loki-mode 11.5.1 → 11.7.1

package/dashboard/control.py

@@ -1,62 +1,23 @@
 """
-Loki Mode Session Control API
+Loki Mode session-control helpers
 
-FastAPI-based session control endpoints for the Loki Mode dashboard.
-Provides start/stop/pause/resume functionality and real-time status updates.
-
-Usage:
-    uvicorn dashboard.control:app --host 0.0.0.0 --port 57374
-    # Or run with the CLI:
-    loki dashboard start
+Shared helpers for the dashboard: session status, atomic JSON writes, skill-dir
+discovery and the browser-mutation Origin check. The HTTP control routes live
+in dashboard/server.py (the only dashboard app).
 """
 
-import asyncio
 import fcntl
 import json
 import os
-import signal
-import subprocess
 import tempfile
 from datetime import datetime, timezone
 from pathlib import Path
 from typing import Optional
 from urllib.parse import urlsplit
 
-from fastapi import Depends, FastAPI, HTTPException, Request
-from fastapi.middleware.cors import CORSMiddleware
-from fastapi.responses import JSONResponse, StreamingResponse
+from fastapi import Request
 from pydantic import BaseModel
 
-# Auth gating for the standalone control app.
-#
-# This module also defines a self-contained FastAPI `app` whose own docstring
-# invites operators to expose it via `uvicorn dashboard.control:app`. When that
-# happens the state-mutating endpoints (start/stop/pause/resume) MUST honor the
-# same scope checks as the primary dashboard (dashboard/server.py), otherwise a
-# user who follows the docstring stands up an unauthenticated control plane that
-# can launch arbitrary builds and kill running sessions even when
-# LOKI_ENTERPRISE_AUTH / OIDC are configured.
-#
-# auth.require_scope is a no-op (allows access) when no auth method is enabled,
-# so this import is safe for the default anonymous-localhost workflow and only
-# enforces when the operator has explicitly turned auth on. The import is
-# defensive: if the package context is unavailable (e.g. the file is run from a
-# path where the relative import fails) we fall back to a gate that always
-# allows, preserving the prior behavior rather than crashing import.
-try:
-    from . import auth as _auth
-
-    def _require_control_scope():
-        return Depends(_auth.require_scope("control"))
-except Exception:  # pragma: no cover - defensive fallback for non-package runs
-    def _require_control_scope():
-        async def _noop() -> bool:
-            return True
-
-        return Depends(_noop)
-
-_CONTROL_DEP = _require_control_scope()
-
 
 def _normalized_http_origin(value: str) -> tuple[str, str, int] | None:
     """Return a comparable browser origin, or ``None`` when malformed.
@@ -250,104 +211,6 @@ def atomic_write_json(file_path: Path, data: dict, use_lock: bool = True):
     except Exception as e:
         raise RuntimeError(f"Failed to write {file_path}: {e}")
 
