loki-mode 11.3.0 → 11.3.1

package/docs/V8-ACCEPTANCE-TRIAGE-2026-07-24.md

@@ -1,114 +0,0 @@
-# v8 acceptance-test triage (partial, in progress)
-
-Date: 2026-07-24. Read-only audit against the v8 competitive plan (P2).
-Method: source-verified only. A filename containing a relevant word does NOT
-count as EXISTS; the assertion or enforcing code must be read.
-
-## Why this triage exists
-
-Source 08 proposes 26 release-blocking acceptance tests. The plan's P2 says
-triage them EXISTS / PARTIAL / NET-NEW before treating any as work, because
-three earlier "gaps" from the same research corpus turned out already shipped
-(evidence-in-PR, the offline verifier, stuck-detection signals). Writing this as
-"add 26 tests" would repeat that error at 26x scale.
-
-Repo has 456 files under `tests/`.
-
-## Verified so far
-
-| # | Test | Verdict | Evidence |
-|---|---|---|---|
-| 15 | empty diff != complete | **EXISTS** | `tests/test-evidence-gate.sh` enumerates 13 gate cases including case 2 "empty diff (baseline==HEAD, clean) -> BLOCK (rc 1), reason empty_diff" (`:21`), case 10 "empty diff + red tests -> BLOCK, reason empty_diff_and_tests_red" (`:29`), case 13 "truly-empty run (no untracked) -> BLOCK, reason empty_diff" (`:32`). Enforced in `autonomy/lib/proof-generator.py:1238` ("A non-empty diff is a PREREQUISITE for VERIFIED") and `autonomy/verify.sh:2067` ("empty diff yields CONCERNS (nothing to verify), never VERIFIED"). Note `test-evidence-gate.sh:126` explicitly guards against a false-pass where `.loki/` being untracked would mask the empty-diff BLOCK. |
-| 19 | unhealthy app != complete | **EXISTS** | `tests/test-evidence-boot-axis.sh` drives the REAL `council_evidence_gate` (sourced from `autonomy/completion-council.sh`, not a mock) with synthetic app-runner fixtures, isolating the boot axis by making the diff and test axes pass. Contract (`:2-7`): a SERVEABLE app confirmed unhealthy -> BLOCK; a non-web project (no serveable runner) or an un-probed one -> inconclusive pass-through, so a CLI/library build cannot deadlock. Health source is `.loki/app-runner/health.json` written by `app_runner_health_check`. |
-
-| 20 | stale/forged evidence != new run | **EXISTS (partial, honestly scoped)** | `tests/test-proof-forgery-defense.sh` locks THREE facts about `proof-verify.py` (v7.111.0) and is deliberately explicit that the non-forgeability gap is MITIGATED AND RELABELED, NOT closed: (a) genuine proof -> `ok:true, headline_consistent:true`; (b) INCONSISTENT forgery (headline flipped to VERIFIED, facts left `not_run`, hash recomputed) -> `ok:false, headline_consistent:false`; (c) CONSISTENT forgery on the UNSIGNED path -> STILL `ok:true`, reporting `generator_trusted:true`. |
-
-| 16 | failing tests != complete | **EXISTS** | `tests/test-evidence-gate-rc.sh` guards `_evidence_gate_and_surface()` (`autonomy/run.sh:10168`) rc propagation: a failing evidence gate must propagate its exact non-zero rc out of the wrapper, preserving the caller's `! council_evidence_gate` elif-chain semantics byte-for-byte. Written because the wrapper's own rc propagation had never been driven against the real function body (another test stubs it out), so a regression returning 0 unconditionally would have swallowed the gate. |
-| 17 | fake test output cannot satisfy gate | **EXISTS** | `tests/test-enforce-mutation-integrity.sh` drives `enforce_mutation_integrity()` (`autonomy/run.sh:10505`) against a REAL project fixture with an actual HIGH-severity finding. Wraps `tests/detect-test-mutations.sh` (Quality Gate 9) with `--block-high`; blocks the iteration (rc 1) iff output has at least one `[HIGH]` line, else rc 0 with MEDIUM/LOW routed to an advisory findings file. Explicitly guards the threat model: "a test-fitted commit (assertions mutated to match buggy output) sail[ing] through completion ungated". |
-| 18 | mock-only cannot satisfy prod completion | **EXISTS** | `tests/test-nomock-data-render.sh` drives both `autonomy/verify.sh` and `autonomy/completion-council.sh` against real fixtures, distinguishing legitimate static content catalogs from mock OPERATIONAL data (so a docs/content site is not false-failed while a mock-backed app is not false-passed). |
-| 24 | trust-core regressions pass | **EXISTS** | `tests/test-completion-council-affirmative-evidence.sh` locks the v7.41.5 trust-gate inversion: `council_evaluate_member` now requires AFFIRMATIVE positive evidence before voting COMPLETE. |
-
-### Note: item 24 documents a real historical false-green
-
-Before v7.41.5, `council_evaluate_member` DEFAULTED to vote=COMPLETE and only
-flipped to CONTINUE on a DETECTED failure. On a greenfield run with an empty
-`.loki/` (no test results, no queue, few TODO files), `requirements_verifier`
-and `devils_advocate` both defaulted COMPLETE while only `test_auditor` went
-CONTINUE, so 2-of-3 cleared the size-3 threshold and the council approved a
-project with ZERO positive evidence. The fix inverts the default to CONTINUE
-and votes COMPLETE only on a real positive signal (shared base:
-`.loki/quality/test-results.json` present AND not red).
-
-This matters for positioning: it is a documented, fixed instance of exactly the
-failure class the moat claims to prevent, found and closed by the project
-itself. It is also a caution - the moat is an ongoing engineering commitment,
-not a property the architecture grants for free.
-
-### Note: item 20's test is itself moat evidence
-
-Case (c) is a test written to STOP THE PROJECT OVERCLAIMING ITS OWN SECURITY. It
-asserts that a forger who rewrites both the facts and the headline into a
-mutually consistent lie and recomputes the hash STILL PASSES on the unsigned
-path. Neutral non-forgeability requires the signed record. This is the same
-honesty-engineering signal as the v7.111.0 removal of Loki's own false
-"non-forgeable" claim, and it is rare: most projects test that their defense
-works, not that it does not work as well as marketing might imply.
