loki-mode 11.3.0 → 11.3.2

package/dashboard/server.py

@@ -1520,9 +1520,9 @@ async def get_provider_models() -> dict:
         "schema_version": 1,
         "providers": {
             "claude": {
-                "latest_planning": "claude-opus-4-7",
-                "latest_development": "claude-opus-4-7",
-                "latest_fast": "claude-sonnet-4-6",
+                "latest_planning": "opus",
+                "latest_development": "opus",
+                "latest_fast": "sonnet",
                 "models": [],
             }
         },
@@ -3360,7 +3360,7 @@ def _provider_model_offers(provider: str) -> list[dict]:
     Every other provider is offered the generic tiers (small/medium/high), which
     are provider-independent, each annotated with the concrete model id the
     catalog says that provider dispatches. That is what makes the picker read
-    "medium -> gpt-5.6-terra" on codex and "medium -> claude-sonnet-5" on claude
+    "medium -> gpt-5.6-terra" on codex and "medium -> <catalog sonnet id>" on claude
     without the frontend knowing a single model id.
     """
     if provider == "claude":
@@ -7738,23 +7738,24 @@ async def stop_session(request: Request):
 # At runtime, overridden by .loki/pricing.json if available
 _DEFAULT_PRICING = {
     # Claude (Anthropic)
-    # Fable 5 is the top-tier advisory model at exactly 2x Opus per token.
-    "fable":  {"input": 10.00, "output": 50.00},
-    "claude-fable-5": {"input": 10.00, "output": 50.00},
-    "opus":   {"input": 5.00, "output": 25.00},
-    "sonnet": {"input": 2.00, "output": 10.00},
-    "haiku":  {"input": 1.00, "output": 5.00},
+    # Fable 5 is the top-tier advisory model at 2.5x Opus 5.5 per token.
+    "fable":  {"input": 10.00, "output": 50.00, "cache_read": 0.25, "cache_write": 12.5, "cache_write_1h": 20},
+    "claude-fable-5": {"input": 10.00, "output": 50.00, "cache_read": 0.25, "cache_write": 12.5, "cache_write_1h": 20},
+    "opus":   {"input": 4.00, "output": 20.00, "cache_read": 0.2, "cache_write": 5, "cache_write_1h": 8},
+    "sonnet": {"input": 2.00, "output": 10.00, "cache_read": 0.1, "cache_write": 2.5, "cache_write_1h": 4},
+    # haiku = Haiku 5.5 up to 100K prompt tokens (no over-100K tier here)
+    "haiku":  {"input": 0.10, "output": 0.50, "cache_read": 0.01, "cache_write": 0.125, "cache_write_1h": 0.2},
+    # Exact ids (a lookup by recorded model string must not fall back to sonnet)
+    "claude-haiku-4-5": {"input": 1.00, "output": 5.00, "cache_read": 0.1, "cache_write": 1.25, "cache_write_1h": 2},
+    "claude-haiku-5-5": {"input": 0.10, "output": 0.50, "cache_read": 0.01, "cache_write": 0.125, "cache_write_1h": 0.2},
     # OpenAI Codex
-    "gpt-5.3-codex": {"input": 1.50, "output": 12.00},
+    "gpt-5.3-codex": {"input": 1.75, "output": 14.00},
     # gpt-5.6 line: sol (high) / terra (medium, default) / luna (small).
-    # UNVERIFIED RATES. The model IDs are confirmed against
-    # developers.openai.com/api/docs/models, but OpenAI's published per-token
-    # prices for this line were not, so these are placeholders scaled from the
-    # gpt-5.3 rate. They drive a display estimate only, never a gate. Replace
-    # from the pricing page; tools/probe-model-catalog.py is the refresh path.
-    "gpt-5.6-sol":   {"input": 2.50, "output": 20.00},
-    "gpt-5.6-terra": {"input": 1.50, "output": 12.00},
-    "gpt-5.6-luna":  {"input": 0.50, "output": 4.00},
+    # Rates from developers.openai.com/api/docs/pricing (read 2026-10-08),
+    # Standard tier, short context (up to 272K). tests/test-pricing-parity.sh pins them.
+    "gpt-5.6-sol":   {"input": 4.00, "output": 20.00},
+    "gpt-5.6-terra": {"input": 2.00, "output": 12.00},
+    "gpt-5.6-luna":  {"input": 0.20, "output": 1.20},
 }
 
 # Active pricing - starts with defaults, updated from .loki/pricing.json
@@ -7888,6 +7889,9 @@ def _compute_cost_snapshot() -> dict:
     cost_recorded = False
     # Tokens were measured (tracker fallback) but no USD figure was recorded.
     cost_unknown = False
+    # FC-44: sessions whose usage could not be recorded (efficiency record flagged tokens_measured:false). Any of them makes
+    # every token and dollar total NOT RECORDED; the response key appears only then.
