMLResponse
 
-# Find static files in multiple possible locations
 DASHBOARD_DIR = os.path.dirname(os.path.abspath(__file__))
 PROJECT_ROOT = os.path.dirname(DASHBOARD_DIR)
 
-# Possible static file locations (in order of preference)
-# Resolves correctly regardless of PYTHONPATH, symlinks, or install method
-def _static_candidates(skill_dir=None, home=None):
-    """Static dirs in preference order: package, LOKI_SKILL_DIR, ~/.claude skill, dev build."""
-    skill_dir = os.environ.get("LOKI_SKILL_DIR", "") if skill_dir is None else skill_dir
-    home_skill = os.path.join(home or os.path.expanduser("~"), ".claude", "skills", "loki-mode")
-    cands = [os.path.join(DASHBOARD_DIR, "static")]
-    if skill_dir:
-        cands.append(os.path.join(skill_dir, "dashboard", "static"))
-    cands.append(os.path.join(home_skill, "dashboard", "static"))
-    cands.append(os.path.join(PROJECT_ROOT, "dashboard-ui", "dist"))
-    if skill_dir:
-        cands.append(os.path.join(skill_dir, "dashboard-ui", "dist"))
-    cands.append(os.path.join(home_skill, "dashboard-ui", "dist"))
-    return cands
-
-
-def _pick_static_dir(candidates):
-    """First candidate that CONTAINS index.html; an empty or partial dir must not win."""
-    for loc in candidates:
-        if os.path.isfile(os.path.join(loc, "index.html")):
-            return loc
-    return None
-
-
-STATIC_LOCATIONS = _static_candidates()
-STATIC_DIR = _pick_static_dir(STATIC_LOCATIONS)
-if STATIC_DIR:
-    logger.info("Dashboard frontend served from: %s", STATIC_DIR)
-else:
-    logger.warning("Dashboard frontend NOT found (looked in %s); serving built-in fallback page", STATIC_LOCATIONS)
-
-if STATIC_DIR:
-    from fastapi.staticfiles import StaticFiles
-
-    # Check if assets directory exists (built frontend)
-    ASSETS_DIR = os.path.join(STATIC_DIR, "assets")
-    if os.path.isdir(ASSETS_DIR):
-        app.mount("/assets", StaticFiles(directory=ASSETS_DIR), name="assets")
+DASHBOARD_DIR = os.path.dirname(os.path.abspath(__file__))
+PROJECT_ROOT = os.path.dirname(DASHBOARD_DIR)
 
 # ---------------------------------------------------------------------------
 # Activity Logger & Session Diff
@@ -11682,75 +11634,29 @@ async def log_activity(entry: dict):
     return result
 
 
-# Serve favicon.svg from static directory
-@app.get("/favicon.svg", include_in_schema=False)
-async def serve_favicon():
-    """Serve the dashboard favicon."""
-    if STATIC_DIR:
-        favicon_path = os.path.join(STATIC_DIR, "favicon.svg")
-        if os.path.isfile(favicon_path):
-            return FileResponse(favicon_path, media_type="image/svg+xml")
-    return Response(status_code=404)
-
-
-# Serve the self-contained cost + observability panel (R3). Zero-build
-# standalone page that fetches /api/cost/timeline. Mirrors the proofs.html
-# pattern: works without the SPA build.
-@app.get("/cost", include_in_schema=False, dependencies=[Depends(auth.require_scope("read"))])
-async def serve_cost_panel():
-    """Serve the standalone cost + observability HTML panel."""
-    if STATIC_DIR:
-        cost_path = os.path.join(STATIC_DIR, "cost.html")
-        if os.path.isfile(cost_path):
-            return FileResponse(cost_path, media_type="text/html")
-    return Response(status_code=404)
-
-
-# R4: standalone trust-trajectory page that fetches /api/trust/trajectory.
-# Mirrors the cost.html / /cost pattern: works without the SPA build.
-@app.get("/trust", include_in_schema=False, dependencies=[Depends(auth.require_scope("read"))])
-async def serve_trust_panel():
-    """Serve the standalone trust-trajectory HTML panel."""
-    if STATIC_DIR:
-        trust_path = os.path.join(STATIC_DIR, "trust.html")
-        if os.path.isfile(trust_path):
-            return FileResponse(trust_path, media_type="text/html")
-    return Response(status_code=404)
-
-
-# Serve index.html or standalone HTML for root
+# The legacy dashboard UI was removed (CPE-24). The Control Plane serves the UI;
+# this server keeps only the /api/* routes that have no Control Plane home yet.
 @app.get("/", include_in_schema=False, dependencies=[Depends(auth.require_scope("read"))])
 async def serve_index():
-    """Serve the frontend SPA or standalone HTML."""
-    # Try multiple index file locations
-    index_candidates = []
-    if STATIC_DIR:
-        index_candidates.append(os.path.join(STATIC_DIR, "index.html"))
-        index_candidates.append(os.path.join(STATIC_DIR, "loki-dashboard-standalone.html"))
+    """Tell a browser where the UI moved; never serve developer JSON to it."""
+    return HTMLResponse(content=_moved_page(), status_code=410)
 