-
-Direct consequence for the plan: it names exactly what receipt SIGNING buys
-(neutral non-forgeability against a consistent forger), which is the remaining
-half of the "sign the receipt" item. The verifier and GPG path already exist in
-`autonomy/lib/proof-verify.py` (`_verify_gpg`); what is missing is key
-distribution and a signed-by-default path, not the mechanism.
-
-## Additional corroborating tests (not yet read, listed to avoid re-derivation)
-
-The verdicts above rest on the assertions cited. These further files also bear
-on the same items and would deepen (not change) the verdicts:
-`test-evidence-gate-no-tests.sh`, `test-completion-route-evidence-gate.sh`
-(#16); `detect-test-mutations.sh` (#17); `detect-mock-problems.sh` (#18);
-`tests/test_proof_verify.py`, `test-completion-signal-consume.sh` (#20);
-`test-iteration-complete-accuracy.sh` (#24).
-
-## Known NET-NEW (verified elsewhere this session)
-
-- **#3 no SDK-full silent fallback to legacy** and the stuck/stagnation coverage:
-  **RESOLVED 2026-07-25, this section is kept for history.** When written, the
-  stagnation and done-signal force-stop valves were NOT active on the TS/SDK
-  route (`trackIteration` wrote placeholder zeros) while bash had both
-  (`autonomy/completion-council.sh:4519`, `:4528`), making the port a hard
-  prerequisite of the SDK-default flip.
-
-  Both valves were ported in commit `5c3d2769` and now run on the TS route,
-  persisting counters to `.loki/council/state.json` so they survive a runner
-  restart (`loki-ts/src/runner/council.ts`). Fail-closed behavior for #3 was
-  separately source-verified in `docs/V8-RUNTIME-TRUTH-2026-07-25.md`: there is
-  no CLI fallback branch, and `sawResult ? exitCode : 1` means a stream that
-  never produced a terminal result is a FAILED iteration.
-
-  Note also that this document's related claim about SDK **session continuity**
-  blocking the flip was later found FALSE and corrected in `c31f6f20` -- legacy
-  session stamping is default-OFF and emits a per-iteration DISTINCT uuid, so it
-  never provided cross-iteration continuity either. No capability regression
-  blocks the flip; the remaining gate is the untested acceptance items.
-
-## Honest status
-
-INCOMPLETE but no longer thin. 7 of 26 assertion-verified: items 15, 16, 17, 18,
-19, 20, 24 all EXISTS; the stuck/stagnation axis is NET-NEW on the TS route.
-
-**The pattern is now strong enough to state as a finding:** every trust-core
-acceptance test the research proposed as new work already exists, and several
-are more rigorous than the proposal (they drive real function bodies rather than
-mocks, and two of them exist specifically to prevent the project overclaiming).
-The research's "26 release-blocking tests to add" framing was wrong for this
-bucket. Remaining NET-NEW risk is concentrated in the SDK/TS runtime items, not
-in the trust core.
-
-Not yet triaged: 1-14, 21, 22, 23, 25, 26. Items 1-14 concern SDK runtime truth,
-crash/resume, cancel, sandbox cleanup, secrets and network isolation; several
-are likely PARTIAL and are downstream of the Phase-0 runtime-truth audit anyway.
-
-Published partial rather than padded: a plausible-looking full table with
-unverified rows is worse than an admitted gap, which is the exact failure mode
-this plan exists to avoid. Two delegated audit agents returned no findings; all
-verdicts here were verified by reading source directly.

package/docs/V8-COMPLEXITY-AUDIT-2026-07-24.md

@@ -1,45 +0,0 @@
-# v8 complexity audit: delete-list candidates
-
-Date: 2026-07-24. Read-only. **Zero deletions performed** (founder decision).
-
-## Why this audit exists
-
-The competitive research corpus (source 12) proposed deleting `voice.sh`,
-cockpit image rendering, `web-app/`, Managed Agents, and the "41 static roles"
-to reduce single-maintainer load. VALIDATION.md marks that source's "unused"
-label as an **assumption it never verified**, and the same source was already
-caught undercounting `autonomy/loki` by 10k lines. So each candidate needed
-positive proof, not a confident assertion.
-
-**Method:** positive proof of non-reference. An absent grep hit is not evidence
-(memory: grep-absence-false-green). A component counts as live if anything
-references it, dispatches it, or ships it.
-
-## Findings
-
-| Candidate | Verdict | Evidence |
-|---|---|---|
-| `autonomy/voice.sh` (501 lines) | **ORPHANED (only true positive)** | Referenced by NOTHING except itself: a repo-wide search across `autonomy/`, `loki-ts/`, `scripts/`, `tests/`, `mcp/`, `dashboard/` returns only the file. Meanwhile `cmd_voice()` (`autonomy/loki:22751`) is dispatched (`:17884`) but is a 4-line stub that prints "Voice mode is planned for a future release" and points at issue #85. So the COMMAND is live and honest; the 501-line SCRIPT behind it is dead weight shipped in the npm tarball (`package.json` includes `autonomy/`). |
-| cockpit rendering | **LIVE** | Real module with 5 source files (`loki-ts/src/cockpit/{raster,cli,capability,svg,render}.ts`). Not an orphan. Source 12 cited `loki-ts/src/commands/cockpit.ts`, which does NOT exist: its path was wrong, its conclusion untested. |
-| `web-app/` | **LIVE AND SHIPPED** | 12 explicit entries in `package.json` `files` (`web-app/dist/`, `server.py`, `auth.py`, `models.py`, ...). Deleting it would break the published package. |
-| Managed Agents | **NOT SUBSTANTIATED** | The claimed "NOT TESTED against live Anthropic API" marker in SKILL.md was not found. The premise of the delete recommendation could not be reproduced. |
-| "41 static roles" | **MISCHARACTERIZED** | `references/agent-types.md:9` already documents these precisely: "prompt-defined specifications the orchestrator adopts per phase, **not separate processes**", with "typically 5-10 for simple projects" activated. They are a catalog, not 41 running agents. There is no static-role runtime cost to delete. |
-
-## Conclusion
-
-**One of five candidates survived.** Four were live, mis-pathed, unsubstantiated,
-or mischaracterized. This is consistent with the pattern across this whole
-planning pass: the research corpus's confident specifics do not survive contact
-with the repo, and the plan's "audit before deleting anything" rule was load
-bearing rather than cautious.
