loki-mode 11.3.0 → 11.3.2

package/docs/metrics.md

@@ -1,6 +1,6 @@
 # Metrics Guide
 
-Prometheus and OpenMetrics monitoring for Loki Mode (v5.38.0).
+Prometheus and OpenMetrics monitoring for Loki Mode.
 
 ## Overview
 
@@ -15,28 +15,28 @@ Loki Mode exposes a `/metrics` endpoint that returns production-ready metrics in
 
 ## Quick Start
 
-The `/metrics` endpoint is served by the dashboard and needs no enabling flag.
-Start the dashboard and scrape it.
+The metrics endpoint is served by the Control Plane and needs no enabling flag.
+Start the Control Plane and scrape it.
 
 ```bash
-# Start the dashboard (serves /metrics)
-loki dashboard start
+# Start the Control Plane (serves /v1/metrics, and /metrics for older scrapers)
+loki control serve
 
 # View metrics
-curl http://localhost:57374/metrics
+curl http://127.0.0.1:47821/v1/metrics
 
-# Or use CLI
-loki metrics
+# Or use the CLI session report
+loki report metrics
 ```
 
 ## Metrics Endpoint
 
 ```
-GET http://localhost:57374/metrics
+GET http://127.0.0.1:47821/v1/metrics
 Content-Type: text/plain; version=0.0.4
 ```
 
-Returns metrics in OpenMetrics text format. No authentication required by default (configure reverse proxy auth for production).
+Returns metrics in OpenMetrics text format. Without `LOKI_CONTROL_TOKEN` the endpoint answers loopback requests only (403 otherwise); with a token set, send it as a bearer token.
 
 ## Available Metrics
 
@@ -121,19 +121,15 @@ Metrics are derived from `.loki/` flat files:
 ## CLI Usage
 
 ```bash
-# Fetch all metrics
-loki metrics
+# Fetch all metrics from a running Control Plane
+curl -s http://127.0.0.1:47821/v1/metrics
 
-# Filter specific metric
-loki metrics | grep loki_cost_usd
-
-# Watch metrics in real-time
-watch -n 5 loki metrics
-
-# Custom dashboard host/port
-loki metrics --host 192.168.1.100 --port 8080
+# Filter one metric
+curl -s http://127.0.0.1:47821/v1/metrics | grep loki_cost_usd
 ```
 
+`loki report metrics` is a separate session productivity report, not the Prometheus text.
+
 ## Prometheus Configuration
 
 ### Basic Scrape Config
@@ -145,7 +141,7 @@ scrape_configs:
   - job_name: 'loki-mode'
     scrape_interval: 15s
     static_configs:
-      - targets: ['localhost:57374']
+      - targets: ['127.0.0.1:47821']
         labels:
           environment: 'production'
           project: 'my-app'
@@ -160,7 +156,7 @@ scrape_configs:
     tls_config:
       insecure_skip_verify: true  # For self-signed certs
     static_configs:
-      - targets: ['localhost:57374']
+      - targets: ['127.0.0.1:47821']
 ```
 
 ### With Authentication (via reverse proxy)
@@ -190,7 +186,7 @@ scrape_configs:
         regex: loki-mode
       - source_labels: [__meta_kubernetes_pod_ip]
         target_label: __address__
-        replacement: $1:57374
+        replacement: $1:47821
 ```
 
 ## Grafana Integration
@@ -287,7 +283,7 @@ Create `/etc/datadog-agent/conf.d/openmetrics.d/loki_mode.yaml`:
 
 ```yaml
 instances:
-  - prometheus_url: http://localhost:57374/metrics
+  - prometheus_url: http://127.0.0.1:47821/v1/metrics
     namespace: loki
     metrics:
       - loki_session_status
@@ -394,15 +390,10 @@ Configure alerts in Grafana panels:
 
 ## Environment Variables
 
-There are none. `/metrics` is an unconditional route on the dashboard app
-(`dashboard/server.py:9637`), served at the dashboard's own port and path. An
-earlier version of this page listed `LOKI_METRICS_ENABLED`,
-`LOKI_METRICS_PORT`, and `LOKI_METRICS_PATH`; none of the three is read by any
-code, so the endpoint cannot be turned off, moved, or re-pathed by environment.
-
-To change the port, change the dashboard port. To restrict access, put the
-dashboard behind a reverse proxy: unlike the `/api/*` routes, `/metrics` has no
-auth scope dependency, so anything that can reach the port can read it.
+There are none specific to metrics. The endpoint follows the Control Plane
+port (`LOKI_CONTROL_PORT`, default 47821) and its token (`LOKI_CONTROL_TOKEN`).
+`LOKI_METRICS_ENABLED`, `LOKI_METRICS_PORT` and `LOKI_METRICS_PATH` are not read
+by any code.
 
 ## Best Practices
 
@@ -434,19 +425,13 @@ auth scope dependency, so anything that can reach the port can read it.
 ### Metrics Endpoint Returns Empty
 
 ```bash
-# Check LOKI_METRICS_ENABLED is set
-echo $LOKI_METRICS_ENABLED
-
-# Verify LOKI_DIR is set (required for dashboard)
-echo $LOKI_DIR
-
 # Check dashboard-state.json exists and is updating
 ls -la .loki/dashboard-state.json
 watch -n 2 cat .loki/dashboard-state.json
 