-    # Also check dashboard-ui directly for standalone
-    standalone_path = os.path.join(PROJECT_ROOT, "dashboard-ui", "dist", "loki-dashboard-standalone.html")
-    if standalone_path not in index_candidates:
-        index_candidates.append(standalone_path)
 
-    for index_path in index_candidates:
-        if os.path.isfile(index_path):
-            return FileResponse(index_path, media_type="text/html")
-
-    # No frontend anywhere: a browser must never see developer JSON.
-    return HTMLResponse(content=_fallback_page(), status_code=503)
-
-
-def _fallback_page() -> str:
+def _moved_page() -> str:
     import html as _html
+    cp = os.environ.get("LOKI_CONTROL_PLANE_URL", "").strip()
+    where = (
+        f'<p>Control Plane: <a href="{_html.escape(cp, quote=True)}">{_html.escape(cp)}</a></p>'
+        if cp.startswith(("http://", "https://"))
+        else "<p>Run <code>loki ui</code> to open the Control Plane.</p>"
+    )
     return (
         '<!doctype html><html lang="en"><head><meta charset="utf-8">'
-        "<title>Loki Mode Dashboard</title></head>"
+        "<title>Loki Mode API</title></head>"
         '<body style="font-family:system-ui,sans-serif;max-width:40rem;margin:4rem auto;padding:0 1rem">'
-        "<h1>Loki Mode dashboard UI is not installed</h1>"
-        f"<p>The dashboard API is running (version {_html.escape(str(_version))}) "
-        "but this install has no frontend files.</p>"
-        "<p>Reinstall to fix it:</p><pre>npm install -g loki-mode@latest</pre>"
+        "<h1>The dashboard UI moved to the Control Plane</h1>"
+        f"<p>This server (version {_html.escape(str(_version))}) now serves the /api routes only.</p>"
+        f"{where}"
         '<p><a href="/docs">API docs</a> | <a href="/health">Health</a></p>'
         "</body></html>"
     )
@@ -13099,40 +13005,18 @@ async def post_wiki_ask(req: WikiAskRequest):
 
 
 # ---------------------------------------------------------------------------
-# SPA catch-all: serve index.html for any path not matched by API routes
-# or static asset mounts.  This lets the dashboard UI handle client-side routing.
+# Catch-all: unknown paths are real 404s (the SPA was removed, CPE-24).
 # Must be registered LAST so it never shadows an API endpoint.
 # ---------------------------------------------------------------------------
 @app.get("/{full_path:path}", include_in_schema=False, dependencies=[Depends(auth.require_scope("read"))])
 async def serve_spa_catchall(full_path: str):
-    """Serve static files or fall back to index.html for SPA routing.
-
-    v7.6.1 B-10 fix: requests under /api/, /lab/api/, or /ws/ that fall through
-    here are missing routes, not SPA navigation. Returning index.html (text/html)
-    silently masks 404s and breaks JSON clients (the dashboard UI's loki-memory-browser
-    pinged /api/learning/metrics expecting JSON and got an HTML SPA on prior
-    failures). Return a JSON 404 instead so clients fail loud.
-    """
-    # API paths that fell through are real 404s, not SPA routes.
+    """Return a JSON 404 for API-like paths so JSON clients fail loud, else a bare 404."""
     api_like = full_path.startswith("api/") or full_path.startswith("lab/api/") or full_path.startswith("ws/")
     if api_like:
         return JSONResponse(
             status_code=404,
             content={"error": "Not Found", "path": f"/{full_path}"},
         )
-    if STATIC_DIR:
-        static_root = os.path.realpath(STATIC_DIR)
-        # Try to serve the exact file first (e.g. /vite.svg, /manifest.json)
-        # Use realpath to prevent path traversal attacks
-        candidate = os.path.realpath(os.path.join(STATIC_DIR, full_path))
-        if not candidate.startswith(static_root + os.sep) and candidate != static_root:
-            return Response(status_code=404)
-        if os.path.isfile(candidate):
-            return FileResponse(candidate)
-        # Fall back to index.html for client-side routes
-        index_path = os.path.join(STATIC_DIR, "index.html")
-        if os.path.isfile(index_path):
-            return FileResponse(index_path, media_type="text/html")
     return Response(status_code=404)
 