-
-`autonomy/voice.sh` is a genuine 501-line orphan. Even so, **no deletion is
-performed here** per the founder decision. Recommended follow-up, separately and
-evidence-gated: either delete `voice.sh` and keep the honest `cmd_voice` stub, or
-keep the script if issue #85 will build on it. That is a small, isolated call
-with no dependents by definition.
-
-## What this does NOT claim
-
-This audit covers only the five named candidates. It is not a repo-wide dead-code
-sweep, and it makes no claim about the rest of the tree.

package/docs/V8-MAJOR-RELEASE-PLAN.md

@@ -1,137 +0,0 @@
-# v8 Major Release - Costed Decision Plan
-
-Status: PROPOSAL (founder review before any implementation spend). 2026-07-24.
-Author: this session, grounded in the actual repo state (not aspirational).
-
-## TL;DR (the honest headline)
-
-**v8 is ~80% built and tested, but uncommitted.** The hard engineering - a 12,300-line
-parity-locked TypeScript runner, the Anthropic SDK route (`sdk_invoker.ts`, `sdk_mode.ts`,
-stream parser), and ~18,000 lines of *working, test-passing* feature work (supervised builds,
-deadline confinement, honesty/no-mock hardening, code-review calibration) - already exists in
-the working tree. The V8-AGENT-SDK-PLAN and RARV-C-100X-PLAN both say so explicitly:
-"much of this is already shipped."
-
-So "the v8 major release" is NOT a build-from-scratch effort. It is, in order of cost:
-1. **CONSOLIDATE + VERIFY + SHIP** what already works (cheap, high-value, the bulk of the win).
-2. **A bounded net-new layer** the founder asked for: jcode-informed harness-intelligence,
-   PostHog analytics, the otel 2.x upgrade.
-
-This plan costs each phase so the founder funds them selectively, not as one open-ended blob.
-
----
-
-## Where v8 actually stands (verified this session)
-
-| Component | State | Evidence |
-|---|---|---|
-| TS runner (autonomous loop, council, gates, prompt) | Built, parity-locked | `loki-ts/src/runner/` 12.3k lines, 22 modules |
-| Anthropic SDK route (judges = raw SDK, loop = Agent SDK) | Built + tested | `sdk_invoker.ts`, `sdk_mode.ts`, `sdk_stream_parser.ts`; tests: sdk_invoker, sdk_stream_parser, sdk_query_provider, sdk_loop_e2e |
-| One-switch `LOKI_SDK_MODE` (off/judges/full) + rollback | Built | CHANGELOG v8.1; byte-mirrored bash+TS, shared parity fixture |
-| Supervised builds / deadline confinement | Built + tests PASS | `deadline.py`, `build_supervisor.py`, `dependency-setup.sh` + `test-hard-deadline-confinement`, `test-supervised-*` (verified passing) |
-| Honesty / no-mock hardening | Built + tests PASS | `no_mock_scan.py`, `test-harness-false-green`, `test-honest-gate-status`, `test-nomock-data-render` (verified passing) |
-| Code-review calibration | Built | `test-review-severity-calibration`, `-assurance-tail`, `-lockfile-context` + council/quality_gates mods |
-| ~18k LOC uncommitted total | Working, not committed | `git diff`: 46 files +7173/-1296; 25 new files +11057 LOC |
-| Published to npm as 8.x | NO | npm latest = 7.129.4; v8 never published, never merged to main |
-| PostHog analytics | **BUILT** (`5dcc88c6`) | opt-in `build_verified` event behind a strict second gate (`LOKI_ANALYTICS=on`, default OFF even when telemetry is on), fixed allowlist reader emits proof scalars only |
-| otel 2.x (the deferred CVE fix) | **DONE** (`159dc7f4`) | clears GHSA-45rx-2jwx-cxfr at source |
-| Phase 3 harness intelligence | **BUILT** (`9e596e9a`, `889bd52a`, `500e74f6`) | 3a prompt-cache discipline already existed (verified, not rebuilt); 3b confidence-spike, 3c goal scoring, 3d smart retry landed 2026-07-25 |
-| Release identity (VERSION vs CHANGELOG) | **RESOLVED** (`a749ee54`) | folded the drafted `v8.1.0` block into one `v8.0.0` entry; no 8.x was ever published, so a first-ever 8.x as 8.1.0 would have described a release history that does not exist |
-
-**Releasability gate:** full `local-ci.sh` on the WIP tree - RESULT PENDING (running at write time;
-this plan's Phase 1 cost depends on how clean it is).
-
----
-
-## The CHANGELOG-vs-WIP question (must resolve first)
-
-The `## v8.1.0 (unreleased)` CHANGELOG entry documents ONLY the SDK one-switch/rollback/packaging
-gate. But the ~18k uncommitted lines are mostly OTHER efforts (supervised builds, deadline,
-honesty, review calibration). **The documented release scope and the actual WIP do not match.**
-
-Resolution needed from founder: is the v8 MAJOR release =
-- (A) the SDK route ONLY (commit just the SDK-related files, ship a focused v8.0.0), OR
-- (B) EVERYTHING in the tree (SDK + supervised + honesty + review work) as one big v8.0.0?
-
-Recommendation: **(B)**, because the extra work is on-thesis (all deepens the trust moat), already
-tested, and shipping it piecemeal means more release cycles. But it requires per-theme commit
-curation (never one `git add -A`), so it costs more review time than (A). This is the single
-biggest scope decision and it changes Phase 1's cost.
-
----
-
-## Phased plan (each phase independently fundable)
-
-### Phase 1 - CONSOLIDATE + SHIP what's built  [CHEAPEST, HIGHEST VALUE]
-The bulk of v8's value is already written. This phase makes it real.
-- Resolve the scope question (A vs B above).
-- Curate the WIP into coherent, themed commits (per-theme, individually staged - the same
-  isolation discipline used for the v7.129.4 doc-gen commit; NEVER `git add -A`).
-- Get full local-ci green on the committed tree (prime deps + rebuild dist - the lesson from
-  v7.129.4: most "failures" are environmental).
-- Reconcile the release identity: VERSION 8.0.0 vs CHANGELOG's 8.1.0; first-ever 8.x publish; a
-  genuine MAJOR. Decide the number, write the CHANGELOG major entry.