-# Check dashboard is running
-loki dashboard status
-curl http://localhost:57374/health
+# Check the Control Plane is running
+loki control status
+curl http://127.0.0.1:47821/health
 ```
 
 ### Metrics Show Zero Values
@@ -468,27 +453,24 @@ ls -la .loki/events.jsonl
 ### Connection Refused
 
 ```bash
-# Verify dashboard is running on expected port
-curl http://localhost:57374/health
-
-# Check if another process is using port 57374
-lsof -ti:57374
+# Verify the Control Plane is running on the expected port
+curl http://127.0.0.1:47821/health
+loki control status
 
-# Restart dashboard
-loki dashboard stop
-loki dashboard start
+# Start it (an explicit --port never falls back to another port)
+loki control serve --port 47821
 ```
 
 ### Prometheus Cannot Scrape
 
 ```bash
 # Test endpoint manually
-curl http://localhost:57374/metrics
+curl http://127.0.0.1:47821/v1/metrics
 
 # Check Prometheus targets page
 open http://prometheus-server:9090/targets
 
-# Verify network connectivity from Prometheus to Loki dashboard
+# Verify network connectivity from Prometheus to the Control Plane
 # (firewall, security groups, etc.)
 
 # Check Prometheus logs
@@ -503,7 +485,7 @@ kubectl logs -f prometheus-server-xyz
 # Set up budget alert
 cat > /tmp/budget_check.sh <<'EOF'
 #!/bin/bash
-COST=$(curl -s http://localhost:57374/metrics | grep loki_cost_usd | awk '{print $2}')
+COST=$(curl -s http://127.0.0.1:47821/v1/metrics | grep loki_cost_usd | awk '{print $2}')
 if (( $(echo "$COST > 4.5" | bc -l) )); then
   echo "CRITICAL: Cost $COST exceeds budget!"
   loki stop
@@ -522,7 +504,7 @@ import requests
 import json
 
 def get_loki_metrics():
-    response = requests.get("http://localhost:57374/metrics")
+    response = requests.get("http://127.0.0.1:47821/v1/metrics")
     metrics = {}
     for line in response.text.splitlines():
         if line.startswith("loki_"):
@@ -553,6 +535,6 @@ EOF
 ## See Also
 
 - [Audit Logging](audit-logging.md) - Track agent actions
-- [Dashboard Guide](dashboard-guide.md) - Web dashboard
+- [Control Plane](control-plane-migration.md) - The local UI and `/v1/*` API
 - [Enterprise Features](../wiki/Enterprise-Features.md) - Complete enterprise guide
 - [Prometheus Metrics](../wiki/Prometheus-Metrics.md) - Detailed wiki documentation

package/docs/network-security.md

@@ -174,7 +174,7 @@ spec:
         sizeLimit: 256Mi
 ```
 
-## TLS/HTTPS for Dashboard (v5.36.0)
+## TLS/HTTPS for Dashboard
 
 Enable encrypted dashboard connections:
 

package/docs/siem-integration.md

@@ -21,7 +21,7 @@ Supported SIEM platforms:
 - LogRhythm
 - SumoLogic
 
-## Syslog Forwarding (v5.38.0)
+## Syslog Forwarding
 
 ### Enable Syslog
 
@@ -108,7 +108,7 @@ spec, so events cannot break the record framing. Failed events
 (`success: false`) are elevated to severity 8.
 
 ```
-CEF:0|Autonomi|Loki Mode|7.49.0|revoke_token|revoke_token|8|rt=2026-02-15T14:30:00.000Z suser=alice src=10.0.0.4 cs1=token cs1Label=resourceType outcome=failure msg=expired credential loki.provider=claude loki.cost=4.25
+CEF:0|Autonomi|Loki Mode|X.Y.Z|revoke_token|revoke_token|8|rt=2026-02-15T14:30:00.000Z suser=alice src=10.0.0.4 cs1=token cs1Label=resourceType outcome=failure msg=expired credential loki.provider=claude loki.cost=4.25
 ```
 
 Nested `details` are flattened under the `loki.` namespace. Standard CEF keys
@@ -326,7 +326,7 @@ export LOKI_CEF_VENDOR=Autonomi
 export LOKI_CEF_PRODUCT="Loki Mode"
 
 # CEF message example:
-# CEF:0|Autonomi|Loki Mode|5.42.2|session.start|Session Started|3|
+# CEF:0|Autonomi|Loki Mode|X.Y.Z|session.start|Session Started|3|
 # rt=2026-02-15T14:30:00Z suser=user cs1=claude cs1Label=Provider
 ```
 
@@ -428,13 +428,13 @@ Notifications: PagerDuty, Slack #incidents
 ### CEF (Common Event Format)
 
 ```
-CEF:0|Autonomi|Loki Mode|5.42.2|session.start|Session Started|3|rt=2026-02-15T14:30:00Z suser=user cs1=claude cs1Label=Provider
+CEF:0|Autonomi|Loki Mode|X.Y.Z|session.start|Session Started|3|rt=2026-02-15T14:30:00Z suser=user cs1=claude cs1Label=Provider
 ```
 