-# FastAPI app
-app = FastAPI(
-    title="Loki Mode Control API",
-    description="Session control endpoints for Loki Mode dashboard",
-    version="1.0.0"
-)
-
-# CORS middleware for dashboard frontend - restricted to localhost by default.
-# Set LOKI_DASHBOARD_CORS to override (comma-separated origins).
-_cors_default = "http://localhost:57374,http://127.0.0.1:57374"
-_cors_raw = os.environ.get("LOKI_DASHBOARD_CORS", _cors_default)
-_cors_origins = [o.strip() for o in _cors_raw.split(",") if o.strip()]
-if "*" in _cors_origins or _cors_raw.strip() == "*":
-    if os.environ.get("LOKI_ENV") == "production":
-        raise RuntimeError(
-            "Wildcard CORS ('*') is not allowed in production. "
-            "Set LOKI_DASHBOARD_CORS to a specific origin list, "
-            "or set LOKI_ENV != production."
-        )
-    import logging
-
-    logging.getLogger(__name__).warning(
-        "LOKI_DASHBOARD_CORS is set to '*' -- all origins are allowed. "
-        "This is insecure for production deployments."
-    )
-app.add_middleware(
-    CORSMiddleware,
-    allow_origins=_cors_origins,
-    allow_credentials=True,
-    allow_methods=["*"],
-    allow_headers=["*"],
-)
-
-
-@app.middleware("http")
-async def browser_mutation_boundary(request: Request, call_next):
-    """Refuse cross-origin browser mutations before control side effects."""
-    if request.method in ("POST", "PUT", "PATCH", "DELETE"):
-        if not browser_mutation_origin_allowed(request, _cors_origins):
-            return JSONResponse(
-                status_code=403,
-                content={"detail": "cross-origin mutation refused"},
-            )
-    return await call_next(request)
-
-
-# Request/Response models
-class StartRequest(BaseModel):
-    """Request body for starting a Loki Mode session."""
-    prd: Optional[str] = None
-    provider: str = "claude"
-    parallel: bool = False
-    background: bool = True
-
-    def validate_provider(self) -> None:
-        """Validate provider is from allowed list."""
-        allowed_providers = ["claude", "codex", "gemini", "cline", "aider"]
-        if self.provider not in allowed_providers:
-            raise ValueError(f"Invalid provider: {self.provider}. Must be one of: {', '.join(allowed_providers)}")
-
-    def validate_prd_path(self) -> None:
-        """Validate PRD path is safe and exists."""
-        if not self.prd:
-            return
-
-        # Check for path traversal sequences
-        if ".." in self.prd:
-            raise ValueError("PRD path contains path traversal sequence (..)")
-
-        # Resolve to absolute path and verify it exists
-        prd_path = Path(self.prd).resolve()
-        if not prd_path.exists():
-            raise ValueError(f"PRD file does not exist: {self.prd}")
-
-        # Verify it's a file, not a directory
-        if not prd_path.is_file():
-            raise ValueError(f"PRD path is not a file: {self.prd}")
-
-        # Verify path resolves within CWD or a reasonable parent.
-        # FAIL CLOSED if the cwd is gone: this is a path-confinement check, so
-        # an unresolvable base must reject the path, never skip the comparison.
-        try:
-            cwd = Path.cwd().resolve()
-        except OSError as exc:
-            raise ValueError(
-                "cannot validate PRD path: the working directory no longer "
-                "exists (%s)" % exc
-            ) from exc
-        try:
-            prd_path.relative_to(cwd)
-        except ValueError:
-            # Not within CWD - check if it's within user's home or project directory
-            home = Path.home().resolve()
-            try:
-                prd_path.relative_to(home)
-            except ValueError:
-                raise ValueError(f"PRD path is outside allowed directories: {self.prd}")
-
 
 class StatusResponse(BaseModel):
     """Current session status."""
@@ -365,13 +228,6 @@ class StatusResponse(BaseModel):
     timestamp: str
 