+    unmeasured_sessions = 0
 
     # Read efficiency files (one JSON file per iteration/task).
     # Use the iteration-*.json pattern so this reader sees the same
@@ -7905,6 +7909,9 @@ def _compute_cost_snapshot() -> dict:
                 if not isinstance(data, dict):
                     continue
                 measured = _record_is_measured(data)
+                rec_unmeasured = data.get("tokens_measured") is False
+                if rec_unmeasured:
+                    unmeasured_sessions += 1
                 if measured:
                     cost_recorded = True
                 # Tokens are measured apart from cost: a record that priced an
@@ -7940,17 +7947,18 @@ def _compute_cost_snapshot() -> dict:
                 for bucket, name in ((by_phase, phase), (by_model, model)):
                     if name not in bucket:
                         bucket[name] = {"input_tokens": 0, "output_tokens": 0, "cost_usd": 0.0,
-                                        "measured": False, "tokens_measured": False}
+                                        "measured": False, "tokens_measured": False, "unmeasured": False}
                     bucket[name]["input_tokens"] += inp
                     bucket[name]["output_tokens"] += out
                     bucket[name]["cost_usd"] += cost
                     bucket[name]["measured"] = bucket[name]["measured"] or measured
                     bucket[name]["tokens_measured"] = bucket[name]["tokens_measured"] or tokens_measured
+                    bucket[name]["unmeasured"] = bucket[name]["unmeasured"] or rec_unmeasured
             except (json.JSONDecodeError, KeyError, TypeError, AttributeError):
                 pass
 
     # Fallback: read from context tracking if efficiency files have no token data
-    if total_input == 0 and total_output == 0:
+    if total_input == 0 and total_output == 0 and not unmeasured_sessions:
         ctx_file = loki_dir / "context" / "tracking.json"
         if ctx_file.exists():
             try:
@@ -8023,25 +8031,26 @@ def _compute_cost_snapshot() -> dict:
     # set of measured records that genuinely sums to zero still renders 0.0 --
     # the direction that would otherwise blank real data (the v8.72.0 trap).
     return {
-        "total_input_tokens": total_input if cost_recorded else None,
-        "total_output_tokens": total_output if cost_recorded else None,
-        "total_cache_read_tokens": total_cache_read if cost_recorded else None,
-        "total_cache_creation_tokens": total_cache_creation if cost_recorded else None,
+        **({"unmeasured_sessions": unmeasured_sessions} if unmeasured_sessions else {}),
+        "total_input_tokens": total_input if cost_recorded and not unmeasured_sessions else None,
+        "total_output_tokens": total_output if cost_recorded and not unmeasured_sessions else None,
+        "total_cache_read_tokens": total_cache_read if cost_recorded and not unmeasured_sessions else None,
+        "total_cache_creation_tokens": total_cache_creation if cost_recorded and not unmeasured_sessions else None,
         "total_tokens": (
             total_input + total_output + total_cache_read + total_cache_creation
-        ) if cost_recorded else None,
+        ) if cost_recorded and not unmeasured_sessions else None,
         "cache_hit_ratio": round(total_cache_read / _read_in, 4) if _read_in > 0 else None,
-        "estimated_cost_usd": round(estimated_cost, 6) if cost_recorded and not cost_unknown else None,
+        "estimated_cost_usd": round(estimated_cost, 6) if cost_recorded and not cost_unknown and not unmeasured_sessions else None,
         "cost_recorded": cost_recorded,
         "by_phase": {k: {
-            "input_tokens": v["input_tokens"] if v.get("tokens_measured") else None,
-            "output_tokens": v["output_tokens"] if v.get("tokens_measured") else None,
-            "cost_usd": round(v["cost_usd"], 6) if v.get("measured") else None,
+            "input_tokens": v["input_tokens"] if v.get("tokens_measured") and not v.get("unmeasured") else None,
+            "output_tokens": v["output_tokens"] if v.get("tokens_measured") and not v.get("unmeasured") else None,
+            "cost_usd": round(v["cost_usd"], 6) if v.get("measured") and not v.get("unmeasured") else None,
         } for k, v in by_phase.items()},
         "by_model": {k: {
-            "input_tokens": v["input_tokens"] if v.get("tokens_measured") else None,
-            "output_tokens": v["output_tokens"] if v.get("tokens_measured") else None,
-            "cost_usd": round(v["cost_usd"], 6) if v.get("measured") else None,
+            "input_tokens": v["input_tokens"] if v.get("tokens_measured") and not v.get("unmeasured") else None,
+            "output_tokens": v["output_tokens"] if v.get("tokens_measured") and not v.get("unmeasured") else None,
+            "cost_usd": round(v["cost_usd"], 6) if v.get("measured") and not v.get("unmeasured") else None,
         } for k, v in by_model.items()},
         "budget_limit": budget_limit,
         "budget_used": round(budget_used, 6) if budget_limit is not None and budget_used is not None else None,
@@ -8565,11 +8574,11 @@ async def get_gate_policy():
 # =============================================================================
 
 _PROVIDER_LABELS = {
-    # v7.104.0: current model IDs (model_catalog.json): opus=claude-opus-4-8,
-    # sonnet=claude-sonnet-5 (the default execution model), haiku=claude-haiku-4-5.