 ### LEEF (Log Event Extended Format)
 
 ```
-LEEF:1.0|Autonomi|Loki Mode|5.42.2|session.start|devTime=2026-02-15T14:30:00Z usrName=user provider=claude
+LEEF:1.0|Autonomi|Loki Mode|X.Y.Z|session.start|devTime=2026-02-15T14:30:00Z usrName=user provider=claude
 ```
 
 ## Event Correlation

package/docs/spec-first-intent.md

@@ -0,0 +1,28 @@
+# Spec-first intent
+
+The intent card (`LOKI_INTENT_CARD`, `LOKI_CONFIRM`) shows what the plan model thinks you want and the acceptance checks it will hold itself to. Spec-first intent turns those checks into a file you can edit before any code is written.
+
+## Flow
+
+```bash
+loki plan "add search ranking" --spec     # or: loki start --spec-first "add search ranking"
+# edit .loki/specs/add-search-ranking.md
+loki start --spec .loki/specs/add-search-ranking.md
+```
+
+1. `loki plan <task> --spec` runs one model session. The model writes the intent sentence and 2 to 6 criteria as JSON; the engine checks that JSON against a schema and renders `.loki/specs/<slug>.md`. The model never writes the markdown itself. An existing spec is never overwritten unless you pass `--force`.
+2. You edit the file. Keep the marker comment on line 1 and the three headings (`## Task`, `## Intent`, `## Acceptance criteria`). Task lines start with `> `; criteria are `- ` bullets.
+3. `loki start --spec FILE` parses the file and treats it as the authoritative intent: the implement brief carries the intent and every criterion, and wins over the task text where they differ. A positional task, if given, replaces the task text but not the spec.
+
+## Refusals
+
+A spec that does not parse exits 2 before any run state is created, naming the file and line, for example `engine10: .loki/specs/a.md: line 14: criteria must be bullet lines starting with "- "`. `--spec` and `--spec-first` cannot be combined.
+
+## Evidence
+
+- The receipt gains an additive `spec` block: `{ "path": ".loki/specs/<slug>.md", "sha256": "<hex>" }`. The hash covers the exact bytes the run started from (the engine snapshots them into the run directory), so later edits to the file do not change what the receipt vouches for. Runs without `--spec` have no `spec` key and their receipt hashes are unchanged.
+- The PR body gains a `Spec:` line linking the file with the first 12 hex characters of its hash, next to the `## Intent` section.
+
+## Unchanged without the flags
+
+Without `--spec` or `--spec-first`, `loki plan` stays on its existing route, `loki start` behaves as before, and the plan and implement briefs are byte-identical (pinned by golden fixtures in `loki-ts/tests/engine10/fixtures`).

package/docs/v10/CLI-MODERN.md

@@ -6,12 +6,12 @@ Classes: KEEP-MODERN (v10-native or engine-neutral), UPDATE (live but needs mode
 
 ## Counts
 
-- KEEP-MODERN: 60
+- KEEP-MODERN: 64
 - UPDATE: 22
 - DROP-LEGACY: 31
 - DELETE: 14
-- Total rows: 127
-- Registry paths (commands and nested subcommands): 171
+- Total rows: 131
+- Registry paths (commands and nested subcommands): 181
 
 ## Commands
 
@@ -35,6 +35,10 @@ Classes: KEEP-MODERN (v10-native or engine-neutral), UPDATE (live but needs mode
 | contract | loki-ts/src/cli.ts | KEEP-MODERN | v10 delivery contract |
 | start | bun route, bash fallthrough | UPDATE | Forks between v10 and the SDK loop; flags still legacy-shaped |
 | slack | loki-ts/src/cli.ts | KEEP-MODERN | Bun-native integration |
+| queue | loki-ts/src/cli.ts | KEEP-MODERN | Governor-aware batch of issue-mode runs |
+| issues | loki-ts/src/cli.ts | KEEP-MODERN | Mass issue pickup on the T7 queue |
+| undo | loki-ts/src/cli.ts | KEEP-MODERN | UNDO-1/2: --plan is read-only, apply behind LOKI_UNDO=1 |
+| verify-pr | loki-ts/src/cli.ts | KEEP-MODERN | VPR-2: fail-to-pass check, LOKI_VERIFY_PR=1 |
 | answer | loki-ts/src/cli.ts | KEEP-MODERN | v10 blocked-run flow |
 | engine10 | loki-ts/src/cli.ts | KEEP-MODERN | The v10 engine |
 | internal (hidden) | loki-ts/src/cli.ts | KEEP-MODERN | Hidden plumbing |