 

package/docs/CLI-REFERENCE.md

@@ -0,0 +1,139 @@
+# CLI reference
+
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v10.10.1. Do not edit by hand.
+Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
+
+| Command | Description |
+| --- | --- |
+| `loki version` | Show version |
+| `loki status` | Show current run status |
+| `loki doctor` | System prerequisites health check |
+| `loki provider` | Show, list or set the AI provider |
+| `loki provider show` | Show current provider |
+| `loki provider list` | List providers and install status |
+| `loki provider set` | Switch the active provider |
+| `loki memory` | Cross-project learnings |
+| `loki memory list` | All learnings |
+| `loki memory index` | Show or rebuild the memory index |
+| `loki memory show` | Show one learning |
+| `loki memory search` | Search learnings |
+| `loki memory stats` | Memory statistics |
+| `loki memory consolidate` | Episodic-to-semantic pipeline |
+| `loki memory compound` | Compound learnings |
+| `loki rollback` | Restore .loki/ state from a checkpoint |
+| `loki rollback list` | List checkpoints |
+| `loki rollback show` | Show a checkpoint |
+| `loki rollback to` | Restore a checkpoint |
+| `loki rollback latest` | Restore the latest checkpoint |
+| `loki proof` (alias: `receipt`) | Inspect and share proof-of-run receipts |
+| `loki proof list` | List receipts |
+| `loki proof show` | Show a receipt |
+| `loki proof open` | Open a receipt |
+| `loki proof share` | Share a receipt |
+| `loki wiki` | Cited codebase wiki and Q&A |
+| `loki wiki generate` | Generate the wiki |
+| `loki wiki show` | Show a section |
+| `loki wiki ask` | Ask a question |
+| `loki control` | Control Plane (serve, backfill, prune, status) |
+| `loki control serve` | Run the control plane and UI |
+| `loki control backfill` | Ship DIR/.loki/runs to the control plane |
+| `loki control prune` | Delete matching runs |
+| `loki control status` | Show control plane reachability |
+| `loki kpis` | KPI snapshot (alias of report kpis) |
+| `loki report` | Reporting: kpis, session, metrics, cost, export, share, dogfood |
+| `loki report kpis` | Canonical KPI snapshot |
+| `loki report session` | Session report |
+| `loki report metrics` | Metrics report |
+| `loki report cost` | Cost report |
+| `loki report export` | Export session |
+| `loki report share` | Share a report |
+| `loki report dogfood` | Dogfood report |
+| `loki trust` | Trust trajectory from proof history |
+| `loki trust detail` | Trust metrics detail |
+| `loki crash` | Inspect or submit scrubbed crash reports |
+| `loki contract` | Print the spec delivery contract |
+| `loki start` | Run the autonomous build |
+| `loki slack` | Slack inbound handler |
+| `loki slack serve` | Serve the Slack handler |
+| `loki answer` | Resume a BLOCKED run with an answer |
+| `loki engine10` | v10 engine router |
+| `loki engine10 run` | Run the v10 engine |
+| `loki engine10 status` | v10 status |
+| `loki engine10 verify` | v10 verify |
+| `loki engine10 keys` | v10 keys |
+| `loki engine10 dashboard` | v10 dashboard |
+| `loki engine10 modernize` | v10 modernize |
+| `loki help` | Show help |
+| `loki quick` | One small task |
+| `loki quickstart` | Guided first build |
+| `loki init` | Scaffold from a template |
+| `loki template` | Manage PRD templates |
+| `loki verify` | Deterministic PR verification |
+| `loki keys` | Receipt-signing keys |
+| `loki keys export` | Print the public signing key (JWK) |
+| `loki review` | Standalone code review with quality gates |
+| `loki dashboard` | Operations UI server |
+| `loki dashboard start` | Start |
+| `loki dashboard stop` | Stop |
+| `loki dashboard status` | Status |
+| `loki dashboard url` | Print URL |
+| `loki dashboard open` | Open in browser |
+| `loki config` | Manage configuration |
+| `loki config show` | Show config |
+| `loki config init` | Create config |
+| `loki config edit` | Edit config |
+| `loki config path` | Print config path |
+| `loki config set` | Set a value |
+| `loki config get` | Get a value |
+| `loki mcp` | Launch the MCP server (stdio) |
+| `loki acp` | Run Loki as an ACP agent |
+| `loki stop` | Stop execution immediately |
+| `loki pause` | Pause after the current session |
+| `loki resume` | Resume a paused or interrupted run |
+| `loki why` | Explain how the last run ended |
+| `loki next` | Run the right next step |
+| `loki logs` | Tail recent log output |
+| `loki ship` | Ship the verified result |
+| `loki deploy` | Deploy the built product |
+| `loki import` | Import issues or specs |
+| `loki github` | GitHub integration |
+| `loki issue` | Work an issue |
+| `loki ci` | CI helpers |
+| `loki modernize` | Code modernization |
+| `loki share` | Share a run |
+| `loki assets` | Export team assets |
+| `loki assets export` | Export shareable assets |
+| `loki export` | Export session data |
+| `loki notify` | Notifications |
+| `loki tour` | See a sample result |
+| `loki welcome` | First-run opener |
+| `loki onboard` | Onboard to a codebase |
+| `loki setup-skill` | Install the skill symlinks |
+| `loki self-update` (alias: `self_update`, `update`) | Update Loki |
+| `loki remote` (alias: `rc`) | Remote session |
+| `loki cockpit` | Live multi-repo cockpit |
+| `loki code` | Code intelligence |
+| `loki context` (alias: `ctx`) | Cross-project context |
+| `loki secrets` | Secrets handling |
+| `loki api` | Dashboard HTTP API |
+| `loki sandbox` | Docker sandbox |
+| `loki docker` | Docker helpers |
+| `loki web` | Web UI |
+| `loki preview` | Preview the built app |
+| `loki telemetry` (alias: `otel`) | Telemetry controls |
+| `loki syslog` | System log forwarding |
+| `loki explain` | Explain code |
+| `loki docs` | Open docs |
+| `loki test` | Run project tests |
+| `loki bench` | Benchmarks |
+| `loki voice` | Voice input |
+| `loki own` (alias: `handoff`) | Hand off ownership |
+| `loki secure` | Security scan |
+| `loki compliance` | Compliance reports |
+| `loki enterprise` | Enterprise features |
+| `loki projects` | Project registry |
+| `loki audit` | Audit log |
+| `loki cost` | Cost report |
+| `loki metrics` | Metrics |
+| `loki sentrux` | Architecture sensor |
+| `loki magic` | Magic modules |