-    "opus": "Opus 4.8",
-    "sonnet": "Sonnet 5",
-    "haiku": "Haiku 4.5",
+    # v7.104.0: current model IDs (model_catalog.json): opus, sonnet (the default execution model), haiku: ids live in
+    # the catalog cli_aliases, not here.
+    "opus": "Opus 5.5",
+    "sonnet": "Sonnet 5.5",
+    "haiku": "Haiku 5.5",
     "gpt-5.3-codex": "GPT-5.3 Codex",
     "gpt-5.6-sol": "GPT-5.6 Sol",
     "gpt-5.6-terra": "GPT-5.6 Terra",
@@ -8580,18 +8589,11 @@ _PROVIDER_LABELS = {
 # the UI WITHOUT changing any computed cost number. The Sonnet 5 intro price
 # ($2/$10 per MTok) became the standard price, so the 2026-09-01 increase to
 # $3/$15 will not occur (platform.claude.com pricing page, read 2026-10-03).
-_UNVERIFIED_RATE_NOTE = (
-    "Unverified placeholder rate, scaled from gpt-5.3; not from OpenAI's pricing page."
-)
 _MODEL_PRICING_NOTES = {
     "sonnet": (
         "Standard pricing: $2 / $10 per MTok. "
         "The intro price became the standard price; no increase to $3 / $15."
     ),
-    # See the UNVERIFIED RATES comment on the pricing table: shown, not hidden.
-    "gpt-5.6-sol": _UNVERIFIED_RATE_NOTE,
-    "gpt-5.6-terra": _UNVERIFIED_RATE_NOTE,
-    "gpt-5.6-luna": _UNVERIFIED_RATE_NOTE,
 }
 
 _MODEL_PROVIDERS = {

package/docs/AGENT-CHANGE-RECEIPT.md

@@ -13,8 +13,8 @@ An Agent Change Receipt is the JSON file a Loki 10 run seals at `.loki/runs/<run
 - `not_proven`: list of strings naming what the run did not prove.
 - `verdict`: one of `VERIFIED`, `PARTIAL`, `ALREADY_SATISFIED`, `SPEC_CONFLICT`, `FAILED` (`types.ts:44`).
 - `evidence`: list of strings (search hits and citation for an ALREADY_SATISFIED verdict).
-- `cost`: `{ usd (number or null), input_tokens, output_tokens, measured_sessions, total_sessions, partial_usd, source? }`.
-- `time`: `{ wall_s, stages }`.
+- `cost`: `{ usd (number or null), input_tokens, output_tokens, cache_read_tokens?, cache_creation_tokens?, sdk_duration_ms?, measured_sessions, total_sessions, partial_usd, source? }`.
+- `time`: `{ wall_s, total_s?, stages, stage_s? }`. `stages` is a disjoint partition of `total_s`: `setup` (first event to machine start), each stage, a parallel group as one bucket (for example `plan+wall`), `orchestration` gaps and `seal`, so a consumer may simply add them. `stage_s` holds each stage's own seconds (parallel members overlap, so they can add to more than their bucket). `wall_s` is the stage buckets without setup, orchestration and seal. `total_s` is elapsed seconds from the run's first event to seal (PR stage excluded); treat it as NOT RECORDED unless every bucket is a non-negative number and they sum to it within 1%. `total_s`, `stage_s` and the cache token keys are additive: older receipts omit them, which reads NOT RECORDED, never 0.
 - `events_sha256`: digest of the run event log.
 - `receipt_sha256`: sha256 of the canonical JSON with `verification` and `receipt_sha256` removed (`loki-ts/src/engine10/verify_cmd.ts:19`).
 - `verification`: `{ jwt, kid }`. `jwt` is a compact EdDSA (Ed25519) token binding the receipt hash; both are null when the receipt is unsigned (`stages/seal.ts:92-95`).

package/docs/ARCHITECTURE.md

@@ -0,0 +1,337 @@
+# Architecture
+
+Loki Mode is the flagship product of [Autonomi](https://www.autonomi.dev/): an
+autonomous spec-to-product system. It accepts any spec source (a PRD, a GitHub
+issue, an OpenAPI/JSON/YAML document, or a one-line brief) and drives it to a
+verified, deployable product through the RARV-C closure loop, with minimal human
+intervention. This document describes the system at a level above the code: how
+the major pieces fit together, how data flows through a build, and the design
+decisions that shaped the current structure.
