loki-mode 11.1.0 → 11.2.1

package/README.md

@@ -17,7 +17,7 @@ CLI reference: [docs/CLI-REFERENCE.md](docs/CLI-REFERENCE.md) (generated from th
 
 Loki Mode is a free, source-available autonomous coding agent by [Autonomi](https://www.autonomi.dev/). Hand it a PRD, GitHub issue, OpenAPI doc or one-line brief. It derives a delivery contract (the acceptance criteria), builds against it, and ends with a signed Evidence Receipt that states what was proven and what was not. If the contract cannot be derived, it stops and asks one question instead of guessing.
 
-Before a build counts as done, a review council selects reviewers from a specialist pool (`agents/types.json`, scored by `run.sh:FOCUS_KEYWORDS`). The bundled MCP server exposes 39 tools over stdio (`mcp/server.py`), including `loki_v10_run`, `loki_v10_status` and `loki_v10_verify` to start a Loki 10 run in the background, read its phase, verdict and cost, and verify its receipt (`BLOCKED` runs report their question). Add it with `claude mcp add loki-mode -- python3 -m mcp.server` from the install directory.
+Before a build counts as done, a review council selects reviewers from a specialist pool (`agents/types.json`, scored by `run.sh:FOCUS_KEYWORDS`). The bundled MCP server exposes 47 tools over stdio (`mcp/server.py`), including `loki_v10_run`, `loki_v10_status` and `loki_v10_verify` to start a Loki 10 run in the background, read its phase, verdict and cost, and verify its receipt (`BLOCKED` runs report their question). Add it with `claude mcp add loki-mode -- python3 -m mcp.server` from the install directory.
 
 ## Contents
 

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: An autonomous software factory that knows what it is supposed to deliver, and proves it did. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v11.1.0
+# Loki Mode v11.2.1
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the legacy engine, which still ships and is being removed (`loki start owner/repo#N` still routes to it; prefer `loki owner/repo#N`).
 
@@ -483,4 +483,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v11.1.0 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v11.2.1 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-11.1.0
+11.2.1

package/autonomy/lib/skill-link-heal.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+# FC-30: keep the provider skill links Loki created pointing at the running
+# install. One shared mechanism, called from npm postinstall and from the bin/loki
+# shim (first invocation after an install or upgrade). Cost: a few lstat/readlink
+# calls, no network, no subprocess beyond readlink/ln/mv on the repair path.
+#
+# Opt out with LOKI_NO_SKILL_LINK_HEAL=1.
+#
+# A link is repointed only when ALL hold:
+#   - it is a symlink (a real directory or file is never touched)
+#   - its target is a Loki install path (…/node_modules/loki-mode, or a Homebrew
+#     Cellar/opt loki-mode dir), so a foreign link is never touched
+#   - its target is missing, or resolves to a different install than the running one
+#   - the running root is itself an install path with a SKILL.md, so a dev checkout
+#     or worktree never hijacks the user's global link
+
+_loki_skill_is_install_path() {
+    case "${1%/}" in
+        */node_modules/loki-mode | */Cellar/loki-mode/* | */opt/loki-mode | */opt/loki-mode/libexec) return 0 ;;
+    esac
+    return 1
+}
+
+loki_skill_link_heal() {
+    [ "${LOKI_NO_SKILL_LINK_HEAL:-}" = "1" ] && return 0
+    local root="${1:-}" home="${HOME:-}" root_p rel link tgt live_p tmp
+    [ -n "$root" ] && [ -n "$home" ] || return 0
+    [ -f "$root/SKILL.md" ] || return 0
+    root_p="$(cd "$root" 2>/dev/null && pwd -P)" || return 0
+    _loki_skill_is_install_path "$root_p" || _loki_skill_is_install_path "$root" || return 0
+
+    for rel in .claude .codex .cline .aider; do
+        link="$home/$rel/skills/loki-mode"
+        [ -L "$link" ] || continue
+        tgt="$(readlink "$link" 2>/dev/null)" || continue
+        case "$tgt" in /*) ;; *) tgt="$(dirname "$link")/$tgt" ;; esac
+        _loki_skill_is_install_path "$tgt" || continue
+        if [ -e "$link" ]; then
+            live_p="$(cd "$link" 2>/dev/null && pwd -P)" || live_p=""
+            [ "$live_p" = "$root_p" ] && continue
+        fi
+        tmp="${link}.heal.$$"
+        rm -f "$tmp" 2>/dev/null
+        ln -s "$root_p" "$tmp" 2>/dev/null || continue
+        # Atomic replace. -T (GNU) / -h (BSD) stop mv from descending into a
+        # link that points at a directory.
+        if mv -fT "$tmp" "$link" 2>/dev/null || mv -fh "$tmp" "$link" 2>/dev/null; then
+            printf 'loki: repointed skill link %s -> %s (was %s)\n' "$link" "$root_p" "$tgt" >&2
+        else
+            rm -f "$tmp" 2>/dev/null
+        fi
+    done
+    return 0
+}

package/autonomy/loki

@@ -1150,6 +1150,53 @@ except Exception:
 PY
 }
 
+# loki_verify_root: the ONE place that decides which tree the receipt verifier
+# hashes (FC-29). The verifier walks and digests the directory it is given, so
+# an ambient cwd (a huge checkout, $HOME, a non-project directory) must never be
+# the default. Order: explicit TARGET_DIR; the parent of an absolute LOKI_DIR;
+# the cwd if it holds .loki; the repo top-level if it holds .loki. Anything else
+# prints one plain sentence on stderr and returns 1 (callers report NOT CHECKED).
+loki_verify_root() {
+    # Helpers live inside so callers that extract this one function stay whole.
+    _loki_verify_trim() {
+        local p="$1"
+        while [ "${#p}" -gt 1 ] && [ "${p%/}" != "$p" ]; do p="${p%/}"; done
+        printf '%s' "$p"
+    }
+
+    _loki_verify_canon() {
+        local p r
+        p="$(_loki_verify_trim "$1")"
+        if [ -n "$p" ] && [ -d "$p" ] && r="$(cd "$p" 2>/dev/null && pwd -P)"; then p="$r"; fi
+        printf '%s' "$p"
+    }
+    local d="${TARGET_DIR:-}" top="" _cd _ch
+    d="$(_loki_verify_trim "$d")"
+    if [ -z "$d" ]; then
+        case "${LOKI_DIR:-}" in
+            /*) [ -d "$LOKI_DIR" ] && d="$(dirname "$LOKI_DIR")" ;;
+        esac
+    fi
+    if [ -z "$d" ]; then
+        if [ -d "$PWD/.loki" ]; then
+            d="$PWD"
+        else
+            top="$(git -C "$PWD" rev-parse --show-toplevel 2>/dev/null || true)"
+            if [ -n "$top" ] && [ -d "$top/.loki" ]; then d="$top"; fi
+        fi
+    fi
+    # Compare canonical paths: every trailing slash stripped, symlinks resolved,
+    # identically for the candidate and HOME (mirrored by resolveVerifyRoot in
+    # loki-ts/src/commands/proof.ts).
+    _cd="$(_loki_verify_canon "$d")"
+    _ch="$(_loki_verify_canon "${HOME:-}")"
+    if [ -z "$d" ] || [ "$_cd" = "/" ] || { [ -n "$_ch" ] && [ "$_cd" = "$_ch" ]; }; then
+        echo "Cannot tell which project tree to verify against: set TARGET_DIR or run from a project directory that contains .loki." >&2
+        return 1
+    fi
+    printf '%s\n' "$d"
+}
+
 loki_remote_verify_receipt() {
     local pj="$1"
     local verifier="${_LOKI_SCRIPT_DIR}/lib/proof-verify.py"
@@ -1181,7 +1228,9 @@ loki_remote_verify_receipt() {
     # empty for a local receipt, which simply means no attestation is checked.
     local _attest_url="${2:-}" _attest=""
     _attest="$(loki_remote_attestation_status "$pj" "$_attest_url")"
-    out="$(python3 -E "$verifier" "$pj" "${TARGET_DIR:-.}" 2>/dev/null)"
+    local _vroot
+    _vroot="$(loki_verify_root)" || { echo "  NOT VERIFIED: no project tree to check against" >&2; return 0; }
+    out="$(python3 -E "$verifier" "$pj" "$_vroot" 2>/dev/null)"
     hash_ok="$(printf '%s' "$out" | jq -r '.hash_ok // false' 2>/dev/null)"
     gpg_ok="$(printf '%s' "$out" | jq -r '.gpg_ok | tostring' 2>/dev/null)"
 