package/docs/COCKPIT-SPEC.md

@@ -1,5 +1,7 @@
 # Loki Cockpit (rec #6) - build spec
 
+> **Historical:** this describes the classic dashboard, removed in Loki Mode 10.8. The Control Plane is the only UI; see [control-plane-migration.md](control-plane-migration.md).
+
 Status: IN BUILD (v7.126.0 target). Design approved via mockup
 (scratchpad/loki-cockpit.html). Grounded in real engine state + Autonomi identity.
 
@@ -59,7 +61,7 @@ No chafa / no headless Chrome hard dependency. Pipeline:
 - S3 (render pipeline): SVG-from-state builder + SVG->PNG + terminal-image
   encoder + capability detection + fallback. Tests (encoder byte-shape, detection).
 - S4 (dashboard identity redesign): apply logo/purple/fonts/multi-repo switcher to
-  dashboard-ui; rebuild dist. Lightweight gate.
+  legacy-ui; rebuild dist. Lightweight gate.
 - S5 (docs + wiki + release): help text, README, wiki, CHANGELOG, 14 version files.
 
 ## Constraints

package/docs/DASHBOARD-9.12-EVIDENCE.md

@@ -28,7 +28,7 @@ carries a `reason`, an unmeasured number reads `None` rather than `0`, and
 | `source` | 10 of 43 | Most rows cannot be audited back to the file they came from |
 
 ```bash
-cd dashboard-ui
+cd legacy-ui
 grep -l "freshness_s" components/*.js core/*.js | wc -l   # 0
 grep -l "measured"    components/*.js core/*.js | wc -l   # 0
 ```

package/docs/DASHBOARD-ARCHITECTURE.md

@@ -1,5 +1,7 @@
 # Dashboard Architecture: Real-Data, Near-Realtime
 
+> **Historical:** this describes the classic dashboard, removed in Loki Mode 10.8. The Control Plane is the only UI; see [control-plane-migration.md](control-plane-migration.md).
+
 Design only. No implementation in this document.
 
 Status: proposal. Measured against the worktree at
@@ -41,7 +43,7 @@ brief's number and my measurement disagree, both are shown.
 