+
+
+## System Overview
+
+At its core, Loki Mode is an autonomous orchestration engine wrapped in a trust
+layer. The orchestrator runs iterative RARV cycles (Reason, Act, Reflect,
+Verify) against a provider CLI, and a closure stage (the "C" in RARV-C) refuses
+to declare work "done" until deterministic evidence supports the claim. Eight
+quality gates, a blind multi-reviewer council, and a verified-completion
+evidence gate stand between an in-progress build and a "complete" verdict.
+
+The system is built around a few load-bearing principles:
+
+- **Verified completion over claimed completion.** A build is not done because
+  the model says so. It is done when the git diff is non-empty against the
+  run-start commit, tests recorded a real command and exited zero, and no gate
+  was skipped. Every build emits an Evidence Receipt that a skeptic can
+  re-derive independently.
+- **Provider-agnostic execution.** The same workflow runs on Claude Code,
+  OpenAI Codex CLI, Cline, and Aider, with automatic failover. Feature richness
+  degrades gracefully by provider tier rather than failing.
+- **Filesystem as the system bus.** Components do not share memory. They
+  communicate through `.loki/` state files (session, queue, checkpoints,
+  findings, memory), which makes the system inspectable, resumable, and
+  crash-tolerant.
+- **Progressive disclosure.** A slim core skill loads on-demand modules and
+  detailed references only when a task needs them, keeping the working context
+  small.
+- **Dual runtime, single behavior.** A modern Bun/TypeScript runner is the
+  default path; a legacy Bash route remains as a verified-parity fallback. Both
+  routes must produce byte-identical behavior, enforced by a parity matrix.
+
+## High-Level Design
+
+A build proceeds through these stages:
+
+1. **Ingest and classify.** A spec enters via `loki start`. The orchestrator
+   detects project complexity and selects a RARV tier (which maps iterations to
+   model strength: Opus for planning, Sonnet for development, Haiku for cheap
+   parallel work).
+2. **Plan.** An architect pass produces a plan. Scope is locked, and a checklist
+   is derived from the spec.
+3. **Iterate (RARV).** Each iteration builds a prompt (injecting RARV
+   instructions, SDLC phase, memory context, queued tasks, and checklist
+   status), invokes the provider, then runs checklist verification, app-runner
+   management, and smoke tests.
+4. **Review.** A blind 3-reviewer council reviews the diff. Critical/High
+   findings block; an override council can contest a BLOCK when backed by
+   evidence.
+5. **Close (the "C").** Findings are injected into the next iteration, learnings
+   are written to memory, and a handoff document is produced.
+6. **Verify completion.** A completion council votes on whether the work is
+   actually done. The verified-completion evidence gate computes the Evidence
+   Receipt headline (VERIFIED / VERIFIED WITH GAPS / NOT VERIFIED) from
+   deterministic facts only.
+7. **Deliver.** The output is a Git repository with source, tests, configs,
+   audit logs, and a re-checkable Evidence Receipt.
+
+The orchestration logic lives in two parallel implementations. The TypeScript
+runner (`loki-ts/src/runner/`) is the default; the Bash engine
+(`autonomy/run.sh`) is the legacy fallback. Both are driven by the CLI
+(`autonomy/loki`).
+
+## Component Diagram
+
+```
+                            +------------------------------+
+                            |   User / CI / MCP client     |
+                            |  spec: PRD | issue | OpenAPI |
+                            +---------------+--------------+
+                                            |
+                    +-----------------------+-----------------------+
+                    |                       |                       |
+              loki CLI                 MCP server               REST API
+          (autonomy/loki)            (mcp/server.py)         (api/server.ts)
+                    |                       |                       |
+                    +-----------+-----------+-----------+-----------+
+                                |                       |
+                                v                       v
+                   +---------------------------+   +-------------------+
+                   |     Orchestration Engine  |   |    Dashboard      |
+                   |                           |   | (dashboard/       |
+                   |  default: loki-ts/runner  |   |  server.py +      |
+                   |  legacy:  autonomy/run.sh |   |  API only)         |
+                   |                           |   +---------+---------+
+                   |  RARV-C loop:             |             |
+                   |   build_prompt -> provider|             |
+                   |   -> reflect -> verify    |             |
+                   |   -> council -> close     |             |
+                   +-----+-------+-------+-----+             |
+                         |       |       |                   |
+            +------------+   +---+---+   +--------+          |
+            |                |       |            |          |
+            v                v       v            v          |
+    +---------------+  +-----------+ +---------+ +----------+ |
+    |   Providers   |  |  Quality  | | Memory  | |  Events  | |
+    | claude/codex/ |  |  Gates +  | | engine  | |   bus    |<+
+    | cline/aider   |  |  Council  | | (RAG,   | | (py/ts/  |
+    | (failover)    |  | (8 gates) | | vector) | |   sh)    |
+    +-------+-------+  +-----------+ +----+----+ +----------+
+            |                            |
+            v                            v
+    +---------------+            +-----------------+
+    | Provider CLI  |            |   .loki/ state  |
+    | (model calls) |            | session, queue, |
+    +---------------+            | checkpoints,    |
+                                 | memory, findings|
+                                 | (system bus)    |
+                                 +-----------------+
+```
+
+All long-lived coordination flows through `.loki/` on the filesystem. The three
+entry surfaces (CLI, MCP, REST API) and the dashboard all read and write the
+same state, which is what makes runs resumable and independently verifiable.