@@ -9547,8 +9596,9 @@ _deploy_receipt_verdict() {
         printf '%s' "UNCHECKED"; return 0
     fi
 
-    local out hash_ok
-    out="$(python3 -E "$verifier" "$pj" "${TARGET_DIR:-.}" 2>/dev/null || true)"
+    local out hash_ok _vroot
+    _vroot="$(loki_verify_root 2>/dev/null)" || { printf '%s' "UNCHECKED"; return 0; }
+    out="$(python3 -E "$verifier" "$pj" "$_vroot" 2>/dev/null || true)"
 
     # "The verifier did not RUN" and "the verifier says the hash is bad" are
     # different facts and must not collapse. If they do, a broken python3
@@ -37656,7 +37706,11 @@ print(json.dumps(json.load(open(os.environ['LOKI_PROOF_JSON'])), indent=2))
                 echo -e "${YELLOW}NOT CHECKED${NC}: python3 is not on PATH, so the verifier could not run (exit 2)." >&2
                 exit 2
             fi
-            local _pv_rc=0 _pv_out="" _pv_base_rc=0
+            local _pv_rc=0 _pv_out="" _pv_base_rc=0 _pv_root=""
+            _pv_root="$(loki_verify_root)" || {
+                echo -e "${YELLOW}NOT CHECKED${NC}: no project tree to verify against (exit 2)." >&2
+                exit 2
+            }
             # Captured, not printed directly, so that --jwks (below) can patch
             # it: BACKLOG 49 -- when --jwks later downgrades _pv_rc to 1
             # (ABSENT) or 2 (NOT CHECKED), this output's own "ok: true"/
@@ -37666,9 +37720,9 @@ print(json.dumps(json.load(open(os.environ['LOKI_PROOF_JSON'])), indent=2))
             # route (proof.ts verifyProof) -- ok already agrees with the exit
             # code there, so there is nothing to patch.
             if [ "$_pv_human" -eq 1 ]; then
-                _pv_out="$(python3 -E "$verifier" --human "$pj" "${TARGET_DIR:-.}")" || _pv_rc=$?
+                _pv_out="$(python3 -E "$verifier" --human "$pj" "$_pv_root")" || _pv_rc=$?
             else
-                _pv_out="$(python3 -E "$verifier" "$pj" "${TARGET_DIR:-.}")" || _pv_rc=$?
+                _pv_out="$(python3 -E "$verifier" "$pj" "$_pv_root")" || _pv_rc=$?
             fi
             _pv_base_rc="$_pv_rc"
 

package/autonomy/run.sh

@@ -22698,16 +22698,24 @@ build_prompt() {
     # configuration there), or LOKI_GOAL_SCORING=0. Advisory only: it never
     # blocks a build and never rewrites the user's goal.
     local goal_sharpening_instruction=""
-    if [ -n "${COMPLETION_PROMISE:-}" ] \
+    # Bash-native trim, matching (goal ?? "").trim() in goal_score.ts: a
+    # whitespace-only promise is an absent goal, not an unmeasurable one.
+    local _goal_trim="${COMPLETION_PROMISE:-}"
+    _goal_trim="${_goal_trim#"${_goal_trim%%[![:space:]]*}"}"
+    _goal_trim="${_goal_trim%"${_goal_trim##*[![:space:]]}"}"
+    if [ -n "$_goal_trim" ] \
        && [ "${LOKI_GOAL_SCORING:-}" != "0" ] \
        && [ "${AUTONOMY_MODE:-}" != "perpetual" ] \
        && [ "${PERPETUAL_MODE:-}" != "true" ] && [ "${PERPETUAL_MODE:-}" != "1" ]; then
         local _goal_lc _goal_dims
-        _goal_lc="$(printf '%s' "$COMPLETION_PROMISE" | tr '[:upper:]' '[:lower:]')"
+        _goal_lc="$(printf '%s' "$_goal_trim" | tr '[:upper:]' '[:lower:]')"
         _goal_dims=0
         # Mirrors the four DIMENSIONS regexes in goal_score.ts, in the same order.
         printf '%s' "$_goal_lc" | grep -qE '[0-9]+(\.[0-9]+)?[[:space:]]*(%|ms|s\b|sec|second|min|minute|hour|day|kb|mb|gb|rps|qps|req|x\b|users?|items?|rows?)' && _goal_dims=$((_goal_dims + 1))
-        printf '%s' "$_goal_lc" | grep -qE '\b(under|below|less than|no more than|at most|over|above|greater than|at least|within|between|<=?|>=?)\b' && _goal_dims=$((_goal_dims + 1))
+        # The symbol alternatives (<, <=, >, >=) cannot use grep's \b: BSD and GNU
+        # disagree on it next to a non-word character. TS \b(<=?)\b means a word
+        # character on BOTH sides of the symbol, so spell that out explicitly.
+        printf '%s' "$_goal_lc" | grep -qE -e '\b(under|below|less than|no more than|at most|over|above|greater than|at least|within|between)\b' -e '[A-Za-z0-9_](<=?|>=?)[A-Za-z0-9_]' && _goal_dims=$((_goal_dims + 1))
         printf '%s' "$_goal_lc" | grep -qE '\b(latency|throughput|p50|p95|p99|uptime|error rate|conversion|coverage|score|accuracy|precision|recall|bundle size|load time|response time|memory|cpu|cost)\b' && _goal_dims=$((_goal_dims + 1))
         printf '%s' "$_goal_lc" | grep -qE '\b(tests? pass|builds? clean|endpoint|returns? [0-9]{3}|exit code|schema|migration|deploys?|renders?|compiles?)\b' && _goal_dims=$((_goal_dims + 1))
         # Only a goal with ZERO measurable dimensions is flagged (score == 0),