-- **Do NOT publish yet** - land it green + reviewed on the branch, PR-ready. Publishing 8.0.0 is a
-  separate, explicit, irreversible founder go (like the v7.129.4 push).
-- Cost: MODERATE (review/curation of 18k LOC + CI greening). Mostly verification, little new code.
-- Deliverable: v8 branch green, committed, coherent, PR-ready. The trust moat + SDK route SHIPPED.
-
-### Phase 2 - PostHog analytics  [NET-NEW, founder-requested]
-"log/monitor/get analytics as much as possible in PostHog."
-- Wire a PostHog sink alongside the existing OTLP/crash telemetry (opt-in, privacy-preserving -
-  loki's zero-egress posture is a documented moat; PostHog must be explicit-opt-in, never covert).
-- The SDK route already surfaces rich typed telemetry (total_cost_usd, usage, cache read/creation,
-  modelUsage, num_turns, duration_ms) - these become PostHog events cheaply.
-- Instrument: build lifecycle, gate outcomes, RARV iterations, provider/model, cost/tokens, council
-  verdicts, receipt facts, per-stage latency, failure modes.
-- Cost: MODERATE (one new sink + event mapping; reuses existing telemetry seams).
-- Deliverable: opt-in PostHog analytics across the v8 build lifecycle.
-
-### Phase 3 - jcode-informed harness intelligence  [NET-NEW, "better than jcode"]
-Adopt jcode's measured-harness discipline onto loki's trust moat (see the jcode analysis in
-[[project-v8-major-release-mandate]]). Ranked by impact/effort:
-- 3a. **Prompt-cache discipline** (HIGH impact on latency+cost, MED effort): append-only context,
-  stable prefix, MCP tools advertised up-front. The SDK route makes cache metrics visible already.
-- 3b. **Confidence-stepping / spike re-check** (HIGH, MED): force re-verify when agent confidence
-  jumps to 100 (jcode's finding: confident-after is not signal). Layers onto the completion council.
-- 3c. **Hill-climbable goal scoring** (MED, MED): score each goal's quantifiability, push back on
-  un-measurable goals. Complements the evidence gate.
-- 3d. **Auto-poke persistence** (MED, LOW): poke the loop back on incomplete todos; smart retry
-  (transient retry, non-retryable stop-to-save-tokens). Partially exists (never-stop directive).
-- Cost: LARGE (each is a real feature). Fund individually; 3a is the best first (direct latency/cost win).
-- Deliverable: measurably faster/cheaper/more-persistent loop, trust moat intact.
-
-### Phase 4 - otel 2.x + dependency modernization  [DEFERRED FROM v7.129.4]
-- The breaking @opentelemetry 2.x major bump that clears GHSA-45rx-2jwx-cxfr for real (the v7.129.4
-  patch waived it as not-reachable; here it gets genuinely fixed since major bumps belong in a major).
-- Re-verify tracing still works after the bump.
-- Founder standing directive: "always latest code, api, libraries" - audit + modernize other deps here.
-- Cost: SMALL-MODERATE (mechanical but needs tracing re-verification).
-
-### Phase 5 - MAJOR RELEASE  [IRREVERSIBLE, explicit founder go]
-- Full CLAUDE.md release workflow: 14-file version bump, CHANGELOG major entry, dashboard rebuild,
-  pre-publish validation, merge to main -> publish npm/Docker/Homebrew.
-- Post-release validation across all channels + both routes (as done for v7.129.4).
-- Cost: SMALL (mechanical, proven process from v7.129.4). The GO is the founder's.
-
----
-
-## Recommended sequence + why
-
-1. **Phase 1 first, always.** It converts existing work into a shipped, reviewed, green branch -
-   the highest value for the least new spend, and it de-risks everything else.
-2. Then the founder picks Phase 2 (PostHog) and/or Phase 3 items (harness intelligence) to fund -
-   these are the "better in every direction" asks and each is independently costed.
-3. Phase 4 (otel/deps) bundles into whichever phase touches CI next.
-4. Phase 5 (publish) only when the founder says the accumulated phases are worth a major release.
-
-## Cost discipline (per the standing directives)
-- Ultrathink each phase's plan + advisor review before its implementation.
-- Ultracode (surgical workflow) for the implementation where parallelism pays - NOT for planning.
-- Every phase ends in a SHIPPED/committed/verified artifact, never another doc.
-- No `git add -A`; per-theme individual staging; repo-local asklokesh identity; explicit go before
-  any irreversible publish.
-
-## The one thing to decide now
-The founder's call that unblocks everything: **the CHANGELOG-vs-WIP scope question (A vs B) + confirm
-Phase 1 as the start.** Everything downstream flows from that.

package/docs/V8-OVERNIGHT-PLAN-2026-07-25.md

@@ -1,82 +0,0 @@
-# v8 overnight execution plan (2026-07-25)
-
-Autonomous session. Founder asleep ~8h. Standing authorization: make the
-architectural calls, validate everything, commit and push verified increments.
-
-## Governing principles
-
-1. **Already-exists check FIRST on every item.** It has been right 5 times out
-   of 5 this session (evidence-in-PR, offline verifier, stuck signals, signing,
-   fail-closed SDK). The research corpus is consistently more confident than
-   correct.
-2. **"Don't overwhelm users" is an architectural constraint, not a preference.**
-   Every new env var is user-facing complexity. Prefer: safe default, honest
-   degradation, structured event for operators, NO new knob. If the safe
-   behavior can be the default, make it the default.
-3. **Never mark done what is not verified.** A test that passes against the
-   pre-change code proves nothing; every behavioral change gets the
-   revert-and-confirm-it-fails treatment.
-4. **Gate on the CI verdict line, never the exit code.**
-5. **`bun run build` after every `loki-ts/src` edit** - the shipped package runs
-   `dist`, not `src`.