+
+## Data Flow
+
+A representative end-to-end flow:
+
+1. **Entry.** `loki start ./prd.md` (CLI dispatch in `autonomy/loki`) resolves
+   the provider and execs the orchestration engine. The TS runner
+   (`loki-ts/src/runner/autonomous.ts`) is default; `LOKI_LEGACY_BASH=1` selects
+   `autonomy/run.sh`.
+2. **Complexity and tier.** The engine detects complexity and maps the iteration
+   to a model tier (`rarv.ts` / `run.sh:get_rarv_tier`).
+3. **Prompt construction.** `build_prompt.ts` (`run.sh:build_prompt`) assembles
+   the iteration prompt: RARV instructions, SDLC phase, retrieved memory context
+   (`memory/retrieval.py` via the RAG injector), queued tasks, and checklist
+   status.
+4. **Provider invocation.** The prompt is dispatched to the selected provider
+   (`providers.ts`). Claude Code runs with full features (subagents, parallel
+   worktrees, Task tool, MCP); Codex/Cline/Aider run in degraded, sequential
+   modes. Failures trigger failover to the next available provider.
+5. **Reflect and verify.** Post-iteration, the engine runs checklist
+   verification (`autonomy/checklist-verify.py`), manages the app runner
+   (`autonomy/app-runner.sh`), and runs Playwright smoke tests.
+6. **Review.** `quality_gates.ts` (`run.sh:run_code_review`) runs the 8 gates and
+   the blind 3-reviewer council (`loki-ts/src/council/voter_agents.ts`). Findings
+   are scored; Critical/High block. An override council can lift a BLOCK only
+   when a non-empty evidence artifact backs a trusted proof type.
+7. **Close.** Structured findings are persisted
+   (`.loki/state/findings-<iter>.json`) and injected into the next iteration
+   (`findings_injector.ts`); learnings are written (`learnings_writer.ts`); a
+   handoff doc is emitted (`escalation_handoff.ts`).
+8. **Completion decision.** The completion council
+   (`autonomy/completion-council.sh:council_should_stop`) votes. Independently,
+   the verified-completion evidence gate computes the Evidence Receipt from
+   deterministic facts (diff SHAs and counts, test/build commands and exit
+   codes, per-gate verdicts) and assessments (council judgment), and derives the
+   headline from facts alone.
+9. **Persistence and events.** State is checkpointed throughout
+   (`checkpoint.ts`); episodes are stored to memory (`episode_bridge.ts`); the
+   event bus (`events/bus.{py,ts}`, `events/emit.sh`) broadcasts progress to the
+   dashboard and any subscribers. The dashboard reads `.loki/` and the event
+   stream over WebSocket.
+
+Crash recovery and resume work because every meaningful step lands in `.loki/`.
+A killed run can be resumed from its last checkpoint; durable-state mode
+(`LOKI_DURABLE_STATE=1`) extends this to run-to-completion k8s Jobs with
+crash-resume and an exit-code contract.
+
+## Directory Structure
+
+```
+autonomy/                  Runtime and orchestration (legacy + shared shell)
+  loki                     CLI: command dispatch, ~100 cmd_ functions
+  run.sh                   Legacy Bash orchestration engine (RARV loop)
+  completion-council.sh    Completion detection via council voting
+  council-v2.sh            Reviewer council (v2)
+  app-runner.sh            Builds, runs, and health-checks the generated app
+  checklist-verify.py      Per-iteration checklist verification
+  context-tracker.py       Context-window usage tracking
+  hooks/                   Lifecycle hooks (quality gate, healing, episode store)
+  lib/                     Shared helpers: proof generation/verify, crash
+                           capture/redact, launch-kit, secure-scan, trust metrics,
+                           wiki generation, MCP config
+
+loki-ts/                   Default Bun/TypeScript runtime
+  src/cli.ts               TS CLI entry
+  src/runner/              RARV-C loop: autonomous, build_prompt, rarv, council,
+                           quality_gates, completion, findings_injector,
+                           learnings_writer, proof, checkpoint, providers, state
+  src/council/             Voter agents and finding schema
+  src/providers/           Provider flag/config helpers (claude, mcp config)
+  src/commands/            Subcommands: doctor, status, memory, trust, wiki, ...