package/bin/loki

@@ -115,6 +115,14 @@ else
     exec "$BASH_CLI" "$@"
 fi
 
+# FC-30: an install artifact must not outlive the install that made it. If a provider
+# skill link Loki created is dangling or points at another Loki install, repoint it
+# to this one. A few lstat/readlink calls, no network, silent when already correct.
+if [ -f "$REPO_ROOT/autonomy/lib/skill-link-heal.sh" ]; then
+    # shellcheck source=../autonomy/lib/skill-link-heal.sh
+    source "$REPO_ROOT/autonomy/lib/skill-link-heal.sh" 2>/dev/null && loki_skill_link_heal "$REPO_ROOT" || true
+fi
+
 # Shell completions install themselves: once per VERSION, on the first interactive
 # run after an install or upgrade (stamp: ~/.loki/completions-version). Never needed
 # by the user; skipped under CI, LOKI_NO_COMPLETIONS=1 and non-TTY stdout. Failure

package/bin/loki-postinstall.js

@@ -1,8 +1,10 @@
 #!/usr/bin/env node
-// npm postinstall: install shell completions. Must never fail the install.
+// npm postinstall: repoint stale skill links (FC-30) and install shell completions. Must never fail the install.
 try {
   const { spawnSync } = require("node:child_process");
   const path = require("node:path");
+  const root = path.join(__dirname, "..");
+  spawnSync("bash", ["-c", '. "$1/autonomy/lib/skill-link-heal.sh" && loki_skill_link_heal "$1"', "_", root], { stdio: ["ignore", "ignore", "inherit"], timeout: 10000 });
   if (!process.env.CI && process.env.LOKI_NO_COMPLETIONS !== "1") {
     spawnSync(path.join(__dirname, "loki"), ["completion", "--postinstall"], { stdio: "ignore", timeout: 20000 });
   }

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "11.1.0"
+__version__ = "11.2.1"
 
 # Expose the control app for easy import
 try:

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.1.0. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.2.1. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
 
 | Command | Description |

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v11.1.0
+**Version:** v11.2.1
 
 **Engine note:** `loki "<task>"`, `loki owner/repo#N` and `loki quick` run the Loki 10 engine. `loki start` still routes to the legacy engine, which is being removed (planned work resumes 2026-10-07); prefer `loki owner/repo#N`. See [docs/v10/GUIDE.md](v10/GUIDE.md).
 

package/docs/WANG-PRINCIPLES-PLAN.md

@@ -53,7 +53,7 @@ Measured on this machine, not asserted.
 | **1 Systems Thinking** | STRONG | 8 quality gates, RARV-C loop, council, Evidence Receipt, dual-route parity enforced by test |
 | **2 Speed** | MEASURED, UNOPTIMISED | agent call = **980s = 96%** of iteration; all gates together = 44s |
 | **3 Reliability** | STRONG, newly so | 73 mutation-proven trust invariants; four gates were shipping broken until v8.38.0 |
-| **4 Extensibility** | STRONG | 5 providers, agent type registry, MCP (39 tools), plugin marketplace |
+| **4 Extensibility** | STRONG | 5 providers, agent type registry, MCP (47 tools), plugin marketplace |
 | **5 Feedback Loops / Evals** | **BROKEN** | `cost_usd == 0` on **3 of 5** efficiency records; no eval score for our own harness |
 
 **Principle 5 is the gap, and it is the one Wang weights highest.** He states the

package/docs/v10/DECISIONS.md

@@ -729,3 +729,7 @@ PROGRESS.md (the FC-25 P9 entry) cites a D88 CI waiver that was never recorded i
 8. Implementation: docs/v11/ROUTER-1.md (slices R1-01 to R1-21). This slice is R1-04.
 9. Default-on only after parity: while slices are built, `LOKI_ROUTER` unset means off. R1-19 flips the default to on only when, on the release candidate SHA, the FireLater#17 gate is green (VERIFIED, ready PR, time within raw + 30s, cost <= raw x 1.2) and the B9 corpus shows correctness parity with raw `claude -p` on every shape not listed in the seeded router-shape-defaults.json. After the flip, `LOKI_ROUTER=0` is the opt-out and restores the exact pre-router model behavior, pins included (R1-21 golden).
 10. Accepted risk (CTO, 2026-10-07): B9 measures about 5 of the 14 or more Repo Shape Matrix shapes, so an unmeasured shape starts on Haiku without shape-level parity evidence; the backstops are the in-run escalation ladder (Haiku -> Sonnet 5.5 before STALLED, so a miss costs time and money, not correctness) and the H4 history floor, the receipt records shape parity as NOT PROVEN for any shape with no B9 row, and each matrix shape gains a B9 row as it becomes runnable.
+
+Amendment to D89 (2026-10-07 21:40Z, CTO decision, refined by the founder at 21:45Z, CoS records). This amends only R1-19, the default-on flip that follows the CTO gate; 11.1.0 and 11.2.0 still ship the router OFF. (1) The default executor is Sonnet 5.5; Haiku 5.5 per work unit when Opus assigns it. (2) Roles: Opus 5.5 is the architect, router and advisor, plans and assigns each unit, and is consulted on hard calls. Sonnet is the senior engineer and the default for implementation and fixes. Haiku does tests, docs and small low-risk changes only when Opus assigns them in the plan. Haiku is never the blanket default. (3) L0 holds: the harness never routes by task type or path regex; it only executes, verifies and escalates. (4) The route schema is `units: [{id, kind, executor, reason}]` plus a run default of sonnet; a missing or invalid unit route goes to sonnet with NOT PROVEN. A haiku unit that fails a code-owned check is redone on sonnet, then escalates to opus; a Wall assigned to haiku gets an Opus review before implement. The receipt lists the executor, assigner and reason per unit. The per-unit schema lands in 11.2.0 or 11.2.1 depending on what is merged. (5) Escalation stays evidence-gated (haiku -> sonnet -> opus, and sonnet -> opus), and `LOKI_ROUTER=0` equals pre-router behavior exactly (the R1-21 golden). (6) The R1-16 shape-defaults semantics are inverted (a shape is listed as `haiku` once it has earned it; an absent listing means Sonnet), and R1-16 history is an input to Opus, not a harness rule. Rationale: a wrong PR costs the user far more than the token savings, B9 covers only about 5 of 14 shapes (item 10), and under L0 a model earns the cheaper tier with evidence. Items 3, 5, 7 and 9 above are read with this amendment; their text is kept as recorded. See docs/v11/ROUTER-1.md sections 4.1, 4.3 and 4.6.
+
+Amendment 2 to D89 (2026-10-08 00:15Z, steering finding, CoS records; tightens a gate, so it binds until the CTO relaxes it). R1-19 gains one more gate line: on the trivial fixture (the steering Node off-by-one fixture), router-on cost must be <= router-off cost x 1.05, measured with n>=3 per arm and recorded per arm as cache-read input tokens, fresh input tokens, output tokens, dollars and wall time (R1-17 B9). Evidence that prompted it (n=1, may be variance): 11.2.0 smoke, router on cost +15% tokens, +27% dollars and +38s with zero advisor calls and no route change. If the advisor tool definition costs tokens on sessions that never consult it, the advisor is enabled only on the sessions Opus marks as needing it (plan and fix rounds), not on every stage. Measure before changing code.