-
-## Order (by reversibility, not task number)
-
-| # | Item | Shape | Status |
-|---|---|---|---|
-| 11 | SDK capability-degradation event | small increment | premise mostly satisfied |
-| 10 | Phase-0 runtime-truth audit | docs from source | gates 12 |
-| 12 | Flip SDK default | TESTS first, flip only if green | conditional |
-| 18 | Typed run journal | MEASURE first | may collapse |
-| 20 | First-4-min preview | MEASURE first | may collapse |
-| 17 | Workspace isolation | interface + Local adapter | Docker = design only |
-| 23 | Helm/RBAC/SSO | real, testable offline | helm lint / kubeval |
-| 15 | npm SDK | build fully, DO NOT PUBLISH | founder gate |
-| 22 | Managed cloud | design doc only | blocked on P0 results |
-| 24 | SWE-bench RESOLUTION | DO NOT RUN | ~$950 spend, deferred |
-
-## Hard stops (will NOT do autonomously)
-
-- **#15 npm publish.** Building the package is in scope; `npm publish` is
-  outward-facing and irreversible. "Commit and push" authorized the feature
-  branch, not the public registry. The publish command is left for the founder.
-- **#24 SWE-bench RESOLUTION run.** 119 pinned instances at
-  `LOKI_BUDGET_LIMIT=8` is up to ~$950 of real spend, on a benchmark the
-  approved plan already marks DEFERRED by founder decision.
-- **Merge to main / publish 8.0.0.** Standing hard founder gate.
-
-## #12 authorization, stated precisely
-
-The approved plan says: do not flip until parity AND recovery tests pass. That
-is a CONDITIONAL authorization, so #12's real content is writing those tests
-(acceptance #1 SDK-full with the claude binary absent, #7 SIGKILL recovery, #8
-resume does not repeat irreversible actions, plus both-route parity). If they
-pass, flipping executes the founder's decision. If any fail, do not flip and
-name the blocker.
-
-## Findings that reshaped the queue
-
-**#11 is nearly done already.** `autonomous.ts:356 requireModule()` is fail-fast
-(a load-bearing module that cannot load is a fatal contract violation, not a
-silent stub). `providers.ts:559-640` is fail-closed: no CLI fallback,
-`exitCode=1` on throw, and `sawResult ? res.exitCode : 1` so a stream that never
-produced a terminal result cannot be counted as success. The SDK path's MAIN
-LOOP has no `claude`-binary dependency.
-
-**Scope stated exactly, 2026-07-26.** `providers.ts:570` delegates every
-non-mainLoop call back to `claudeProvider()`, which reaches the binary via
-`ensureClaudeHelpCache()`. But that is the `LOKI_SDK_MODE=off` path, and
-reading it alone to mean "the judge path shells out to claude" is wrong:
-under `judges`/`full`, `sdkModeDefaults()` enables all seven `JUDGE_VARS` and
-those sites have their own raw-SDK bridges. `completion-council.sh:2910` says
-so directly -- the raw-SDK vote path "needs no claude binary" (its precondition
-is bun plus the bridge), falling closed to `claude` only on an SDK miss.
-
-So under `LOKI_SDK_MODE=full` BOTH the loop and the judges have binary-free
-paths; the residual CLI dependency is off-mode delegation plus the fail-closed
-fallback. Pinned by
-`loki-ts/tests/runner/acceptance_sdk_binary_absent.test.ts`.
-
-The genuine remaining gap is OBSERVABILITY: an SDK load/stream failure is
-written into captured text, not emitted as a structured capability-degradation
-event an operator can alert on. That is the increment.

package/docs/V8-SDK-RESEARCH-RAW.md

@@ -1,129 +0,0 @@
-# Claude Agent SDK Research (TypeScript) - for the v8 Loki migration
-
-Sources: live docs `code.claude.com/docs/en/agent-sdk` + `/agent-sdk/typescript` (WebFetch, today); installed `claude` v2.1.207 `--help`; and the **actual unpacked `@anthropic-ai/claude-agent-sdk@0.3.207` tarball** (published 3 days ago) - `sdk.d.ts` (6923 lines), `package.json`, `sdk.mjs`. Every API shape below was verified against the real `.d.ts`, not just docs (WebFetch invented a few types - those are flagged UNVERIFIED). Package repo: `github.com/anthropics/claude-agent-sdk-typescript`.
-
-## THE ONE FINDING THAT REFRAMES THE FOUNDER'S PREMISE (verified, load-bearing)
-
-**The Claude Agent SDK does NOT remove the `claude` binary dependency. It IS the `claude` binary, wrapped as a subprocess.**
-
-Primary-source evidence from the 0.3.207 tarball:
-- `package.json`: `"dependencies": {}` but `"optionalDependencies"` ships **8 platform-specific native Claude Code binaries** (`@anthropic-ai/claude-agent-sdk-{linux,darwin,win32}-{x64,arm64}[-musl]@0.3.207`).
-- `sdk.mjs` imports `node:child_process` and calls `spawn()` (2 call sites, 291 refs to `claude`, 13 to `claude-code`).
-- `Options` exposes `executable?: 'bun'|'deno'|'node'`, `pathToClaudeCodeExecutable?: string`, `executableArgs`, and `spawnClaudeCodeProcess?: (o) => SpawnedProcess` - all subprocess-management knobs. There's even an `extractFromBunfs()` export whose only job is to locate the embedded `claude` binary when you `bun build --compile`.
-- Docs confirm: *"The TypeScript SDK bundles a native Claude Code binary for your platform as an optional dependency."* README: *"The Claude Code SDK is now the Claude Agent SDK."* - it's a rename of the Claude Code SDK.
-
-**Implication for the founder requirements.** Adopting `@anthropic-ai/claude-agent-sdk` gives Loki a first-class TS library, structured messages, in-process tools, and the full Claude Code harness - but it does **not** deliver the stated KEY strategic win (removing the CLI binary / "just an API key" containers). The binary is bundled instead of PATH-installed (so: no interactive login, no separate `claude` install step, no user-managed version drift - the SDK pins its own binary), but a native Claude Code executable still runs as a child process in every container. It's still "Claude Code," just vendored and spawned by your code instead of shelled out to on PATH.
-
-If "NO claude binary at all, pure API calls" is a hard requirement, the surface that actually delivers it is **`@anthropic-ai/sdk` (the Client SDK, v0.111.0)** - pure HTTPS to `api.anthropic.com`, zero binary - but then Loki owns the agent loop, tools, context management, and permissions itself (which RARV-C/run.sh largely already does). Or **Managed Agents** (Anthropic hosts the loop + sandbox; REST only). This is the real architectural fork; recommend surfacing it to the founder before committing.