package/docs/v10/DECISIONS.md

@@ -733,3 +733,62 @@ PROGRESS.md (the FC-25 P9 entry) cites a D88 CI waiver that was never recorded i
 Amendment to D89 (2026-10-07 21:40Z, CTO decision, refined by the founder at 21:45Z, CoS records). This amends only R1-19, the default-on flip that follows the CTO gate; 11.1.0 and 11.2.0 still ship the router OFF. (1) The default executor is Sonnet 5.5; Haiku 5.5 per work unit when Opus assigns it. (2) Roles: Opus 5.5 is the architect, router and advisor, plans and assigns each unit, and is consulted on hard calls. Sonnet is the senior engineer and the default for implementation and fixes. Haiku does tests, docs and small low-risk changes only when Opus assigns them in the plan. Haiku is never the blanket default. (3) L0 holds: the harness never routes by task type or path regex; it only executes, verifies and escalates. (4) The route schema is `units: [{id, kind, executor, reason}]` plus a run default of sonnet; a missing or invalid unit route goes to sonnet with NOT PROVEN. A haiku unit that fails a code-owned check is redone on sonnet, then escalates to opus; a Wall assigned to haiku gets an Opus review before implement. The receipt lists the executor, assigner and reason per unit. The per-unit schema lands in 11.2.0 or 11.2.1 depending on what is merged. (5) Escalation stays evidence-gated (haiku -> sonnet -> opus, and sonnet -> opus), and `LOKI_ROUTER=0` equals pre-router behavior exactly (the R1-21 golden). (6) The R1-16 shape-defaults semantics are inverted (a shape is listed as `haiku` once it has earned it; an absent listing means Sonnet), and R1-16 history is an input to Opus, not a harness rule. Rationale: a wrong PR costs the user far more than the token savings, B9 covers only about 5 of 14 shapes (item 10), and under L0 a model earns the cheaper tier with evidence. Items 3, 5, 7 and 9 above are read with this amendment; their text is kept as recorded. See docs/v11/ROUTER-1.md sections 4.1, 4.3 and 4.6.
 