package/docs/v10/FAILURE-CLASSES.md

@@ -331,6 +331,32 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - User saw: tests/test-proof-verify-jwks.sh passed 108/0 in 33s in a fresh worktree and hung until killed when run from the main checkout. The CI-style run was green and the founder's own run was red, so the suite read as flaky.
 - Mechanism (measured): `loki proof verify` and `loki_remote_verify_receipt` run `proof-verify.py "$pj" "${TARGET_DIR:-.}"`. With TARGET_DIR unset the verifier runs `compute_tree_digest` on the caller's cwd, whose filesystem walk visited 1,054,266 paths (13.3s just to enumerate, then it hashes them) because `.claude/worktrees` (190 worktrees, 32G) sits inside the checkout. A fresh worktree has a few thousand files.
 - Law: L2 (a verdict is about the tree it names, never an ambient one), and the test hermeticity rule: a test owns its fixture tree.
-- Siblings: swept every tests/*.sh spawn of `proof verify` and `loki_remote_verify_receipt`; only the jwks test lacked TARGET_DIR. Direct `proof-verify.py` runs pass the repo as an argument. Other `${TARGET_DIR:-.}` readers in autonomy/loki (HANDOFF.md, failover.json, .loki dir) are not swept yet.
+- Siblings: swept every tests/*.sh spawn of `proof verify` and `loki_remote_verify_receipt`; only the jwks test lacked TARGET_DIR. Direct `proof-verify.py` runs pass the repo as an argument. Sibling sweep (11.2.0 lane 10): of every `${TARGET_DIR:-.}` reader in autonomy/, five spawn sites were unsafe: the Bun `loki proof verify` (loki-ts/src/commands/proof.ts, the default route for a plain `verify <id>`), the bash `loki proof verify` (human and JSON, reached by flags or LOKI_LEGACY_BASH), `loki_remote_verify_receipt` and `_deploy_receipt_verdict` all handed the verifier the caller's cwd (it digests the tree when cwd is a repo). Safe, each reads or writes fixed paths and walks nothing: cmd_deploy detectors (test -f on named files), cmd_failover (one failover.json), `loki handoff --md` (writes one HANDOFF.md), crash.sh (writes .loki/crash), spec-interrogation.sh (five named manifests). app-runner.sh and completion-council.sh run only inside a `loki start` run, where run.sh sets TARGET_DIR to the project.
 - Mechanism of the fix: every verifier spawn in the jwks test sets TARGET_DIR to its fixture; tests/test-verifier-spawn-sets-target-dir.sh fails any test that spawns the verifier without TARGET_DIR or a cd into an owned directory.
+- Shared mechanism for the sweep: `loki_verify_root` in autonomy/loki and its port `resolveVerifyRoot` in loki-ts/src/commands/proof.ts are the one resolver (TARGET_DIR, parent of an absolute LOKI_DIR, cwd or repo top-level holding .loki, else a plain refusal and exit 2 NOT CHECKED; HOME and / are never roots, a trailing slash is normalized first). The first sweep fixed only the bash copy; the HIGH review found the Bun route still defaulting to ".".
+- Sweep fixture: tests/test-verifier-root-not-ambient-cwd.sh (runs `proof verify` through bin/loki on both the default and legacy routes; source guards cover autonomy/loki and loki-ts/src) and loki-ts/tests/commands/proof_verify_root.test.ts (the TS resolver, red before the port). The bash source guard goes red when a spawn passes `${TARGET_DIR:-.}` again.
 - Fixture: tests/test-verifier-spawn-sets-target-dir.sh, mutated against the pre-fix jwks test (7 hits). tests/test-proof-verify-jwks.sh run with cwd = the main checkout.
+
+## FC-30 An install artifact outlives the install that made it
+- User saw: after upgrading to 11.1.0, ~/.claude/skills/loki-mode was a symlink to ~/.bun/install/global/node_modules/loki-mode, which no longer existed. `loki doctor` FAILed and told the user to run `loki setup-skill`, an extra command the product should never ask for.
+- Mechanism (measured): `cmd_setup_skill` creates the provider skill links once and only on request. Nothing re-checked them on install, upgrade or first run, so a package-manager move or reinstall left a dangling link (or one to the previous install). Raw cause is a one-shot writer with no owner for the link's lifetime.
+- Law: L0 (the harness repairs what it can verify is its own instead of delegating to the user), L2 (the doctor verdict is about the host as it is, and the fix must make that true without a command).
+- Siblings: swept every place Loki writes an install-time path. Provider skill links ~/.claude, ~/.codex, ~/.cline, ~/.aider skills/loki-mode (all four covered by the shared mechanism); `cmd_remote` ln -sf of the Claude skill link in autonomy/loki (only creates when SKILL.md is absent, covered by the same repair on the next run); shell completions via `completion --postinstall` and the shim (already self-healing, stamped by VERSION in ~/.loki/completions-version); no PATH shims or bin links are written by Loki (the package manager owns bin/loki). Real directories and foreign links are deliberately left to doctor.
+- Mechanism of the fix: autonomy/lib/skill-link-heal.sh `loki_skill_link_heal` repoints a symlink only when its target is a Loki install path (node_modules/loki-mode or a Homebrew loki-mode dir) that is missing or is a different install than the running one, and only when the running root is itself an install path. Atomic temp link plus rename, one stderr line, silent no-op when correct, LOKI_NO_SKILL_LINK_HEAL=1 opts out. Called from bin/loki-postinstall.js (install and upgrade) and the bin/loki shim (first run).
+- Fixture: tests/test-skill-link-heal.sh (dangling, other install, real dir, foreign link, correct link, opt-out, dev checkout), red before autonomy/lib/skill-link-heal.sh existed.
+
+## FC-31 A slice gate skips the suites that guard its own files, and main goes red in Tier B
+- User saw: main 27447cf46 failed Tier B on tests/test-doctor-blocker-parity.sh (run 37697291383). The slice R1-20 (8ff988516) changed loki-ts/src/commands/doctor.ts and gated only on tsc and bun test. The local-ci fast tier had timed out (rc=124) on a loaded host, so no shell suite ran.
+- Law: L2 (a verdict is about the tree it names; a gate that did not run the guarding suites says nothing about them) and the evidence rule (a timeout is not a pass).
+- Cause (measured): scripts/select-tests.sh rule R4 handled loki-ts/src files with `continue` after selecting bun tests, so rule R3 (shell suites that reference the file) never ran for them. test-doctor-blocker-parity.sh runs `bin/loki doctor`, never the string doctor.ts, so no path or basename match could have found it anyway.
+- Mechanism: one shared mapping, scripts/select-tests.sh. R4 now also selects shell suites that name the full path, and for loki-ts/src/commands/X.ts those that run `loki X`. One gate command, `bash scripts/local-ci.sh --impacted <base>` (scripts/impacted-gate.sh), runs only the selected shell and moat suites, each under `timeout -k`, prints per-suite rc, and exits non-zero on any failure or timeout.
+- Siblings swept (file-to-suite mapping by source tree): loki-ts/src was the only tree whose rule skipped the shell grep (fixed). mcp/, providers/, autonomy/ (other than run.sh and loki), scripts/ get R3 path and basename grep. dashboard/ gets R3 plus the R5 pytest area. web-app/ gets R3 plus R5. Still thin: a loki-ts/src file that is not a command module (runner/, util/) maps to shell suites by full path only, not by the subcommand a suite drives; dashboard and web-app shell suites that drive an API route by URL are not mapped to the handler file; mcp/server.py tools are not mapped to suites that call the tool by name. Follow-up: a per-tree needle table once a second miss appears.
+- Fixture: tests/test-select-tests.sh, "FC-31: doctor.ts selects doctor parity shell suite" (red before the fix: 39 passed, 1 failed).
+
+## FC-32 Hand-maintained file lists drift from the import graph
+- User saw: Tier B run 37706008817 on main 6a01413bd failed two suites: "no hardcoded home-directory paths in tests" (and its cascade, "Structural checks catch planted defects (D44-C)") and "Loki control plane wiring (CP-04)". Both slices had passed tsc and the full bun test.
+- Law: L2 (a verdict is about the tree it names; a gate that did not run the guarding suites says nothing about them).
+- Cause (measured): faf1d0ace added tests/test-parity-goal-score.sh with hardcoded /opt/homebrew/bin and /usr/local/bin grep paths (flagged by tests/test-no-hardcoded-paths.sh). The R1 router slices (0f3e3d55a, c15b8157b, 1b9e479c1) added loki-ts/src/engine10/cost.ts, runner/router/flag.ts and runner/router/route_block.ts to the control-plane value-import closure, but Dockerfile.control-plane lists its COPY files by hand. RC-SLICE-SHELL-GATE: the FC-31 impacted gate selected neither shell structural guard, including for a touched tests/*.sh.
+- Mechanism (this slice, minimal): the parity test discovers greps with `type -ap grep ggrep` (no absolute paths); the three files are added to Dockerfile.control-plane. 11.2.2 follow-up (root fix): replace the hand-maintained COPY list with a directory COPY or a generated list, make CP-04 build the image and import the bundle, and extend scripts/select-tests.sh so a touched tests/*.sh selects the hardcoded-path and structural-checks suites and a loki-ts/src file reachable from packages/control-plane selects CP-04.
+- Siblings swept: tests/test-no-hardcoded-paths.sh scans every tests/ file (3 passed, 0 failed after the fix); the CP-04 closure guard covers every loki-ts/src value import (25 passed, 0 failed); no other hits.
+- Fixture: the two existing guards, red on 6a01413bd and green here.