-
----
-
-## 1. Core primitives (verified against `sdk.d.ts`)
-
-**Entry point - `query()` (sdk.d.ts:2527):**
-```ts
-export declare function query(_params: {
- prompt: string | AsyncIterable<SDKUserMessage>;
- options?: Options;
-}): Query;
-```
-- `prompt: string` = one-shot. `prompt: AsyncIterable<SDKUserMessage>` = streaming-input mode (enables mid-session control methods).
-- Returns a `Query` (below); you `for await (const message of query(...))` to drive the agentic loop. The SDK runs the whole Reason→Act tool-use loop internally - you don't write the `while stop_reason === 'tool_use'` loop (that's the explicit contrast the docs draw vs the Client SDK).
-
-**`Query` interface (sdk.d.ts:2230) - `extends AsyncGenerator<SDKMessage, void>`** with control methods (all verified present):
-`interrupt()`, `setPermissionMode(mode)`, `setModel(model?)`, `setMaxThinkingTokens(n, display?)`, `applyFlagSettings(settings)`, `supportedModels()`, `supportedAgents()`, `supportedCommands()`, `mcpServerStatus()`, `setMcpServers()`, `reconnectMcpServer()`, `toggleMcpServer()`, `rewindFiles(userMessageId, {dryRun?})`, `streamInput(stream)`, `initializationResult()`, `reinitialize()`, `close()`. Mid-session setters (`setModel`, `setPermissionMode`, `applyFlagSettings`) work **only in streaming-input mode**.
-
-**Custom tools - `tool()` (sdk.d.ts:6745) + `createSdkMcpServer()` (sdk.d.ts:467):**
-```ts
-export declare function tool<Schema extends AnyZodRawShape>(
- _name, _description, _inputSchema: Schema,
- _handler: (args: InferShape<Schema>, extra) => Promise<CallToolResult>,
- _extras?: { annotations?: ToolAnnotations }
-): SdkMcpToolDefinition<Schema>;
-
-export declare function createSdkMcpServer(_options: CreateSdkMcpServerOptions): McpSdkServerConfigWithInstance;
-```
-Tools are **in-process** (Zod-schema'd TS functions), bundled into an SDK MCP server, passed via `options.mcpServers`. This is how Loki would expose its own tools (queue, memory, council) to the agent without a separate MCP process - a genuine enhancement over shelling out.
-
-**Built-in tools (no implementation needed):** Read, Write, Edit, Bash, Monitor, Glob, Grep, WebSearch, WebFetch, AskUserQuestion, Agent (subagent invocation), + MCP. Gated by `allowedTools`/`disallowedTools`/`tools`.
-
-**Subagents / multi-agent - `options.agents: Record<string, AgentDefinition>` (sdk.d.ts:1327):**
-```ts
-type AgentDefinition = {
- description: string; prompt: string;
- tools?: string[]; disallowedTools?: string[];
- model?: string; // alias, full id, or "inherit"
- mcpServers?: AgentMcpServerSpec[]; skills?: string[];
- maxTurns?: number; background?: boolean;
- memory?: 'user'|'project'|'local';
- effort?: 'low'|'medium'|'high'|'xhigh'|'max'|number;
- permissionMode?: PermissionMode;
- initialPrompt?: string; /* + experimental fields */
-};
-```
-Subagents invoked via the `Agent` tool (include `"Agent"` in `allowedTools` to auto-approve). Messages from a subagent carry `parent_tool_use_id` so you can attribute them. This maps cleanly onto Loki's dev-fleet/council pattern - but note it's **one level deep** and runs subagents within the same host process, unlike Loki's current parallel-Task fan-out.
-
-**Memory/context:** three layers. (a) `CLAUDE.md`/`.claude/` loaded via `settingSources` (`'user'|'project'|'local'`). (b) Automatic context compaction is built into the Claude Code harness the SDK spawns. (c) `AgentDefinition.memory` + Skills (`.claude/skills/*/SKILL.md`, `options.skills`). There is no separate vector-memory primitive - Loki's `memory/` Python package has no SDK equivalent; you'd wire it in as SDK MCP tools or hooks.
-
-**Hooks:** `options.hooks` - `PreToolUse`, `PostToolUse`, `Stop`, `SessionStart`, `SessionEnd`, `UserPromptSubmit`, etc., as in-process callbacks (validate/block/transform/log). Good fit for Loki's quality gates and telemetry.
-
-## 2. Session continuity (verified)
-- `options.resume?: string` (session id), `options.continue?: boolean` (most recent), `options.forkSession?: boolean`, `options.resumeSessionAt?: string` (resume at a specific message UUID), `options.sessionId?: string` (pin a UUID), `options.persistSession?: boolean`.
-- Session id comes from the `system`/`init` message (`message.session_id`) on the first query; pass it as `resume` on the next.
-- Storage: **JSONL on your filesystem** (docs confirm; helpers `listSessions()`, `getSessionMessages()`, `getSessionInfo()`, `renameSession()`, `tagSession()`). `options.sessionStore` can mirror transcripts to an external backend.
-- Maps to the CLI's `--resume`/`--session-id`/`--continue`/`--fork-session`/`--resume-session-at` (all present in `claude --help`). This is a strict superset of Loki's current CLI-flag resume usage.
-
-## 3. Structured output (verified - direct CLI `--json-schema` equivalent)
-```ts
-outputFormat?: OutputFormat; // sdk.d.ts:1686
-type OutputFormat = JsonSchemaOutputFormat; // :2016
-type JsonSchemaOutputFormat = { type: 'json_schema'; schema: Record<string, unknown> }; // :898
-```
-Result lands on **`SDKResultSuccess.structured_output?: unknown`** (sdk.d.ts). There's a dedicated error subtype `error_max_structured_output_retries`, so the harness retries to satisfy the schema. This is the exact analog of the CLI's `--json-schema` flag. **Yes, fully supported.**
-
-## 4. Budget / effort / model / fallback (verified - direct CLI-flag parity)
-| Need | Agent SDK option | CLI flag |
-|---|---|---|
-| Budget cap | `maxBudgetUsd?: number` → error subtype `error_max_budget_usd` | `--max-budget-usd` |
-| Effort | `effort?: 'low'\|'medium'\|'high'\|'xhigh'\|'max' \| number` (also runtime `applyFlagSettings({effortLevel})`) | `--effort` |
-| Model | `model?: string` (alias/full id; runtime `setModel()`) | `--model` |
-| Fallback | `fallbackModel?: string` | `--fallback-model` |
-| Turn cap | `maxTurns?: number` → `error_max_turns` | (SDK/`--max-turns`) |
-| Task budget | `taskBudget?: { total: number }` → sent as API `output_config.task_budget` + beta header `task-budgets-2026-03-13` | - |
-| Thinking | `thinking?: ThinkingConfig` (`maxThinkingTokens` deprecated) | - |
-| Betas | `betas?: SdkBeta[]` - only `'context-1m-2025-08-07'` is valid | `--betas` |
-
-Result message carries `total_cost_usd`, `usage` (NonNullableUsage), `modelUsage: Record<string, ModelUsage>`, `num_turns`, `duration_ms/api_ms`, `permission_denials` - richer cost/telemetry than parsing CLI stdout. **Every CLI control Loki uses has a typed SDK option.**
-
-## 5. The "outcome" / Managed-Agents primitive vs RARV-C (honest assessment)
-There is **no `outcome` primitive in the Agent SDK.** The closest thing is the SDK's built-in agent loop bounded by `maxTurns` / `maxBudgetUsd` / `taskBudget` / structured-output retries - an *effort/budget-bounded* loop, **not** an iterate-until-a-grader-says-done loop.