 Amendment 2 to D89 (2026-10-08 00:15Z, steering finding, CoS records; tightens a gate, so it binds until the CTO relaxes it). R1-19 gains one more gate line: on the trivial fixture (the steering Node off-by-one fixture), router-on cost must be <= router-off cost x 1.05, measured with n>=3 per arm and recorded per arm as cache-read input tokens, fresh input tokens, output tokens, dollars and wall time (R1-17 B9). Evidence that prompted it (n=1, may be variance): 11.2.0 smoke, router on cost +15% tokens, +27% dollars and +38s with zero advisor calls and no route change. If the advisor tool definition costs tokens on sessions that never consult it, the advisor is enabled only on the sessions Opus marks as needing it (plan and fix rounds), not on every stage. Measure before changing code.
+
+## D90 (2026-10-08, founder directive, CoS records; CTO approved): the push and release gate is the fast gate, full suites run nightly
+Founder directive, verbatim: "why tests take 15 to 20min? cut it down to only needed ones and keep only less than 2min total in git".
+
+1. This supersedes D55 for the release gate. D55 required a full Tier B verdict on the exact tree of every main commit. The blocking gate on slice-*, train/**, main and PRs (test.yml, name "Tests") is now: tsc plus the dist build once (reused as an artifact), the moat P9 case only (tests/moat/p9-rule-of-two.sh, with every registered P9 id required to PASS), the structural guards, and the impacted bun and shell suites selected from the diff since the last release tag by scripts/ci/fast-gate.sh (it wraps scripts/select-tests.sh and adds path-to-guard mapping for the paths the selector sends to R0: workflows, Dockerfiles, package manifests, tests/lib, dist, VERSION). Shards are packed to stay under 90s each.
+2. Fail safe: if the diff cannot be computed, the planner selects the FULL set (test.yml calls full-suite.yml).
+3. Deferral: any selected suite estimated over 80s (from tests/shard-durations.tsv) is not run in the push gate; it is listed in deferred.tsv and covered by the nightly.
+4. Backstop: full-suite.yml (all 8 shell shards, full bun, python matrix, helm, Node 20/24, the full moat registry) runs from nightly.yml on a schedule and by workflow_dispatch. It is non-blocking for the push. A red nightly opens a FAILURE-CLASSES fix slice and blocks the NEXT release: release.yml required-ci fails while the latest completed nightly on main is red and newer than the previous release tag, until a newer nightly is green. The block fails closed if the API cannot be read.
+5. Removed as duplicates: tier-a.yml (its job is now the fast gate in test.yml, same triggers), first-run-gate.yml (moved to a continue-on-error job in nightly.yml; promote.yml and the post-release smoke already run an installed first-run check), and tests/test-tier-a-r0-timeout-budget.sh (its workflow no longer exists).
+6. Release: publish-npm packs once, verifies the PACKED tarball, uploads it and publishes that tarball with no second prepack build; the registry-visibility wait is its own job (npm-visible) so the publish job ends when the publish does. Post-Release Smoke npm leg shrinks to a fresh install plus loki version plus the doctor assertion with a short backoff.
+7. Not done here, tracked as deferred: publishing the tarball built by the Tests run across workflows, the stubbed-run smoke step, and the full moat registry ratchet in the push gate (kept nightly).
+8. Risks accepted: selected tests are an estimate of impact, not proof; the nightly is the proof, and the NEXT release pays for a miss. Timings are estimates until measured on push.
+
+## D91 (2026-10-08, founder directive relayed by the CTO at 04:35Z, CoS records): releases by clock, continuous merge, hotspot registries
+Founder directive, verbatim: "faster faster, increase velocity and releases and feature count in each release and updates/enhancements/bug-fixes in each release, strategize and steer that way".
+
+1. Releases by clock, not scope (amends D25 and D37). From 11.3.2 on, the Release Manager cuts a release every 45 minutes from whatever is approved and green on main. No cut waits for a slice; a slice that misses a cut takes the next one. Each release targets at least 3 user-visible features plus at least 5 enhancements or fixes, with a user-facing CHANGELOG. A cut short of that target still ships what is green; the shortfall is recorded in METRICS.md and the backlog is refilled.
+2. Continuous merge to main. An approved slice rebases and merges right away behind tsc, its impacted tests, the always-run global guards and moat P9. Long-lived train branches end after 11.3.1. Risky features merge flag-gated and default off, never held.
+3. Hotspot registries (pure refactor, goldens byte-identical). The seal verdict chain, the PR body, the supervisor start line, plan output and start dispatch each become a registry of contributors, so a new feature adds one file plus one registry line. One Opus architect plus 2 engineers own it.
+4. Pipeline budget: push to npm latest under 10 minutes; publish-npm under 1 minute; smoke plus promote under 3 minutes. Measured on every release and reported to steering.
+5. Backlog: at least 30 specced ready slices at all times, split evenly between features, enhancements and fixes, each with acceptance tests. Seat cap 14 while weekly usage is under 50%.
+6. Dogfood: once MASS-1 ships, Loki runs `loki issues run --label bug --draft` against asklokesh/loki-mode's own issues; each VERIFIED PR is a candidate fix for the next cut, reviewed like any slice.
+7. Host: local gates are tsc, impacted tests and global guards; remote CI is the authority. Worktrees stay under 40, pruned by recorded path on every merge (never by timestamp).
+8. Reviews keep the bar (D12/D13) and run in pair mode for every HIGH slice: the reviewer reviews live as commits land, not serially after the build. Unchanged: moat > Seal accuracy, a moat regression still blocks a cut (it is never waived by the clock), and Tier B on the release SHA is still required (D90).
+9. Amendments relayed by steering, 04:40Z to 04:55Z. The cadence drops to 30 minutes once CI-FAST is live (from 11.3.2), and each cut carries 3+ features and 8+ enhancements or fixes. The seat cap rises to 20 once the hotspot registries land. Acceptance-first: an Opus-written acceptance test is committed before the code of every feature slice. Real-run harness: `scripts/real-run.sh <scenario>` installs the packed tarball into a temp prefix and asserts on receipt.json plus the console contract; Post-Release Smoke runs trivial-sum. Finding-to-guard: every review finding becomes an FC row plus an automated guard test.