package/docs/v10/GUIDE.md

@@ -233,6 +233,91 @@ NOT PROVEN line adds the literal entry `kill blocking not enforced`
 (`loki-ts/src/engine10/stages/seal.ts`). opencode is not one of engine10's
 provider names (`claude`, `codex`, `cline`, `aider`); it is not supported.
 
+## Model routing
+
+Model routing picks which Claude model does each stage of a run. It is OFF
+by default in 11.2.0. Set `LOKI_ROUTER=1` to opt in. `LOKI_ROUTER=0` is the
+explicit opt-out and keeps the exact pre-router model behavior, pins
+included (guarded by the opt-out golden test in
+`loki-ts/tests/engine10/router_optout_golden.test.ts`). Explicit
+`LOKI_MODEL_OVERRIDE` and `LOKI_CLAUDE_MODEL_DEVELOPMENT` still win and
+bypass the router. The other knobs are `LOKI_ROUTER_EXECUTOR` (post-flip
+default sonnet; haiku only by earned evidence), `LOKI_ROUTER_ESCALATE` (default sonnet) and `LOKI_ROUTER_ADVISOR`
+(default opus; `off` disables the advisor). The router engine itself lands in
+11.2.0; the pieces below marked "shipped in 11.1.0" are already in the code.
+
+### Executor and advisor
+
+When the router is on, the post-flip default executor is Sonnet 5.5;
+Haiku 5.5 per work unit when Opus assigns it. Opus 5.5 is the architect,
+router and advisor: it plans, assigns each work unit and is consulted on
+hard calls. Sonnet is the senior engineer and the default for
+implementation and fixes. Haiku does tests, docs and small low-risk changes
+only when Opus assigns them in the plan, and is never the blanket default.
+The harness never routes by task type or path regex; it only executes,
+verifies and escalates. Per-repo history is an input to Opus, not a harness
+rule. The per-unit route (`units: [{id, kind, executor, reason}]` plus a run
+default of sonnet) lands in 11.2.0 or 11.2.1 depending on what is merged. A
+missing or invalid unit route goes to Sonnet and is reported as NOT PROVEN.
+The receipt lists the executor, assigner and reason per unit.
+The advisor needs Claude Code 2.1.293 or later,
+which the Agent SDK 0.3.293 bundles (shipped in 11.1.0). If the advisor is
+unavailable, the executor is Sonnet 5.5 and the run is never failed for it.
+The advisor is unavailable when the provider is not
+claude, when `CLAUDE_CODE_USE_BEDROCK`, `CLAUDE_CODE_USE_VERTEX` or
+`CLAUDE_CODE_USE_FOUNDRY` is set, when `ANTHROPIC_BASE_URL` points at a
+non-Anthropic host, when Claude Code is older than 2.1.293, when
+`LOKI_ROUTER_ADVISOR=off`, or after a session reports an advisor tool error
+(remembered for the rest of the run). The probe is
+`loki-ts/src/runner/router/advisor_probe.ts` (shipped in 11.1.0). The
+default-on flip happens after the CTO gate; 11.1.0 and 11.2.0 still ship the
+router off.
+
+### Escalation
+
+Escalation is gated on evidence and only moves up: haiku to sonnet to opus,
+and sonnet to opus. A haiku unit that fails a code-owned check is redone on
+Sonnet, then escalates to Opus. A Wall assigned to Haiku gets an Opus review
+before implement. A repeated failure on Sonnet gets a fix round on Opus
+before the run can stall. A failure owned by the harness, the environment or
+the provider causes no transition and is reported as NOT PROVEN.
+
+### Per-repo-shape outcome memory
+
+Loki remembers how each kind of repo went. The shape key is the Project
+Model `workspaceKind` plus the sorted runners, for example
+`multi-root:pytest+vitest`; a package with no runner contributes `none`.
+Outcomes are stored in the per-repo cache. The haiku floor moves a shape to
+Sonnet after 2 code-owned losses in the last 3 Haiku runs. Only code-owned
+FAILs and escalations count; harness, environment and provider errors and
+NOT PROVEN outcomes never do. A missing or corrupt history file is a cold
+read, never a crash (shipped in 11.1.0, `loki-ts/src/runner/router/history.ts`).
+The shipped `loki-ts/data/router-shape-defaults.json` is empty in 11.1.0.
+After the flip a shape is listed as `haiku` once it has earned it with a B9
+row, and an absent listing means Sonnet. Shape history and the defaults file
+are inputs to Opus, not harness routing rules.
+
+### Pricing
+
+Haiku 5.5 is priced on its exact model id: $0.10 in and $0.50 out per MTok
+for prompts up to 100K tokens, and $0.50 in and $2.50 out over 100K, with
+the cache rates in `loki-ts/data/model-pricing.json`. The `haiku` family
+alias row in that file is still the Haiku 4.5 price of $1 and $5, because
+the exact-id key is matched first (`loki-ts/src/runner/budget.ts`).
+
+### What you see
+
+In 11.2.0 the receipt carries a `route` block (initial decision, each
+escalation with its trigger, advisor availability and the share of requests
+above 100K), and `loki doctor` prints an advisor line. The executor and any
+fallback reason are also printed on the start line.
+
+### Comparing models
+
+`scripts/b9-scoreboard.sh` is the comparison harness for routed against raw
+runs on the B9 corpus, and it can emit shape defaults from those runs
+(lands in 11.2.0).
+
 ## After the flip
 