-
-The grader-driven "iterate until an independent rubric passes" primitive is **Managed Agents' Outcomes** (`user.define_outcome` + rubric + `max_iterations`, with `span.outcome_evaluation_*` events and a separate grader model) - a **different product** (hosted REST API, `client.beta.sessions.*` on `@anthropic-ai/sdk`), not the Agent SDK. Per the docs' own comparison table, Managed Agents runs the loop + sandbox on Anthropic infra; the Agent SDK runs in your process.
-
-**Honest verdict:** RARV-C already *is* Loki's home-grown Outcomes equivalent (iterate → grade via council → close). Neither the Agent SDK nor Managed Agents Outcomes maps onto it 1:1. Do **not** fabricate a wiring where the SDK "provides" RARV-C - the SDK provides a bounded tool-use loop; the grader/council closure stays Loki's. Managed Agents Outcomes is the nearest hosted analog but would mean re-platforming completion onto Anthropic's grader (out of scope, and would cede Loki's council).
-
-## 6. Runtime / auth / cost (verified)
-- **Runtime:** Node, Bun, or Deno - `executable?: 'bun'|'deno'|'node'`. TS SDK bundles the native binary per platform (no separate `claude` install). Python variant (`claude-agent-sdk`) needs Python ≥3.10.
-- **Auth:** `ANTHROPIC_API_KEY` (docs). Also Bedrock (`CLAUDE_CODE_USE_BEDROCK=1`), Claude Platform on AWS (`CLAUDE_CODE_USE_ANTHROPIC_AWS=1` + `ANTHROPIC_AWS_WORKSPACE_ID`), Vertex (`CLAUDE_CODE_USE_VERTEX=1`), Foundry (`CLAUDE_CODE_USE_FOUNDRY=1`). **Anthropic explicitly prohibits third-party products from using claude.ai login / subscription rate limits via the Agent SDK - API-key auth only.** No interactive login (a real improvement over the CLI's OAuth `claude auth`).
-- **Cost:** standard per-token API billing (surfaced live as `total_cost_usd` on the result). Same underlying `/v1/messages` cost as the CLI - the CLI's cost is API cost; the SDK doesn't change the cost model, it just reports it structurally.
-
-## 7. Honest gaps (what each does that the other doesn't)
-
-**Agent SDK gains over Loki's `claude -p` wrapper:**
-- Typed streaming messages (`SDKMessage` union) instead of stdout parsing; structured `SDKResultSuccess`/`SDKResultError` with cost/usage/`structured_output`.
-- In-process custom tools (`tool()`), in-process hooks, programmatic subagents (`agents`), programmatic MCP.
-- Mid-session control (`interrupt`, `setModel`, `setPermissionMode`, `applyFlagSettings`, `streamInput`, `rewindFiles`) - no equivalent when you shell out to `claude -p`.
-- `startup()`/`WarmQuery` for low-latency warm spares.
-
-**Provider-agnostic caveat (per founder's constraint):** the Agent SDK is Anthropic/Claude-Code-specific. It does NOT give Loki Codex/Cline/Aider. Those routes need their own story (the OpenAI-compatible layer, explicitly out of scope here). Note the Agent SDK *can* target Bedrock/Vertex/Foundry via env vars, but that's still Claude models.
-
-**What the Agent SDK does NOT do / gaps vs the premise:**
-- **Does not remove the native binary** (finding above) - it spawns a bundled Claude Code executable per platform. "Library, just an API key, no binary" is only true of `@anthropic-ai/sdk` (Client SDK).
-- No grader/Outcomes primitive (RARV-C stays Loki's; §5).
-- No built-in vector memory (Loki's `memory/` package has no SDK analog; wire via MCP/hooks).
-- Only one valid `SdkBeta` (`context-1m-2025-08-07`) - other API betas (fast-mode, compaction, etc.) aren't first-class SDK options.
-- WebFetch-only claims I could NOT verify in the `.d.ts` and mark **UNVERIFIED**: the exact `SDKAssistantMessage`/`SDKPartialAssistantMessage` content-block shapes, `ThinkingConfig` as a 3-variant union, and `CanUseTool`'s full options object. The `thinking?: ThinkingConfig` field, `includePartialMessages?: boolean`, and `canUseTool?: CanUseTool` fields **are** confirmed present; their inner shapes should be re-read from `sdk.d.ts` before you write code against them.
-
-Verified type-def file (kept for the implementer): `/private/tmp/claude-501/-Users-lokesh-git-lokimode-anthropic/8db286db-3006-49f5-9dc6-cb241e559d45/scratchpad/package/sdk.d.ts` (line refs above are from this file, v0.3.207).
-
-**Recommendation to fold into the v8 plan:** the migration decision is not "Agent SDK vs bash" - it's a three-way fork (Agent SDK = bundled binary + full harness; Client SDK = pure API, Loki owns the loop; Managed Agents = hosted loop+sandbox+Outcomes). Only the Client SDK path delivers the founder's stated "no binary, API-key-only container" win, at the cost of re-owning the loop Loki mostly already owns. Surface this explicitly before locking scope.