+10. 10x rule. Each release names one headline metric measured 10x better than a named competitor baseline, and publishes it only when measured: 11.3.2 unattended throughput (MASS-1), 11.3.3 cost per verified fix, 11.3.4 human review time, 11.3.5 babysitting interventions, 11.3.6 time to first verified PR.
+11. COST-HALF. Loki's dollars per VERIFIED task must be at most 0.5x raw `claude -p` on the B9 set (n>=3, with intervals), measured and published every release. Levers: one warm session, model-decided stage skipping (verify and seal never skip), per-unit Haiku, the advisor only where Opus marks it, a context diet under 100K, a byte-identical cache prefix with a test, and harness prefetch of the repomap, test command and failing output. B9 gains a raw arm and a loki arm.
+
+## D92 (2026-10-08, founder directive relayed by steering at 05:00Z, CoS records): 40x efficiency in 12 hours
+Founder directive, verbatim: "research and update all things in loki mode per latest docs, features, updates in the industry, latest standards and much better ways of doing things so our efficiency increases by 40 times overall by tomorrow morning, all should complete in 12hrs, run everything like a software company including researchers and scientists ... consider us to become the best for next 5yrs right now".
+
+1. Definition: EFFICIENCY = verified tasks / (dollars x wall-minutes x human-minutes), measured with B9 raw-vs-loki on a fixed set (trivial-sum, two-bug, one medium real issue, a 10-issue mass run). Baseline is 11.3.1, measured the moment it ships. Target by about 17:00Z: 40x, as a product of factors (about 2x cost, 2x wall time, 10x human-minutes), each reported separately in METRICS.md every release.
+2. Organization: a research division (paper-scout, docs-scout, market-scout; Opus with web access) feeds slice specs through steering. Engineering programs with named owners: COST-HALF, SPEED, HUMAN-TIME, REGISTRIES, ACCURACY, PLATFORM-UPDATE, STANDARDS. One measurement owner runs the B9 raw arm and the 40x scoreboard script. Seat cap 20 while weekly usage is under 50%.
+3. Cadence and bar: a release every 30 minutes once CI-FAST is live, each with 3+ features, 8+ fixes or enhancements and a scoreboard row. A moat regression blocks a cut, P9 is never waived, and nothing unmeasured is claimed.
+
+## D93 (2026-10-08, CTO amendment relayed by the CoS, Architect records): the router plan becomes a routing call; the full plan is conditional
+Amends FC-35 (the router-on plan no longer skips small tasks) and D89 Amendment 2 for COST-HALF (D91 item 11).
+
+1. Under LOKI_ROUTER=1, Opus ALWAYS makes the routing decision, as one short structured-output call: cache-stable prefix (COST-HALF CP-01), effort low, output {size: trivial|small|medium|large, units[], needs_full_plan: bool}. Measured target cost: under $0.01 per run.
+2. The full Opus plan session runs only when needs_full_plan is true. Trivial and small tasks go straight to the routed executor on the lean path.
+3. One plan gate. The implement session's LOKI_NEED_PLAN marker is a second input to the same gate: it can raise it (plan runs once, implement resumes), never lower it. With the router off, the gate's inputs are the marker and the Project Model. The receipt records the reason: route_call, marker, project_model or skipped.
+4. FC-35 R-B holds unchanged: always emit a route or a recorded reason. A failed, timed-out or malformed routing call writes routed:false with the reason to route.json and runs the full plan as before (fail-safe toward more planning, never less). Wall, verify, commit, seal and pr never skip.
+5. Measurement gate: the B9 row on trivial-sum shows the routing call below 10% of total run cost (n>=3), and router-on cost at most 1.05x router-off (D89 Amendment 2). Router-off output stays byte-identical with the flags off.
+6. Slices: COST-HALF LD-01 (gate plus routing call) and LD-02 (marker as a late input), HIGH tier.
+
+## D94 (2026-10-08, CTO ruling relayed by the CoS): main holds the last pushed release until npm has it; RG-06 contrib cap
+1. Main stays at the last pushed release commit until that version is on npm. Later approved slices merge onto a train branch (train-<version>), which fast-forwards or merges into main only after the cut is published. Origin: 11.3.2 train merges sat on main while 11.3.1 was blocked on a red nightly (NIGHTLY-BLOCK), which forced a cherry-pick-only push.
+2. Line budgets are never raised to admit a feature. Overflow is extracted along docs/v11/REGISTRIES.md.
+3. RG-06 approved: loki-ts/src/contrib/ with a 1200-line cap and the D66 import rules. Binding guards: core (engine10) never imports contrib; each contrib module is optional (deleting one leaves core compiling and flag-off goldens unchanged); no verdict logic in contrib (D42); the cap failure lists per-file line counts.
+
+## D96 (2026-10-08, founder directive relayed by steering at 17:45Z, CoS records): every approved slice is a release; next by merge, latest by promotion
+Founder: "you are taking hours long for releases, I wanted 3 releases to 10 releases per hour ... release asap to accommodate that many". Supersedes D94 point 1 (trains) and the D91 clock cut; D90 moves from publish to promotion. D94 points 2 and 3 stand.
+1. A slice that passes merge-gate merges straight to main, and main publishes a PATCH to npm `next` within 15 minutes. There are no trains and no batching. Target: 3 or more releases per hour, 10 when the queue allows.
+2. `next` gate (budget 10 min from push to npm): tsc, impacted tests plus always-run guards, moat P9 (never waived), dist guard, pack smoke.
+3. `latest` is promotion only, never a separate build. promote.yml moves `latest` to the newest `next` version whose SHA, or a descendant of it, has a green full-suite backstop and a green Post-Release Smoke. The backstop runs on main HEAD every 60 minutes. A red backstop blocks promotion, not publishing, and opens a P0 fix slice within the hour.
+4. Pipeline: the workflow bumps the version on push to main (no human bump), CHANGELOG lines come from slice cards and verdicts, the backstop runs hourly, and promotion is driven by a green backstop. Every existing release guard stays: never-backwards, the gitHead stamp, the release-actor tag check. First slice: D96-GATE (move the red-nightly block from release.yml to promote.yml).
+5. Slices are 20-40 minutes of build, one concern, with a user-visible line on the card. Large features ship as a sequence of small flag-gated slices.
+6. HIGH reviews run in pair mode. A TL reviews LOW and MEDIUM with the machine gate, and merge-gate is the hard check. There is no serial review queue.
+7. Every tick reports merge-to-`next` minutes for each release and releases per hour.