 D48 made v10 the default for `loki "<task>"`, `loki owner/repo#N` and

package/docs/v11/ROUTER-1.md

@@ -1,11 +1,11 @@
-# ROUTER-1: Haiku executor, Opus advisor, evidence-gated Sonnet escalation
+# ROUTER-1: Sonnet executor, Opus advisor, evidence-earned Haiku, evidence-gated escalation
 
-Status: plan (Architect, 2026-10-07; default-on adjustment from steering the same day). Ship target 11.1.0, where Haiku 5.5 executor + Opus advisor is the DEFAULT. While slices are built they merge behind `LOKI_ROUTER` (unset = off). R1-19, the final slice, makes it default ON, gated on steering's FireLater#17 gate plus the B9 scoreboard on the release candidate. After the flip `LOKI_ROUTER=0` is the opt-out and restores the exact pre-router model behavior, pins included (R1-21 test).
+Status: plan (Architect, 2026-10-07; default-on adjustment from steering the same day). CTO decision 2026-10-07 21:40Z, refined by the founder at 21:45Z (D89 amendment), governs R1-19 only: when the default-on flip lands after the CTO gate, the default executor is Sonnet 5.5; Haiku 5.5 per work unit when Opus assigns it. Opus 5.5 is the architect, router and advisor: it plans, assigns each work unit and is consulted on hard calls. Sonnet is the senior engineer and the default for implementation and fixes. Haiku does tests, docs and small low-risk changes only when Opus assigns them in the plan. Haiku is never the blanket default. The per-unit schema (section 4.1) lands in 11.2.0 or 11.2.1 depending on what is merged; the earlier whole-run schema below is superseded. 11.1.0 and 11.2.0 still ship the router OFF. Earlier text below that calls Haiku the default executor describes the superseded plan. While slices are built they merge behind `LOKI_ROUTER` (unset = off). R1-19, the final slice, makes it default ON, gated on steering's FireLater#17 gate plus the B9 scoreboard on the release candidate. After the flip `LOKI_ROUTER=0` is the opt-out and restores the exact pre-router model behavior, pins included (R1-21 test).
 Source: founder directive 2026-10-07 ("Opus is the advisor, Haiku does all engineering work; Sonnet is optional, routed by Opus when Haiku is not performing well enough; model decides").
 Scope: the engine10 path (`loki start <issue|text>`, `loki-ts/src/engine10`). The legacy RARV route (`autonomy/run.sh`, `runner/autonomous.ts`, `runner/capability_router.ts`) keeps its tiers; only its pricing table mirror changes (R1-02).
 
 ## 1. Goal
-Every engine10 session runs on Claude Haiku 5.5 as the executor with Opus attached through the native Claude Code advisor tool, so the model itself decides when it needs stronger judgment. Opus picks the executor at plan time with a recorded reason. Sonnet 5.5 takes over for the rest of a run only on execution evidence. The outcome (solve rate, time, cost) is never below raw `claude -p`, proven on the B9 scoreboard.
+After the R1-19 flip, every engine10 session runs on Claude Sonnet 5.5 as the default executor with Opus 5.5 attached through the native Claude Code advisor tool, so the model itself decides when it needs stronger judgment. Opus picks the executor at plan time with a recorded reason. Opus may route a task to Haiku 5.5 only when the R1-16 history and a B9 row show Haiku at outcome parity on that repo shape; a shape with no evidence stays on Sonnet. Escalation stays evidence-gated (haiku -> sonnet -> opus, and sonnet -> opus). The outcome (solve rate, time, cost) is never below raw `claude -p`, proven on the B9 scoreboard.
 
 ## 2. What already exists (read before building; cite, do not rebuild)
 - Session model plumbing: `engine10/session.ts:25` resolveModel, `:31-60` childEnv (tier pins via `LOKI_CLAUDE_MODEL_<TIER>`, `LOKI_E10_MODEL_DEFAULT` omits `--model`).
@@ -32,15 +32,17 @@ Every engine10 session runs on Claude Haiku 5.5 as the executor with Opus attach
 ## 4. Architecture
 ### 4.1 Routing decision schema (written into plan-scope.json by the plan session; parsed by `runner/router/decision.ts`)
 ```
-route: { executor: "haiku" | "sonnet", reason: string (<= 200 chars), risk: "low" | "medium" | "high",
-         source: "advisor" | "opus-plan" | "default" | "history" }
+route: { default: "sonnet",
+         units: [ { id: string, kind: string, executor: "haiku" | "sonnet", reason: string (<= 200 chars) } ],
+         source: "opus-plan" | "advisor" | "default" }
 ```
-Invalid or missing JSON yields `{executor: "haiku", source: "default", reason: "no route returned"}` (Sonnet when the advisor is unavailable, section 4.4) plus a NOT PROVEN line (L2: fail open on work). Aliases resolve through `providers/model_catalog.json` (haiku -> claude-haiku-5-5, sonnet -> claude-sonnet-5-5, opus -> claude-opus-5-5).
+Per-unit schema (founder refinement 2026-10-07 21:45Z; lands in 11.2.0 or 11.2.1 depending on what is merged). Opus writes the units into plan-scope.json at plan time, with a run default of sonnet. The harness never routes by task type or path regex (L0): it only executes, verifies and escalates. R1-16 history is an input to the Opus planning prompt, not a harness rule. The receipt lists the executor, the assigner and the reason per unit.
+A missing or invalid unit route goes to sonnet (`{executor: "sonnet", source: "default", reason: "no route returned"}`; the superseded plan returned haiku here) plus a NOT PROVEN line (L2: fail open on work). Aliases resolve through `providers/model_catalog.json` (haiku -> claude-haiku-5-5, sonnet -> claude-sonnet-5-5, opus -> claude-opus-5-5).
 
 ### 4.2 Where the decision is made
-1. Run start: advisor availability is probed (R1-06). Start line: `executor haiku-5.5, advisor opus` (or `executor sonnet-5.5, advisor unavailable: <reason>`).
+1. Run start: advisor availability is probed (R1-06). Start line: `executor sonnet-5.5, advisor opus` (or `executor haiku-5.5, advisor opus` for a shape with earned Haiku evidence; or `executor sonnet-5.5, advisor unavailable: <reason>`).
 2. Plan stage runs (normal tasks): the plan session runs on the executor with the Opus advisor attached; its brief asks it to consult the advisor and write `route` into plan-scope.json. With no advisor, the plan session itself is pinned to Opus (the single cheap Opus call) and writes the same field; a `haiku` route is then raised to Sonnet (section 4.4).
-3. Plan skipped (small task, `plan.ts:55`): no extra call. Executor = history floor or shape default if one applies, else Haiku with the advisor (Sonnet with no advisor, section 4.4), `source: default`.
+3. Plan skipped (small task, `plan.ts:55`): no extra call. Executor = history floor or shape default if one applies, else Sonnet with the advisor (post-flip default; Haiku only for a shape listed `haiku` in section 4.6), `source: default`.
 4. Recorded: a `route` event (implement), run.started `route_initial`, receipt `route` block (initial decision, every escalation with trigger and evidence pointer, advisor availability, share of requests above 100K).
 