+  src/metrics/             Efficiency and reward metrics
+
+providers/                 Provider configs (shell-sourceable)
+  claude.sh                Claude Code - Tier 1 (full features)
+  cline.sh                 Cline - Tier 2
+  codex.sh / aider.sh      Codex / Aider - Tier 3 (degraded, sequential)
+  loader.sh / models.sh    Provider loader and model registry
+  model_catalog.json       Model catalog (probed)
+
+memory/                    Memory system (Python package, ~19 modules)
+  engine.py                Memory orchestrator
+  schemas.py / storage.py  Pydantic schemas; file-based backend
+  retrieval.py             Task-aware retrieval
+  consolidation.py         Episodic-to-semantic pipeline
+  embeddings.py            Vector embeddings (optional)
+  vector_index.py          Vector search index
+  cross_project.py         Cross-project knowledge transfer
+  rag_injector.py          RAG context injection into prompts
+  knowledge_graph.py       Knowledge graph over memories
+  layers/                  Progressive-disclosure loading
+
+mcp/                       Model Context Protocol server
+  server.py                MCP server (tools + resources + prompts)
+  tools.py / magic_tools.py / managed_tools.py  Tool registries
+  resources.py             MCP resources
+  lsp_proxy.py             LSP proxy (references, definitions, symbols)
+
+dashboard/                 FastAPI control-plane backend
+  server.py                100+ endpoints, WebSocket event stream
+  control.py / auth.py     Run control and authentication
+  database.py / audit.py   Persistence and audit logging
+packages/control-plane/    Control Plane: browser UI and service (Bun)
+
+web-app/                   Web surface (FastAPI + built dist) for browser PRD input
+
+api/                       REST API (TypeScript/Deno-style)
+  server.ts / mod.ts       Server entry and module map
+  routes/                  events, health, learning, memory, sessions, tasks
+  services/                cli-bridge, event-bus, learning-collector, state-*
+  middleware/              auth, cors, error, timing
+
+events/                    Unified event bus (py + ts + sh emitter)
+
+skills/                    On-demand skill modules (progressive disclosure)
+  00-index.md              Module selection and routing
+  quality-gates.md         The 8-gate system (canonical)
+  healing.md / testing.md / production.md / providers.md / agents.md / ...
+
+references/                Detailed documentation (~24 files): research patterns,
+                           agent types, SDLC phases, deployment, MCP, memory
+
+templates/                 21 PRD templates (saas, cli, discord-bot, ...)
+agents/                    Agent registry: types.json, hub install, managed registry
+benchmarks/                SWE-bench and HumanEval harnesses
+plugins/                   Claude Code plugin packaging
+.github/workflows/         CI: tests, release, sbom,
+                           security-audit, post-release-smoke, ...
+SKILL.md                   Slim core skill (progressive disclosure entry)
+CLAUDE.md                  Project + agent operating instructions
+VERSION / package.json     Single source of version truth
+docker/                            Container distribution (Dockerfiles, compose)
+```
+
+## Key Design Decisions
+
+- **Verified completion as the product, not a feature.** The Evidence Receipt
+  splits deterministic *facts* (diff, test/build exit codes, gate verdicts) from
+  AI *assessments* (council judgment) and computes the green/amber/red headline
+  from facts alone. This is a deliberate stance against transcript-narrated
+  "done." It guarantees a "complete" verdict is independently re-checkable, not a
+  promise.
+
+- **Dual runtime with enforced parity.** Rather than a risky big-bang migration,
+  the modern Bun/TS runner runs as the default while the Bash engine remains a
+  fallback. Parity suites under `tests/` check identical
+  behavior across both routes; there is no continuous parity CI workflow.
+
+- **Filesystem state bus over in-process coupling.** Coordination through
+  `.loki/` files (rather than shared memory or a message broker) buys
+  inspectability, crash-resume, and the ability for three independent entry
+  surfaces (CLI, MCP, REST) plus the dashboard to observe and drive the same run.
+
+- **Provider tiering with graceful degradation.** Provider capability is encoded
+  as tiers (full -> reduced -> sequential) instead of hard requirements. A weaker
+  provider loses parallelism and the Task tool but still completes the workflow,
+  preserving "no vendor lock-in" as a real property.
+
+- **Model-tier selection by task, not by knob.** Opus is reserved for planning
+  and architecture, Sonnet for implementation, Haiku for cheap parallel work.
+  The tier is auto-selected from task signals; explicit knobs exist only as
+  opt-out escape hatches.
+
+- **Council and override council for trust under uncertainty.** A blind
+  3-reviewer council must reach consensus; a separate override council can only
+  lift a BLOCK when a non-empty evidence artifact backs a trusted proof type.
+  This prevents a confident-but-wrong verdict from silently shipping.
+
+- **Progressive disclosure of instructions.** A slim `SKILL.md` plus on-demand
+  `skills/` modules and `references/` keeps the orchestrator's working context
+  focused, loading deep documentation only when a task requires it.