 One correction against myself: my first pass reported `0` aria attributes in the
 built artifact and I nearly wrote that up as a shipped accessibility regression.
-It was a measurement error. `dashboard/static/index.html` has lines long enough
+It was a measurement error. `legacy-ui-static/index.html` has lines long enough
 (577 chars plus minified runs) that `grep` treated the file as binary and
 suppressed output. With `grep -a` the brief's numbers are confirmed. This is the
 `grep-absence false-green` failure mode: an empty result was an absent
@@ -178,7 +180,7 @@ machine-checkable instead of a naming habit.
   `/api/health/processes`.
 
 Built artifact realtime constructs: 9
-(`grep -oaE "new WebSocket|EventSource|setInterval" dashboard/static/index.html | wc -l`).
+(`grep -oaE "new WebSocket|EventSource|setInterval" legacy-ui-static/index.html | wc -l`).
 The brief's "34 realtime constructs" is not reproducible by any pattern I tried;
 I mark that figure **not independently verified** rather than repeat it.
 
@@ -234,8 +236,8 @@ The bundle is 779,725 bytes raw, 150,341 gzipped
 gzip stays; nothing in this design touches it.
 
 **Progressive disclosure here cannot mean code-splitting.**
-`dashboard-ui/scripts/build-standalone.js` produces a single self-contained
-file with zero runtime dependencies, written to both `dashboard/static/` and
+`legacy-ui/scripts/build-standalone.js` produces a single self-contained
+file with zero runtime dependencies, written to both `legacy-ui-static/` and
 `dist/`. That property is why the dashboard works offline and inside Docker
 without a CDN. Splitting the bundle would trade a real capability for a
 transfer-size win that gzip has already mostly taken (5.2x). So disclosure is
@@ -265,12 +267,12 @@ Measured on the shipped artifact with `grep -a`:
 
 | Property | Count | Command |
 |---|---|---|
-| Custom elements registered | 39 | `grep -oa "customElements.define" dashboard/static/index.html \| wc -l` |
+| Custom elements registered | 39 | `grep -oa "customElements.define" legacy-ui-static/index.html \| wc -l` |
 | `aria-*` attributes | 100 | `grep -oa "aria-[a-z]*=" ... \| wc -l` |
 | `aria-` occurrences | 113 | `grep -oa "aria-" ... \| wc -l` |
 | `role="` | 38 | `grep -oa 'role="' ... \| wc -l` |
 | `@media` breakpoints | 13 | `grep -oa "@media" ... \| wc -l` |
-| Component source files | 43 | `ls dashboard-ui/components \| grep -v vendor \| wc -l` |
+| Component source files | 43 | `ls legacy-ui/components \| grep -v vendor \| wc -l` |
 | Registrations in source | 44 | `grep -roha "customElements.define" components core \| wc -l` |
 
 The brief's 113 aria and 41 role are consistent with mine within pattern choice
@@ -278,7 +280,7 @@ The brief's 113 aria and 41 role are consistent with mine within pattern choice
 figure is 43 files carrying 44 registrations, not 46.
 
 **One gap worth noting:** source registers 44 custom elements, the shipped
-artifact registers 39. Five components exist in `dashboard-ui/` and do not reach
+artifact registers 39. Five components exist in `legacy-ui/` and do not reach
 the browser. This is out of scope for this document and I did not chase it, but
 it is recorded here because it means the source tree is not a reliable proxy for
 what ships. All acceptance criteria in section 5 therefore measure the **built
@@ -369,10 +371,10 @@ Every row is measurable by a command. No aspirational entries.
 |---|---|---|---|
 | A1 | No route regression | `grep -cE '^@app\.(get\|post\|put\|delete\|patch\|websocket)' dashboard/server.py` | >= 165 |
 | A2 | api_v2 routes intact | `grep -cE '@router\.(get\|post\|put\|delete)' dashboard/api_v2.py` | >= 24 |
-| A3 | Accessibility not regressed | `grep -oa "aria-" dashboard/static/index.html \| wc -l` | >= 113 |
-| A4 | Roles not regressed | `grep -oa 'role="' dashboard/static/index.html \| wc -l` | >= 38 |
-| A5 | Custom elements not regressed | `grep -oa "customElements.define" dashboard/static/index.html \| wc -l` | >= 39 |
-| A6 | Breakpoints not regressed | `grep -oa "@media" dashboard/static/index.html \| wc -l` | >= 13 |
+| A3 | Accessibility not regressed | `grep -oa "aria-" legacy-ui-static/index.html \| wc -l` | >= 113 |
+| A4 | Roles not regressed | `grep -oa 'role="' legacy-ui-static/index.html \| wc -l` | >= 38 |
+| A5 | Custom elements not regressed | `grep -oa "customElements.define" legacy-ui-static/index.html \| wc -l` | >= 39 |
+| A6 | Breakpoints not regressed | `grep -oa "@media" legacy-ui-static/index.html \| wc -l` | >= 13 |
 | A7 | gzip still active | `grep -c "GZipMiddleware" dashboard/server.py` | >= 1 |
 | A8 | Zero runtime dependencies | Built artifact contains no external script/CDN src | 0 external hosts |
 | A9 | Runs store is written by the engine | Drive the lifecycle writer directly (source `run.sh`, call the phase-boundary function), then `GET /api/v2/runs`. No provider call, no spend | Returns >= 1 record with a real run id |