 ### 4.3 Escalation state machine (pure function in `runner/router/decision.ts`)
@@ -51,7 +53,7 @@ EXEC(haiku) --c: SPEC_CONFLICT exit | stall | implement limit kill------> EXEC(s
 EXEC(sonnet) --a or stall------------------------------------------------> fix round on opus (existing L1 path) -> STALLED
 any state --harness/env/provider-owned ERROR-----------------------------> no transition (NOT PROVEN path)
 ```
-At most one Haiku -> Sonnet transition per run. A SPEC_CONFLICT confirmed by Sonnet stays BLOCKED. Resume across the swap: the fix session resumes the prior session id with the new model when the SDK honors `model` on `resume` (verified in R1-12); otherwise it starts fresh with the full brief plus the prior diagnosis and records `fix_resume_why`.
+Per-unit rule (founder refinement 2026-10-07 21:45Z): a haiku unit that fails a code-owned check is redone on sonnet, then escalates to opus; a Wall assigned to haiku gets an Opus review before implement. The state machine above is the whole-run form and is read per unit. At most one Haiku -> Sonnet transition per run (whole-run form). A SPEC_CONFLICT confirmed by Sonnet stays BLOCKED. Resume across the swap: the fix session resumes the prior session id with the new model when the SDK honors `model` on `resume` (verified in R1-12); otherwise it starts fresh with the full brief plus the prior diagnosis and records `fix_resume_why`.
 
 ### 4.4 Advisor wiring and fallback detection
 - Wiring: SDK route passes `settings: { advisorModel }` (in SDK 0.3.288 `advisorModel` is a field of `interface Settings`, `sdk.d.ts:6674,8987`, not a top-level Option; R1-07 confirms the 0.3.293 shape). CLI route merges `advisorModel` into the existing `--settings` JSON or uses `--advisor` when `claudeFlagSupported` says so.
@@ -62,13 +64,13 @@ At most one Haiku -> Sonnet transition per run. A SPEC_CONFLICT confirmed by Son
 Lean briefs and the cache-stable prefix already exist (`LOKI_E10_PREFIX=lean`, `providers.ts:524`). R1-07 adds `autoCompactWindow: 100000` (the SDK minimum, `sdk.d.ts` Settings) for routed sessions. R1-08 records per request `input+cache_read+cache_creation` and writes `requests_total`, `requests_over_100k` and advisor tokens into each cost event; the receipt shows the share.
 
 ### 4.6 Per-shape defaults (a shape that fails parity routes to Sonnet instead of holding the release)
-- Where it lives: `loki-ts/data/router-shape-defaults.json`, shipped in the package next to model-pricing.json. Schema `{"$schema_version":1, "_source":"<B9 run ids + RC version + date>", "shapes":{"<shape_key>":{"executor":"sonnet"|"prior-default","evidence":"<METRICS.md row ref>"}}}`. Legal values are `sonnet` and `prior-default` (the `LOKI_ROUTER=0` model for that stage). A shape is listed only to move it up; absent shape = Haiku default. Created empty by R1-16.
+- Where it lives: `loki-ts/data/router-shape-defaults.json`, shipped in the package next to model-pricing.json. Schema `{"$schema_version":1, "_source":"<B9 run ids + RC version + date>", "shapes":{"<shape_key>":{"executor":"haiku"|"prior-default","evidence":"<METRICS.md row ref>"}}}`. Semantics inverted by the 2026-10-07 21:40Z CTO decision and refined by the founder at 21:45Z (D89 amendment): the default executor is Sonnet 5.5 and Haiku 5.5 is used per work unit when Opus assigns it. A shape is listed as `haiku` once it has earned it with a B9 row showing Haiku at outcome parity on that shape, and an absent listing means Sonnet 5.5. The shipped file and the R1-16 history are inputs to the Opus planning prompt, not harness routing rules; the harness never routes by task type or path regex (L0). `prior-default` (the `LOKI_ROUTER=0` model for that stage) stays legal for a shape where Sonnet also loses. The shipped file is empty (R1-16), so every shape starts on Sonnet.
 - Shape key: Project Model `workspaceKind` plus the sorted, lowercased, de-duplicated package `runner` labels from `.loki/project.json` (both model-derived, L4; the schema has no language field, `project_model/schema.ts:20-30`, decided 2026-10-07 by the CoS after R1-16 found the gap), for example `multi-root:pytest+vitest`. A package with no runner contributes `none`. The same function (`shapeKey()` in history.ts) computes it at runtime and in the receipt (R1-15 writes `route.shape_key`), so B9 rows and runtime agree by construction. No file-pattern regex (L0).
 - Seeding: `scripts/b9-scoreboard.sh --emit-shape-defaults <out.json>` (R1-17) reads each run's receipt `route.shape_key`, compares arm 2 (router) with arm 1 (raw) per shape on correctness, and lists every shape where router solve count < raw. A shape where Sonnet also loses on the confirming rerun is emitted as `prior-default`. R1-19 commits that output as the shipped file, citing the METRICS.md rows. Later B9 runs reseed it in a normal slice; removing a shape, or lowering it from `prior-default` to `sonnet`, needs a B9 row showing the lower executor at parity on it.
-- Read path: `decision.ts` resolves the executor as the strongest of: Opus route, shipped shape default, per-repo history floor (R1-16, local runs; Haiku lost 2 of the last 3 by code-owned FAIL or escalation -> Sonnet, cleared only by a B9 row showing Haiku at parity on that shape), the no-advisor floor (section 4.4), then Haiku. `prior-default` resolves to the exact `LOKI_ROUTER=0` model for that stage (R1-21 fixture semantics). Explicit `LOKI_MODEL_OVERRIDE`, `LOKI_CLAUDE_MODEL_DEVELOPMENT` or `LOKI_ROUTER_EXECUTOR` still win. Evidence rungs never lower a model: a shape default can only move the executor up. The shape key is a lookup into executed outcome evidence and may only move the executor up (ENGINE-LAWS H4); this is the documented exception to the L0 review rule. The receipt records `source: shape-default` with the evidence ref. Missing or corrupt file = empty map plus a NOT PROVEN line, never a crash.
+- Read path: `decision.ts` resolves the executor as the strongest of: Opus route, shipped shape default, per-repo history floor (R1-16, local runs; under the inverted semantics Haiku is reachable only when the shape is listed `haiku` and the history does not show Haiku losing 2 of the last 3 by code-owned FAIL or escalation -> Sonnet, cleared only by a B9 row showing Haiku at parity on that shape), the no-advisor floor (section 4.4), then Sonnet unless the shape is listed `haiku`. `prior-default` resolves to the exact `LOKI_ROUTER=0` model for that stage (R1-21 fixture semantics). Explicit `LOKI_MODEL_OVERRIDE`, `LOKI_CLAUDE_MODEL_DEVELOPMENT` or `LOKI_ROUTER_EXECUTOR` still win. Evidence rungs never lower a model: a shape default can only move the executor up. The shape key is a lookup into executed outcome evidence and may only move the executor up (ENGINE-LAWS H4); this is the documented exception to the L0 review rule. The receipt records `source: shape-default` with the evidence ref. Missing or corrupt file = empty map plus a NOT PROVEN line, never a crash.
 