+
+- **Memory as a cross-project asset.** Episodic, semantic, and procedural memory
+  with optional vector search and RAG injection means lessons learned on one
+  build surface on the next, with token-economics tracking to keep retrieval
+  cheap.
+
+- **Closure loop (RARV-C) wiring.** Findings injection, override council,
+  auto-learnings, and structured handoff are wired together (gated by
+  `LOKI_INJECT_FINDINGS`, `LOKI_OVERRIDE_COUNCIL`, `LOKI_AUTO_LEARNINGS`,
+  `LOKI_HANDOFF_MD`) so each iteration closes on the last instead of starting
+  cold.
+
+## Technology Choices
+
+- **Bun + TypeScript** for the default runtime (`loki-ts/`). Fast startup, a
+  single bundled binary path, and strong typing for the orchestration core.
+- **Bash** for the legacy engine (`autonomy/run.sh`, `autonomy/loki`) and shared
+  shell helpers. Retained as a verified-parity fallback and for the broadest
+  host portability.
+- **Python** for the memory system, the MCP server, the dashboard backend, and
+  numerous lib helpers (proof generation/verification, crash capture/redaction,
+  secure scanning, wiki generation). Chosen for its data and ML ecosystem
+  (Pydantic schemas, optional sentence-transformers embeddings, FastAPI).
+- **FastAPI** for the dashboard control plane and web surface, with a WebSocket
+  event stream for live run telemetry.
+- **Vite + Playwright** for the Control Plane UI (`packages/control-plane/ui`): a
+  lightweight build and end-to-end browser tests.
+- **Model Context Protocol (MCP)** as a first-class integration surface
+  (`mcp/server.py`): tools, resources, and prompts, plus an LSP proxy for
+  code intelligence (references, definitions, symbols).
+- **Provider CLIs** (Claude Code, OpenAI Codex CLI, Cline, Aider) as the model
+  execution layer, abstracted behind shell-sourceable provider configs and the
+  TS providers module.
+- **Docker / Docker Compose** for distribution and for the multi-service,
+  12-factor stacks Loki generates (web + database + cache with healthchecks).
+- **GitHub Actions** for CI/CD: test suites, SBOM and security audits,
+  multi-channel release (npm, Docker, Homebrew), and post-release smoke tests.
+
+---
+
+For deeper detail, see `SKILL.md` (core skill), `skills/quality-gates.md` (the
+canonical 8-gate table), `skills/sdlc-fleet.md` (the standing SDLC fleet
+pattern), and the `references/` directory.

package/docs/BRANDING.md

@@ -0,0 +1,124 @@
+# Branding: Loki (the agent) by Autonomi (the company)
+
+Authoritative naming reference. Founder directive 2026-06-12. Consult this
+before naming any product, doc heading, marketing surface, CLI string, or
+release note. When in doubt, this file wins.
+
+## The one rule
+
+**Loki Mode is the agent / brand ambassador. Autonomi is the company and the
+name on everything commercial.**
+
+**CRITICAL: this is a BRANDING distinction only. Nothing technical changes
+between free and paid.** The same software, CLI, SDK, MCP server, agent, and
+code ship to free OSS users and to paid/enterprise/cloud users. Loki is the CLI,
+the SDK, the MCP server, the agent - for everyone. The ONLY difference is the
+brand label on the *offering*: an OSS/free user runs "Loki Mode"; a paying
+team/enterprise buys the same thing under the "Autonomi" brand (Autonomi Cloud,
+Autonomi Enterprise). There is no separate "enterprise build" or "cloud fork" of
+the engine - it is one product, two brand labels chosen by audience. Do NOT
+rename, fork, gate, or technically diverge anything; only relabel the commercial
+*presentation*.
+
+The relationship is the industry pattern of "named assistant, by company":
+- Alexa by Amazon
+- Copilot by GitHub
+- Watson by IBM
+- Gemini by Google
+- Ellie by Entelligence
+- **Loki by Autonomi**
+
+Loki is *who you talk to and what you run*. Autonomi is *who you pay and who
+stands behind the enterprise/cloud product*. The chat box on autonomi.dev is
+"chat with Loki." The invoice says Autonomi.
+
+## What is called "Loki Mode" (the agent / free / OSS)
+
+Everything free, source-available, OSS, and developer-facing keeps the **Loki**
+name:
+- The CLI: `loki` (binary), "Loki Mode" (product name of the OSS tool).
+- The SDK(s): "Loki SDK".
+- The local dashboard / web app (runs on the user's machine): "Loki Mode dashboard".
+- The agent persona / chat: "Loki" (the thing users converse with, everywhere -
+  including inside Autonomi Cloud and on autonomi.dev).