package/docs/DASHBOARD_V2_CHECKLIST.md

@@ -1,5 +1,7 @@
 # Loki Mode Dashboard V2 - Implementation Checklist
 
+> **Historical:** this describes the classic dashboard, removed in Loki Mode 10.8. The Control Plane is the only UI; see [control-plane-migration.md](control-plane-migration.md).
+
 ## Overview
 Enterprise-grade Kanban dashboard with FastAPI backend, cross-project support, and CLI integration.
 

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v10.8.0
+**Version:** v10.10.1
 
 **Engine note:** `loki "<task>"`, `loki owner/repo#N` and `loki quick` run the Loki 10 engine. `loki start` still routes to the legacy engine, which is being removed (planned work resumes 2026-10-07); prefer `loki owner/repo#N`. See [docs/v10/GUIDE.md](v10/GUIDE.md).
 
@@ -294,7 +294,7 @@ trade-offs.
 ## VS Code Extension (Deprecated)
 
 > **DEPRECATED as of v7.2.0.** The Loki Mode VS Code extension is no longer
-> maintained. Use the dashboard at `loki dashboard start` instead.
+> maintained. Use the Control Plane (`loki dashboard`) instead.
 >
 > The marketplace listing remains for users on v7.2.0 and earlier but will
 > not receive further updates. The `vscode-extension/` source remains in the
@@ -305,8 +305,8 @@ trade-offs.
 ### Recommended replacement: the dashboard
 
 ```bash
-loki dashboard start
-# Then open http://localhost:57374 in your browser.
+loki dashboard
+# Opens the Control Plane (default http://127.0.0.1:47821).
 ```
 
 The dashboard provides session monitoring, task views, the completion
@@ -450,7 +450,7 @@ behave exactly like the local `loki` CLI. Auth is auto-detected:
 (Max/Pro subscribers need no API key), else an honest error with guidance. It
 also forwards `~/.gitconfig` and `~/.config/gh` (read-only) plus
 `GITHUB_TOKEN`/`GH_TOKEN` if set, so commits and PRs work like local, and
-exposes the dashboard on port 57374. Use `--image IMG` to override the image.
+exposes the API on port 57374. Use `--image IMG` to override the image.
 
 `loki docker` is a thin host wrapper around the image; it requires loki and
 Docker installed on the host.
@@ -459,7 +459,7 @@ Multi-repo + unified dashboard: you can run `loki docker start` in several
 different repos at once, exactly like the host CLI. Each repo gets its own
 container (deterministic name `loki-<hash-of-path>`) and its own bind-mounted
 `.loki/` state. Every `loki docker` project registers with the host dashboard,
-so running `loki dashboard` on the host shows ALL your projects in one unified
+so running `loki dashboard` on the host (the Control Plane) shows ALL your projects in one unified
 view, whether they run via local `loki start` or via `loki docker start`. Builds
 run with the dashboard off by default (so concurrent runs do not collide on port
 57374); use the host `loki dashboard`, or `loki docker start --api` for a single
@@ -775,11 +775,12 @@ Loki Mode uses two network ports for different services:
 
 | Port | Service | Description |
 |------|---------|-------------|
-| **57374** | Dashboard + API (FastAPI) | Unified server serving both the web dashboard UI (real-time monitoring, task board, Completion Council, memory browser, log streaming) and the REST API (used by CLI tools, programmatic access, and the deprecated VS Code extension). Served by `dashboard/server.py`. |
+| **47821** | Control Plane UI + API | The only UI, plus the `/v1/*` API. Started by `loki control serve` or `loki dashboard`. See [control-plane-migration.md](control-plane-migration.md). |
+| **57374** | Legacy API (FastAPI) | The classic dashboard UI is removed in 10.8; this port no longer serves a UI. |
 