 ## 5. Knobs
-`LOKI_ROUTER` (unset = off while building; unset = on after R1-19; `0` = opt-out to pre-router behavior), `LOKI_ROUTER_EXECUTOR` (default haiku), `LOKI_ROUTER_ESCALATE` (default sonnet), `LOKI_ROUTER_ADVISOR` (default opus; `off` disables). `LOKI_MODEL_OVERRIDE` and explicit `LOKI_CLAUDE_MODEL_DEVELOPMENT` still win and bypass the router (recorded `source: override`).
+`LOKI_ROUTER` (unset = off while building; unset = on after R1-19; `0` = opt-out to pre-router behavior), `LOKI_ROUTER_EXECUTOR` (post-flip default sonnet; haiku only by earned evidence), `LOKI_ROUTER_ESCALATE` (default sonnet), `LOKI_ROUTER_ADVISOR` (default opus; `off` disables). `LOKI_MODEL_OVERRIDE` and explicit `LOKI_CLAUDE_MODEL_DEVELOPMENT` still win and bypass the router (recorded `source: override`).
 
 ## 6. Slices
 Tier sets the review (D12): LOW/MEDIUM by Tech Leads, HIGH by opus reviewers, unanimous. Every TS slice rebuilds dist in the main checkout before its train (memory: symlinked node_modules), runs `bash scripts/local-ci.sh`, and keeps `LOKI_ROUTER` unset behavior byte-identical (existing suites green). File sets do not overlap; `runner/router/flag.ts` (created by R1-05) and `loki-ts/data/router-shape-defaults.json` (created empty by R1-16) are edited only by R1-19, after every other slice has merged, so no two slices touch them concurrently.
@@ -93,7 +95,7 @@ Tier sets the review (D12): LOW/MEDIUM by Tech Leads, HIGH by opus reviewers, un
 | R1-16 | Per-shape outcome history (H4) | loki-ts/src/runner/router/history.ts, loki-ts/src/e10ext/repomemory.ts, loki-ts/tests/runner/router_history.test.ts | MEDIUM | haiku | append/read in the per-repo cache dir; shape key from Project Model workspaceKind + sorted runner labels (model-derived, L4), never from file regex; floor: haiku lost 2 of last 3 on the shape (code-owned FAIL or escalation; harness, env and provider ERRORs do not count) -> sonnet, cleared only by a B9 row showing Haiku at parity on that shape; fixture: 3 harness-owned FAILs on haiku do NOT trigger the floor. Also creates the empty shipped `loki-ts/data/router-shape-defaults.json` and its reader `shapeDefault(key)` (section 4.6), which accepts `sonnet` and `prior-default` and rejects any other value (cold read + NOT PROVEN) | corrupt file is a cold read, never a crash | none |
 | R1-17 | B9 scoreboard harness | scripts/b9-scoreboard.sh, tests/test-b9-scoreboard.sh, tests/run-all-tests.sh (registration + shard row) | MEDIUM | sonnet | dry-run with a stub `claude` produces one METRICS row per arm with solve, wall seconds, usd, shape_key; `--emit-shape-defaults` on a fixture where the router loses one shape lists exactly that shape as `sonnet`; a fixture where the Sonnet confirming rerun also loses emits it as `prior-default` | shellcheck, `timeout -k`, runner registration guard (memory: new test file structural guards) | none |
 | R1-18 | Docs: GUIDE model-routing section, CHANGELOG | docs/v10/GUIDE.md, CHANGELOG.md | LOW | haiku | doc lint; GUIDE names every knob in section 5 and the fallback | Release Manager reads it against the receipt | R1-15 |
-| R1-19 | Final flip: LOKI_ROUTER default ON for 11.1.0, ship seeded shape defaults | loki-ts/src/runner/router/flag.ts, loki-ts/data/router-shape-defaults.json, loki-ts/tests/runner/router_flag_default.test.ts | HIGH | sonnet | red: unset env resolves off; green: unset resolves on, `0`/`off`/`false` resolve off; R1-21 opt-out golden still green with `LOKI_ROUTER=0` | GATE (all on the release candidate SHA): steering's FireLater#17 gate green (VERIFIED, ready PR, time within raw + 30s, cost <= raw x 1.2); B9 correctness parity with raw `claude -p` on every shape not listed in the seeded shape-defaults file; arm 4 correctness parity, or the Sonnet no-advisor fallback in place (R1-07, R1-09); every shape listed as `prior-default` runs the exact LOKI_ROUTER=0 models (R1-21 golden per listed shape); the seeded file committed with its METRICS.md refs | all |
+| R1-19 | Final flip after the CTO gate: LOKI_ROUTER default ON with Sonnet 5.5 + Opus 5.5 advisor as the default executor (11.1.0 and 11.2.0 still ship OFF); Haiku 5.5 per work unit only when Opus assigns it in the plan, per-unit schema `units: [{id, kind, executor, reason}]` (11.2.0 or 11.2.1); ship seeded shape defaults (`haiku` only for earned shapes) | loki-ts/src/runner/router/flag.ts, loki-ts/data/router-shape-defaults.json, loki-ts/tests/runner/router_flag_default.test.ts | HIGH | sonnet | red: unset env resolves off; green: unset resolves on, `0`/`off`/`false` resolve off; R1-21 opt-out golden still green with `LOKI_ROUTER=0` | GATE (all on the release candidate SHA): steering's FireLater#17 gate green (VERIFIED, ready PR, time within raw + 30s, cost <= raw x 1.2); B9 correctness parity with raw `claude -p` on the Sonnet default and on every shape listed `haiku` (a shape with no evidence stays on Sonnet); arm 4 correctness parity, or the Sonnet no-advisor fallback in place (R1-07, R1-09); every shape listed as `prior-default` runs the exact LOKI_ROUTER=0 models (R1-21 golden per listed shape); the seeded file committed with its METRICS.md refs | all |
 | R1-21 | Opt-out golden: `LOKI_ROUTER=0` equals pre-router behavior exactly | loki-ts/tests/engine10/router_optout_golden.test.ts, loki-ts/tests/engine10/fixtures/pre_router_models.json | HIGH | sonnet | fixture captured on 11.0.3 code BEFORE any router slice merges: for an env matrix (default; LOKI_E10_CASCADE=1; LOKI_E10_WALL_TIER=haiku; LOKI_ALLOW_HAIKU=true; LOKI_MODEL_OVERRIDE=sonnet; LOKI_CLAUDE_MODEL_DEVELOPMENT=opus; LOKI_E10_PLAN=always) it records, per stage (plan, wall, already_done, implement, fix round 1 and escalated round 2), the model passed to sessions.run, the child-env LOKI_CLAUDE_MODEL_* values, the SDK query options model/fallbackModel/settings, the downgrade list, the start line and the run.started keys. The test replays the matrix through fake sessions with `LOKI_ROUTER=0` (and unset, until R1-19) and requires deep equality. Mutation: changing wallModel's default or adding `settings.advisorModel` under `0` turns it red | runs in the fast tier; must be green on every slice's train | none (lands first in W1) |
 | R1-20 | `loki doctor` shows advisor availability and bundled CC version | loki-ts/src/commands/doctor.ts, loki-ts/tests/commands/doctor_router.test.ts | LOW | haiku | doctor prints `advisor: available` or the reason from R1-06 | doctor suites | R1-06 |