package/docs/v10/DEPS.md

@@ -151,9 +151,16 @@ Inventory only. No dependency, lockfile, workflow or image was changed to produc
 | `.github/workflows/coverage.yml` | `oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6` | `0c5077e51419868618aeaa5fe8019c62421857d6  # v2` | `v2.2.0` | minor | SHA-pinned |
 | `.github/workflows/coverage.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
 | `.github/workflows/coverage.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
-| `.github/workflows/first-run-gate.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
-| `.github/workflows/first-run-gate.yml` | `oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6` | `0c5077e51419868618aeaa5fe8019c62421857d6  # v2` | `v2.2.0` | minor | SHA-pinned |
-| `.github/workflows/first-run-gate.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/docker-build-check.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/docker-build-check.yml` | `oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6` | `0c5077e51419868618aeaa5fe8019c62421857d6  # v2` | `v2.2.0` | minor | SHA-pinned |
+| `.github/workflows/docker-build-check.yml` | `docker/setup-buildx-action@v3` | `v3 (resolves to v3.12.0)` | `v4.4.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v3 resolves to v3.12.0 (commit 8d2750c68a42), behind latest release v4.4.1 (commit f87e5991a6d7); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/docker-build-check.yml` | `docker/build-push-action@v5` | `v5 (resolves to v5.4.0)` | `v7.4.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.4.0 (commit ca052bb54ab0), behind latest release v7.4.0 (commit c3c9e263c25d); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/full-suite.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/full-suite.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/full-suite.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/full-suite.yml` | `oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6` | `0c5077e51419868618aeaa5fe8019c62421857d6  # v2` | `v2.2.0` | minor | SHA-pinned |
+| `.github/workflows/full-suite.yml` | `actions/cache@v4` | `v4 (resolves to v4.3.0)` | `v6.1.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.3.0 (commit 0057852bfaa8), behind latest release v6.1.0 (commit 55cc8345863c); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/full-suite.yml` | `azure/setup-helm@v4` | `v4 (resolves to v4.3.1)` | `v5.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.3.1 (commit 1a275c3b6953), behind latest release v5.0.1 (commit 9bc31f4ebc9c); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
 | `.github/workflows/integrity-audit.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
 | `.github/workflows/integrity-audit.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
 | `.github/workflows/integrity-audit.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
@@ -210,10 +217,6 @@ Inventory only. No dependency, lockfile, workflow or image was changed to produc
 | `.github/workflows/test.yml` | `oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6` | `0c5077e51419868618aeaa5fe8019c62421857d6  # v2` | `v2.2.0` | minor | SHA-pinned |
 | `.github/workflows/test.yml` | `actions/cache@v4` | `v4 (resolves to v4.3.0)` | `v6.1.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.3.0 (commit 0057852bfaa8), behind latest release v6.1.0 (commit 55cc8345863c); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
 | `.github/workflows/test.yml` | `azure/setup-helm@v4` | `v4 (resolves to v4.3.1)` | `v5.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.3.1 (commit 1a275c3b6953), behind latest release v5.0.1 (commit 9bc31f4ebc9c); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
-| `.github/workflows/tier-a.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
-| `.github/workflows/tier-a.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
-| `.github/workflows/tier-a.yml` | `oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6` | `0c5077e51419868618aeaa5fe8019c62421857d6  # v2` | `v2.2.0` | minor | SHA-pinned |
-| `.github/workflows/tier-a.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
 | `action.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
 | `.github/actions/issue-to-pr/action.yml` | `(none found)` | `` | `-` | n/a | no `uses:` step found in this workflow/action file |
 | `.github/actions/receipt-check/action.yml` | `(none found)` | `` | `-` | n/a | no `uses:` step found in this workflow/action file |
@@ -243,14 +246,12 @@ Node.js current stable: 26.10.0 (cycle 26); Python current stable: 3.14.8 (cycle
 