 ### When to Use Which Port
 
-- **Browser access** (dashboard, monitoring): Use port **57374** -- `http://localhost:57374`
+- **Browser access** (UI, monitoring): Use the Control Plane, port **47821** -- `http://127.0.0.1:47821`
 - **API calls** (REST, programmatic): Use port **57374** -- `http://localhost:57374`
 - **VS Code extension** (deprecated as of v7.2.0): Connects to API on port **57374** automatically (configurable via `loki.apiPort` setting). No new releases will be published; see the deprecation notice above.
 - The server is started automatically when you run `loki start` or `./autonomy/run.sh`. No manual configuration is needed.
@@ -787,8 +788,8 @@ Loki Mode uses two network ports for different services:
 ### Port Configuration
 
 ```bash
-# Dashboard port (default: 57374)
-LOKI_DASHBOARD_PORT=57374 loki dashboard start
+# Control Plane port (default: 47821)
+loki control serve --port 47821
 
 # API port (default: 57374)
 loki api start --port 57374   # was: loki serve
@@ -796,7 +797,7 @@ loki api start --port 57374   # was: loki serve
 
 ### CORS Configuration
 
-For remote or cross-origin access to the dashboard, configure allowed origins via the `LOKI_DASHBOARD_CORS` environment variable:
+The Control Plane has no CORS setting and requires a loopback Host header unless it is bound to a non-loopback address with `LOKI_CONTROL_TOKEN` set (see [control-plane-migration.md](control-plane-migration.md)). The `LOKI_DASHBOARD_CORS` variable below applies only to the legacy API server:
 
 ```bash
 # Allow specific origins

package/docs/LOKI-10-BUILD-PROMPT.md

@@ -150,7 +150,7 @@ Order is a default. Re-rank with data, and record why.
   - Decide whether the Seal replaces the Evidence Receipt or profiles it, and record the decision.
 - **M3. Assign it like a teammate (the Devin experience).**
   - Work arrives from:
-    - a GitHub issue label or `/loki` comment (exists: `.github/workflows/loki-issue-to-pr.yml`);
+    - a GitHub issue label or `/loki` comment (exists: `docs/examples/loki-issue-to-pr.yml.example`);
     - a GitLab equivalent;
     - Slack @loki (code exists under `src/integrations/slack/`; verify it is actually reachable, because v9.33.0 found unreachable integrations);
     - Jira (the read path works);
@@ -200,7 +200,7 @@ Order is a default. Re-rank with data, and record why.
     - it works behind a corporate proxy with SSO;
     - the only outbound traffic is to configured model endpoints.
     Measure install-to-first-sealed-PR in the adoption eval.
-  - Keep `provenance.yml` and `sbom.yml` green.
+  - Keep `sbom.yml` and the release.yml signing steps green.
 - **M10. Simplify and ship v10.0.0.**
   - Collapse the surface.
   - Remove deprecated commands and settings that measurement shows nobody needs.

package/docs/MERGE-DEDUP-MAP.md

@@ -362,7 +362,7 @@ class FileEventDebouncer(FileSystemEventHandler):
 ### What Was NOT Audited (and Why)
 
 1. **Frontend code duplication** (TypeScript/React):
-   - Dashboard UI (`dashboard-ui/src/`) and Lab UI (`web-app/dist/` or source) likely have overlapping components (session cards, status displays, log viewers).
+   - Dashboard UI (`legacy-ui/src/`) and Lab UI (`web-app/dist/` or source) likely have overlapping components (session cards, status displays, log viewers).
    - Scope: This audit covers Python backend only. Frontend audit deferred to UI design review in Merge-3 (Vite rebuild).
 
 2. **Database schema migrations and compatibility:**

package/docs/MERGE-ROUTE-MAP.md

@@ -30,7 +30,7 @@ This document is the source-of-truth route-collision analysis for the Purple Lab
 | Method | Path | Dashboard purpose | Purple Lab purpose | Resolution |
 |---|---|---|---|---|
 | `GET` | `/health` | Dashboard health check | Purple Lab health check | Single `/health` on Dashboard wins. Lab's becomes `/lab/health`. |
-| `GET` | `/{full_path:path}` | Dashboard SPA catch-all (serves `dashboard/static/index.html`) | Purple Lab SPA catch-all (serves `web-app/dist/index.html`) | Dashboard catch-all wins at root. Lab's becomes `/lab/{full_path:path}` -- triggered only inside the mount. |
+| `GET` | `/{full_path:path}` | Dashboard SPA catch-all (serves `legacy-ui-static/index.html`) | Purple Lab SPA catch-all (serves `web-app/dist/index.html`) | Dashboard catch-all wins at root. Lab's becomes `/lab/{full_path:path}` -- triggered only inside the mount. |
 | `WS` | `/ws` | Dashboard WebSocket bus | Purple Lab WebSocket bus | Dashboard `/ws` wins. Lab's becomes `/lab/ws`. Long term: unify into a single bus (Phase Merge-5). |
 