package/docs/WELCOME-OPENER-PLAN.md

@@ -1,106 +0,0 @@
-# Welcome Opener Plan (the "magic opener")
-
-## Goal
-A polished welcome experience shown when people install the loki CLI or
-run the Docker image. It (1) introduces Loki/Autonomi with the dashboard's
-design language, (2) subtly highlights the research backing + memory
-compounding moat, (3) offers a simple opt-in form collecting anonymous
-role / business / tools, transmitted to PostHog on click, and (4) links to
-autonomi.dev/docs.
-
-## Hard constraints (from the user + CLAUDE.md)
-- Anonymous usage analytics for PRODUCT IMPROVEMENT ONLY. NEVER transmit
-  prompts, PRDs, code, or any project content. Disclosed, not covert.
-- Reuse the EXISTING PostHog contract already in the codebase:
-  - host `https://us.i.posthog.com`, path `/capture/`
-  - public ingest key `phc_ya0vGBru41AJWtGNfZZ8H9W4yjoZy4KON0nnayS7s87`
-    (same key postinstall.js + autonomy/telemetry.sh already use; public
-    ingest keys are safe in client code), overridable by LOKI_POSTHOG_KEY.
-  - Honor opt-out: LOKI_TELEMETRY_DISABLED=true and DO_NOT_TRACK=1.
-- Design must match the loki dashboard: accent #553DE9, light bg #FAFAF7 /
-  dark #0F0B1A, text #1A1614 / #F0ECF8, fonts DM Serif Display (headings),
-  Inter (body), JetBrains Mono (mono). Glass cards. Light + dark.
-- No emojis, no em dashes anywhere.
-
-## Components
-
-### 1. web-app-less static page: `assets/welcome/welcome.html`
-Self-contained single HTML file (inline CSS + JS, Google Fonts link), so
-it works opened directly from disk OR served. Sections:
-- Hero: "Loki Mode by Autonomi" + tagline "Describe it. Walk away. Get
-  working, tested software." + version (templated at serve time or left
-  generic).
-- Three subtle highlight cards: (a) RARV-C closure + unanimous council
-  ("finishes the work, verified"), (b) Cross-project memory that compounds
-  ("your agents stop repeating mistakes across projects"), (c) Research
-  backing (Anthropic Constitutional AI / DeepMind debate / OpenAI Agents
-  SDK / NVIDIA ToolOrchestra) shown as small footnote-style chips, not
-  loud claims.
-- Opt-in form: role (select), company size (select), primary tools
-  (multi-select chips: Claude Code, Cursor, Codex, Copilot, Cline, Aider,
-  other). A single "Send + get started" button. Consent line directly
-  under it: "Sends anonymous usage analytics (your role, company size,
-  tools) to help us improve the product. We never collect your prompts,
-  PRDs, or code. Opt out anytime with LOKI_TELEMETRY_DISABLED=true."
-- CTA row: "Read the docs" -> https://www.autonomi.dev/docs ; "Quick
-  start" copyable `loki start ./prd.md`.
-- On submit: POST to us.i.posthog.com/capture/ with event
-  `welcome_profile`, distinct_id = the existing ~/.loki-telemetry-id (or a
-  fresh uuid in browser localStorage if not injected), properties =
-  {role, company_size, tools, source:'welcome_opener', loki_version}.
-  Then show a thank-you state + the docs link. Submission is the ONLY
-  network call; nothing is sent on page load.
-- Respect opt-out: if the page is served with ?telemetry=off (the CLI
-  passes this when LOKI_TELEMETRY_DISABLED/DO_NOT_TRACK is set), the form
-  is replaced with a "analytics disabled" note and the submit is a no-op.
-
-### 2. CLI command: `loki welcome`
-- Mirrors cmd_dashboard_open idiom. Resolves the welcome.html path inside
-  the package, opens it with `open`/`xdg-open`. If no browser opener
-  (headless/Docker), prints the terminal fallback (see #4) + the file path
-  + the autonomi.dev/docs URL.
-- Passes ?telemetry=off when opt-out env is set.
-- Dispatch: add `welcome) cmd_welcome "$@" ;;` near the `demo)` case
-  (~autonomy/loki:12505) and a help line.
-
-### 3. First-run auto-open (once)
-- Marker file: `~/.loki/.welcomed`. On first `loki start` (and at end of
-  postinstall when a browser is available + not CI + not opt-out), if the
-  marker is absent: open the welcome page once, then write the marker.
-  Never auto-open again. CI/non-TTY/Docker never auto-open a browser; they
-  only print the terminal welcome.
-- postinstall.js already prints an install summary; append a one-line
-  "Run `loki welcome` for a quick tour" pointer (no auto browser launch in
-  postinstall to avoid surprising npm installs).
-
-### 4. Terminal fallback
-- A clean ASCII/ANSI welcome (loki accent color) printed when no browser:
-  product one-liner, the 3 highlights as one line each, the docs URL, the
-  quick-start command, and the consent/opt-out line. No network call from
-  the terminal fallback (the form is browser-only; terminal just informs).
-
-## Files
-- ADD `assets/welcome/welcome.html`
-- ADD `assets/welcome/welcome.terminal.sh` (sourced helper that prints the
-  terminal welcome) OR inline in cmd_welcome.
-- EDIT `autonomy/loki`: cmd_welcome + dispatch + help + first-run hook in
-  cmd_start.
-- EDIT `bin/postinstall.js`: add the "Run `loki welcome`" pointer line.
-- EDIT `package.json` "files": add `assets/`.
-- EDIT `Dockerfile`, `Dockerfile.sandbox`: COPY assets/.
-- ADD `tests/test-welcome-opener.sh`.
-- Version bump 14 locations + CHANGELOG.
-
-## Privacy test matrix (must pass)
-- Page load makes ZERO network calls (only submit does).
-- Submit payload contains ONLY {role, company_size, tools, source,
-  loki_version, distinct_id}; never any file/prompt/PRD content.
-- LOKI_TELEMETRY_DISABLED=true and DO_NOT_TRACK=1 each => form disabled,
-  no capture.
-- `loki welcome` works headless (terminal fallback, no browser error).
-- First-run marker opens once and not again.
-
-## Honesty
-Highlights cite real, documented research (already in README Research
-Foundation) and frame the memory moat as "retrieval/compounding," NOT a
-claimed task-success number (consistent with prior honesty fixes).