+- The npm package `loki-mode`, the Docker image `asklokesh/loki-mode`, the
+  Homebrew formula, the MCP server `io.github.asklokesh/loki-mode` - all KEEP
+  their identifiers (renaming published artifact IDs breaks installs; do NOT
+  rename them).
+- The benchmarks, the RARV/council engine, the memory system - the *technology*
+  is Loki.
+
+## What is called "Autonomi" (the company / commercial / paid)
+
+Everything commercial, hosted, paid, or enterprise wears the **Autonomi** brand:
+- **Autonomi** - the company (autonomi.dev).
+- **Autonomi Cloud** - the hosted/SaaS surface (was/never "Loki Cloud").
+- **Autonomi Enterprise** - the enterprise offering (SSO, RBAC, audit, SLAs).
+- **Autonomi** (VaaS) - the hosted Verification-as-a-Service product (the
+  ~/loki-vaas scaffold's *product* name is Autonomi-branded; the engine is Loki).
+- Any paid tier, support plan, or commercial license: Autonomi.
+
+Each commercial product carries a **"powered by Loki"** (or "runs Loki" /
+"built on Loki") attribution so the engine lineage stays visible - the Copilot/
+GPT pattern. Example: "Autonomi Cloud, powered by Loki."
+
+## Mapping table (rename these going forward)
+
+| Old / ambiguous | New | Notes |
+|---|---|---|
+| Loki Cloud | **Autonomi Cloud** (powered by Loki) | commercial hosted |
+| Loki Enterprise (as a *product/offering* name) | **Autonomi Enterprise** (powered by Loki) | the paid offering |
+| Loki VaaS / Loki Verification Cloud | **Autonomi Verify** (VaaS), powered by Loki | ~/loki-vaas product brand (renamed 2026-06-12) |
+| "Loki, the company" | **Autonomi** | the company is Autonomi |
+| Loki SaaS / Loki Pro / Loki Business | **Autonomi Cloud** / **Autonomi Enterprise** | no paid tier wears "Loki" |
+| Loki Mode (the CLI/SDK/agent) | **Loki Mode** (unchanged) | the agent keeps its name |
+| `loki` CLI binary | `loki` (unchanged) | never rename the binary |
+
+## Tricky cases (decided)
+
+1. **The `loki enterprise` CLI subcommand** (`loki enterprise token …`, `loki
+   enterprise audit …`): the COMMAND stays `loki enterprise` for backward
+   compatibility (renaming breaks every user/script). It is the Loki CLI's
+   gateway to enterprise *features*. But in PROSE / docs / marketing, the
+   enterprise *offering* it unlocks is branded "Autonomi Enterprise." So:
+   command = `loki enterprise`; product = Autonomi Enterprise. Doc pattern:
+   "Use `loki enterprise` to manage your **Autonomi Enterprise** license."
+   (A future `autonomi` alias for the command MAY be added as a superset, but
+   `loki enterprise` is never removed.)
+
+2. **Published artifact IDs** (npm `loki-mode`, Docker `asklokesh/loki-mode`,
+   brew `loki-mode`, MCP `io.github.asklokesh/loki-mode`): KEEP. These are
+   install identifiers; the brand on the *page* can say "Loki Mode (by
+   Autonomi)" but the package name does not change. Renaming = broken installs.
+
+3. **The dashboard/web-app chat**: the agent in the chat box is "Loki"
+   everywhere - in the OSS dashboard AND inside Autonomi Cloud. The container
+   product (local dashboard = Loki Mode dashboard; hosted = Autonomi Cloud) is
+   what changes, not the agent's name.
+
+4. **autonomi.dev website**: company + commercial = Autonomi branding; the
+   product you download is "Loki Mode"; the assistant is "Loki". The hero can be
+   "Autonomi - autonomous software delivery, powered by Loki" with a "Download
+   Loki Mode (free)" CTA and a "Autonomi Cloud / Enterprise" commercial CTA.
+
+5. **License/legal**: BUSL-1.1 is held by Autonomi; "Free for personal/internal/
+   academic use" applies to Loki Mode (source-available); commercial licensing = Autonomi.
+   Keep "source-available," never "open source" (BUSL is not OSI-approved).
+
+## Taglines (approved patterns)
+
+- "Loki Mode - the autonomous coding agent. Free and source-available."
+- "Autonomi - autonomous software delivery for teams and enterprises. Powered by Loki."
+- "Autonomi Cloud - hosted Loki, managed for your team."
+- "Autonomi Enterprise - Loki with SSO, RBAC, audit, and SLAs."
+- "Chat with Loki." (the assistant, anywhere)
+
+## Going forward
+
+Any new product, page, heading, or release note must place itself on the correct
+side of this line:
+- Free / OSS / CLI / SDK / agent / chat -> **Loki Mode** / **Loki**.
+- Paid / hosted / cloud / enterprise / company -> **Autonomi** (+ "powered by Loki").
+
+Update this file if the founder revises the rule; this file is the single source
+of truth for naming.