 All three collisions resolve automatically when Lab's FastAPI app is mounted at `/lab` via Starlette `app.mount("/lab", purple_lab_app)`. No code dedup needed in Merge-1 -- the mount provides path isolation.

package/docs/MERGE3-PLAN.md

@@ -68,7 +68,7 @@ Change the `open` URL from `http://127.0.0.1:${PURPLE_LAB_DEFAULT_PORT}/` to `ht
 ## Release Pipeline Wiring
 
 ### 7. Root `package.json` `prepublishOnly` (line ~106)
-Append `&& cd ../web-app && npm ci && npm run build && test -f dist/index.html` after the existing dashboard-ui build.
+Append `&& cd ../web-app && npm ci && npm run build && test -f dist/index.html` after the existing legacy-ui build.
 
 ### 8. `Dockerfile`
 Add `COPY` for web-app build artifacts + server files. Mirror the `dashboard/` COPY pattern. (Merge-4 owns the actual import; Merge-3 ensures files are in the image.)
@@ -109,7 +109,7 @@ run_check "web-app build produces /lab/-prefixed assets" \
 ## NOT Done In This Phase
 
 - Auto-spawn web-app subprocess from `loki dashboard` (Merge-4).
-- Sidebar entry in `dashboard/static/index.html` (Merge-6).
+- Sidebar entry in `legacy-ui-static/index.html` (Merge-6).
 - Deep state dedup (Merge-5).
 - Deprecation of `loki web` (Merge-7).
 - `vite-plugin-html` dev `/` -> `/lab/` redirect (nice-to-have, not blocking).

package/docs/PLANS-INDEX.md

@@ -4,9 +4,8 @@ This index maps each historical plan doc to its status. Plan docs are kept as de
 
 | Plan | Status | Notes |
 |---|---|---|
-| BRANCH-LIFECYCLE-PLAN.md | shipped | Feature-branch-by-default + CI/CD-aware deploy; `feature_branch` logic in `autonomy/run.sh`. |
 | BUILD-HUD-PLAN.md | shipped | Live in-terminal build HUD; `LOKI_HUD` / `[HUD]` in `autonomy/run.sh`, CHANGELOG "Live in-terminal build HUD". |
-| CONFIG-FILE-PLAN.md | shipped | Unified config file; `--config` / `--vars` / `--env-file` flags in `autonomy/loki`. |
+| history/v8-config-plan.md | shipped | Unified config file; `--config` / `--vars` / `--env-file` flags in `autonomy/loki`. |
 | CRASH-REPORTING-PLAN.md | shipped | Crash-reporting + auto-fix; `cmd_crash()` in `autonomy/loki` (`loki crash`). |
 | DEPLOY-PLAN.md | shipped | `loki deploy` advisory print-only; CHANGELOG "`loki deploy`: advisory, print-only deploy guidance". |
 | FAILURE-MEMORY-PLAN.md | shipped | Failure-memory loop; `FailureMode` schema in `memory/schemas.py`. |
@@ -29,5 +28,5 @@ This index maps each historical plan doc to its status. Plan docs are kept as de
 | UNCERTAINTY-ESCALATION-PLAN.md | shipped | Uncertainty-gated escalation (v7.19.2); uncertainty escalation logic in `autonomy/run.sh`. |
 | VERIFIED-COMPLETION-PLAN.md | shipped | Verified completion (v7.19.1); verified-completion gate in `autonomy/run.sh` + `autonomy/completion-council.sh`. |
 | WELCOME-OPENER-PLAN.md | shipped | Welcome opener ("magic opener"); `welcome` path in `autonomy/loki`. |
-| V8-AGENT-SDK-PLAN.md | shipped | The v8 Anthropic SDK runtime migration; shipped on `feature/v8-agent-sdk` as v8.0.0 + v8.1 (`loki-ts/src/runner/sdk_invoker.ts`, `sdk_mode.ts`, CHANGELOG v8.0.0/v8.1). Feature-branch-only, not yet merged to main. |
+| history/v8-agent-sdk-plan.md | shipped | The v8 Anthropic SDK runtime migration; shipped on `feature/v8-agent-sdk` as v8.0.0 + v8.1 (`loki-ts/src/runner/sdk_invoker.ts`, `sdk_mode.ts`, CHANGELOG v8.0.0/v8.1). Feature-branch-only, not yet merged to main. |
 | V8-SDK-RESEARCH-RAW.md | shipped | Research notes underpinning V8-AGENT-SDK-PLAN; design history for the v8 SDK arc. |