 | File | Name | Current | Latest stable | Bump | Note |
 |---|---|---|---|---|---|
-| `Dockerfile` | `oven/bun:${BUN_VERSION}` | `oven/bun:${BUN_VERSION}` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
-| `Dockerfile` | `ubuntu:24.04` | `ubuntu:24.04` | `24.04.5 (newest line 26.04.1)` | MAJOR | EOL 2029-05-31 (not yet); patch in line; MAJOR to newest line |
-| `Dockerfile.control-plane` | `oven/bun:${BUN_VERSION}` | `oven/bun:${BUN_VERSION}` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
-| `Dockerfile.control-plane` | `oven/bun:${BUN_VERSION}-slim` | `oven/bun:${BUN_VERSION}-slim` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
-| `Dockerfile.purplelab-test` | `node:22-slim` | `node:22-slim` | `22.23.3 (newest line 26.10.0)` | MAJOR | EOL 2027-04-30 (not yet); minor in line; MAJOR to newest line |
-| `Dockerfile.sandbox` | `debian:bookworm-slim` | `debian:bookworm-slim` | `12.15 (newest line 13.7)` | MAJOR | EOL 2028-06-30 (not yet); minor in line; MAJOR to newest line |
-| `Dockerfile.sandbox` | `debian:bookworm-slim` | `debian:bookworm-slim` | `12.15 (newest line 13.7)` | MAJOR | EOL 2028-06-30 (not yet); minor in line; MAJOR to newest line |
-| `Dockerfile.test-runner` | `python:3.12-slim` | `python:3.12-slim` | `3.12.15 (newest line 3.14.8)` | minor | EOL 2028-10-31 (not yet); patch in line; minor to newest line |
+| `docker/Dockerfile` | `oven/bun:${BUN_VERSION}` | `oven/bun:${BUN_VERSION}` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
+| `docker/Dockerfile` | `ubuntu:24.04` | `ubuntu:24.04` | `24.04.5 (newest line 26.04.1)` | MAJOR | EOL 2029-05-31 (not yet); patch in line; MAJOR to newest line |
+| `docker/Dockerfile.control-plane` | `oven/bun:${BUN_VERSION}` | `oven/bun:${BUN_VERSION}` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
+| `docker/Dockerfile.control-plane` | `oven/bun:${BUN_VERSION}-slim` | `oven/bun:${BUN_VERSION}-slim` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
+| `docker/Dockerfile.sandbox` | `debian:bookworm-slim` | `debian:bookworm-slim` | `12.15 (newest line 13.7)` | MAJOR | EOL 2028-06-30 (not yet); minor in line; MAJOR to newest line |
+| `docker/Dockerfile.sandbox` | `debian:bookworm-slim` | `debian:bookworm-slim` | `12.15 (newest line 13.7)` | MAJOR | EOL 2028-06-30 (not yet); minor in line; MAJOR to newest line |
 | `artifacts/observability/Dockerfile` | `nginx:1.27-alpine` | `nginx:1.27-alpine` | `1.27.5 (newest line 1.31.6)` | EOL | EOL 2025-06-24 (past); EOL in current line; newest line is 1.31.6 |
 | `dashboard/Dockerfile` | `python:3.11-slim-bookworm` | `python:3.11-slim-bookworm` | `3.11.17 (newest line 3.14.8)` | minor | EOL 2027-10-31 (not yet); patch in line; minor to newest line |
 | `web-app/Dockerfile` | `node:22-alpine` | `node:22-alpine` | `22.23.3 (newest line 26.10.0)` | MAJOR | EOL 2027-04-30 (not yet); minor in line; MAJOR to newest line |
@@ -259,14 +260,13 @@ Node.js current stable: 26.10.0 (cycle 26); Python current stable: 3.14.8 (cycle
 | `deploy/docker-compose/docker-compose.yml` | `asklokesh/loki-mode:latest` | `asklokesh/loki-mode:latest` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
 | `deploy/docker-compose/docker-compose.yml` | `otel/opentelemetry-collector-contrib:0.96.0` | `otel/opentelemetry-collector-contrib:0.96.0` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
 | `deploy/docker-compose/docker-compose.yml` | `jaegertracing/all-in-one:1.54` | `jaegertracing/all-in-one:1.54` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
-| `docker-compose.yml` | `loki-mode:latest` | `loki-mode:latest` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
-| `docker-compose.yml` | `chromadb/chroma:latest` | `chromadb/chroma:latest` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
-| `docker-compose.yml` | `loki-mode:latest` | `loki-mode:latest` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
-| `docker-compose.yml` | `loki-mode:latest` | `loki-mode:latest` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
-| `docker-compose.yml` | `redis:7-alpine` | `redis:7-alpine` | `7.4.11 (newest line 8.10.2)` | MAJOR | EOL 2029-12-01 (not yet); resolved floating tag '7' to cycle 7.4; minor in line; MAJOR to newest line |
+| `docker/docker-compose.yml` | `loki-mode:latest` | `loki-mode:latest` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
+| `docker/docker-compose.yml` | `chromadb/chroma:latest` | `chromadb/chroma:latest` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
+| `docker/docker-compose.yml` | `loki-mode:latest` | `loki-mode:latest` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
+| `docker/docker-compose.yml` | `loki-mode:latest` | `loki-mode:latest` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
+| `docker/docker-compose.yml` | `redis:7-alpine` | `redis:7-alpine` | `7.4.11 (newest line 8.10.2)` | MAJOR | EOL 2029-12-01 (not yet); resolved floating tag '7' to cycle 7.4; minor in line; MAJOR to newest line |
 | `web-app/docker-compose.purple-lab.yml` | `postgres:16-alpine` | `postgres:16-alpine` | `16.15 (newest line 18.6)` | MAJOR | EOL 2028-11-09 (not yet); minor in line; MAJOR to newest line |
 | `web-app/docker-compose.purple-lab.yml` | `redis:7-alpine` | `redis:7-alpine` | `7.4.11 (newest line 8.10.2)` | MAJOR | EOL 2029-12-01 (not yet); resolved floating tag '7' to cycle 7.4; minor in line; MAJOR to newest line |
-| `docker-compose.test.yml` | `(none found)` | `` | `-` | n/a | no `FROM` / `image:` line found (build-context-only service, or a multi-stage FROM this pass did not match) |
 
 ## Helm (every `Chart.yaml` found via `git ls-files`, any directory)
 
@@ -367,7 +367,7 @@ Counts are all from the single `Bump` column (current line vs newest line in the
 | Python (pyproject) | 0 | 0 | 1 | 1 | 0 | 0 | 1 | 1 | 0 |
 | GitHub Actions | 0 | 11 | 0 | 59 | 0 | 0 | 2 | 2 | 2 |
 | Runtimes | 0 | 4 | 0 | 2 | 2 | 0 | 1 | 0 | 0 |
-| Docker/Compose | 0 | 3 | 0 | 8 | 1 | 0 | 11 | 0 | 1 |
+| Docker/Compose | 0 | 2 | 0 | 7 | 1 | 0 | 11 | 0 | 0 |
 | Helm | 0 | 0 | 0 | 0 | 0 | 3 | 5 | 0 | 42 |
 | Terraform | 0 | 0 | 0 | 4 | 0 | 0 | 0 | 0 | 15 |
 | Homebrew | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 1 | 0 |

package/docs/v10/ENGINE.md

@@ -107,7 +107,7 @@ Every claim below comes from reading main at 84c22568. I edited no files.
   - The dry-run list contains the three files.
 - **Deps:** E-14, E-TG.
 
-### E-33: EV-6 gate report generator
+### E-33: gate report generator (EV-6)
 - **Files:** `eval/loki10/gate_report.py` (new), `eval/loki10/test-gate-report.sh` (new), `eval/loki10/fixtures/gate/` (new subdir).
 - **Tier:** HIGH. Its marker controls E-31.
 - **Contents:**