 
-class ControlResponse(BaseModel):
-    """Generic control operation response."""
-    success: bool
-    message: str
-    pid: Optional[int] = None
-
-
 # Utility functions
 def read_file_safe(filepath: Path) -> str:
     """Read file contents safely, returning empty string on error."""
@@ -520,289 +376,3 @@ def get_status() -> StatusResponse:
         complexity=complexity,
         timestamp=datetime.now(timezone.utc).isoformat()
     )
-
-
-# API Endpoints
-@app.get("/api/control/health")
-async def health_check():
-    """Health check endpoint."""
-    return {"status": "ok", "version": get_version()}
-
-
-@app.get("/api/control/status", response_model=StatusResponse)
-async def get_session_status():
-    """Get current session status."""
-    return get_status()
-
-
-@app.post("/api/control/start", response_model=ControlResponse, dependencies=[_CONTROL_DEP])
-async def start_session(request: StartRequest):
-    """
-    Start a Loki Mode session.
-
-    Args:
-        request: Start request with PRD path, provider, and options
-
-    Returns:
-        ControlResponse with success status and PID
-    """
-    # Validate input
-    try:
-        request.validate_provider()
-        request.validate_prd_path()
-    except ValueError as e:
-        raise HTTPException(status_code=400, detail=str(e))
-
-    # Check if already running
-    status = get_status()
-    if status.state == "running":
-        raise HTTPException(
-            status_code=409,
-            detail=f"Session already running with PID {status.pid}"
-        )
-
-    # Verify run.sh exists
-    if not RUN_SH.exists():
-        raise HTTPException(
-            status_code=500,
-            detail=f"run.sh not found at {RUN_SH}"
-        )
-
-    # Build command arguments
-    args = [str(RUN_SH), "--provider", request.provider]
-    if request.parallel:
-        args.append("--parallel")
-    if request.background:
-        args.append("--bg")
-    if request.prd:
-        args.append(request.prd)
-
-    try:
-        # Start the process
-        # RUN_SH is a trusted fixed path; provider and PRD were validated above,
-        # and argv is passed directly without a command shell.
-        process = subprocess.Popen(
-            args,  # lgtm[py/command-line-injection]
-            stdout=subprocess.DEVNULL,
-            stderr=subprocess.DEVNULL,
-            start_new_session=True,
-            # A deleted cwd would make Popen itself raise; fall back to the
-            # skill tree rather than failing to launch the run at all.
-            cwd=str(_cwd_or_skill_dir()),
-            shell=False,
-        )
-
-        # Save provider for status tracking
-        (STATE_DIR / "provider").write_text(request.provider)
-
-        # Emit start event
-        emit_event("session_start", {
-            "pid": process.pid,
-            "provider": request.provider,
-            "prd": request.prd,
-            "parallel": request.parallel
-        })
-
-        return ControlResponse(
-            success=True,
-            message=f"Session started with provider {request.provider}",
-            pid=process.pid
-        )
-    except Exception as e:
-        raise HTTPException(status_code=500, detail=str(e))
-
-
-@app.post("/api/control/stop", response_model=ControlResponse, dependencies=[_CONTROL_DEP])
-async def stop_session():
-    """
-    Stop the current Loki Mode session.
-
-    Creates a STOP file to signal graceful shutdown and attempts
-    to terminate the process directly.
-    """
-    stop_file = LOKI_DIR / "STOP"
-    pid_file = LOKI_DIR / "loki.pid"
-
-    # Create STOP file for graceful shutdown
-    stop_file.parent.mkdir(parents=True, exist_ok=True)
-    stop_file.write_text(datetime.now(timezone.utc).isoformat())
-
-    # Also try to terminate process directly
-    pid_str = read_file_safe(pid_file)
-    pid = None
-    if pid_str.isdigit():
-        pid = int(pid_str)
-        if is_process_running(pid):
-            try:
-                os.kill(pid, signal.SIGTERM)
-            except (OSError, ProcessLookupError):
-                pass
-
-    # Mark session.json as stopped (skill-invoked sessions)
-    session_file = LOKI_DIR / "session.json"
-    if session_file.exists():
-        try:
-            # Read current session data
-            session_data = json.loads(session_file.read_text())
-            session_data["status"] = "stopped"
-
-            # Atomic write with file locking to prevent race conditions
-            atomic_write_json(session_file, session_data, use_lock=True)
-        except (json.JSONDecodeError, OSError, KeyError, RuntimeError):
-            pass
-
-    # Emit stop event
-    emit_event("session_stop", {"pid": pid, "reason": "user_request"})
-
-    return ControlResponse(
-        success=True,
-        message="Stop signal sent",
-        pid=pid
-    )
-
-
-@app.post("/api/control/pause", response_model=ControlResponse, dependencies=[_CONTROL_DEP])
-async def pause_session():
-    """
-    Pause the current Loki Mode session.
-
-    Creates a PAUSE file that signals the runner to pause
-    after completing the current task.
-    """
-    pause_file = LOKI_DIR / "PAUSE"
-
-    # Create PAUSE file
-    pause_file.parent.mkdir(parents=True, exist_ok=True)
-    pause_file.write_text(datetime.now(timezone.utc).isoformat())
-
-    # Get current PID for response
-    pid_file = LOKI_DIR / "loki.pid"
-    pid_str = read_file_safe(pid_file)
-    pid = int(pid_str) if pid_str.isdigit() else None
-
-    # Emit pause event
-    emit_event("session_pause", {"pid": pid})
-
-    return ControlResponse(
-        success=True,
-        message="Pause signal sent - session will pause after current task",
-        pid=pid
-    )
-
-
-@app.post("/api/control/resume", response_model=ControlResponse, dependencies=[_CONTROL_DEP])
-async def resume_session():
-    """
-    Resume a paused Loki Mode session.
-
-    Removes the PAUSE and STOP files to allow the session to continue.
-    """
-    pause_file = LOKI_DIR / "PAUSE"
-    stop_file = LOKI_DIR / "STOP"
-
-    # Remove control files
-    try:
-        pause_file.unlink(missing_ok=True)
-    except Exception:
-        pass
-
-    try:
-        stop_file.unlink(missing_ok=True)
-    except Exception:
-        pass
-
-    # Get current PID for response
-    pid_file = LOKI_DIR / "loki.pid"
-    pid_str = read_file_safe(pid_file)
-    pid = int(pid_str) if pid_str.isdigit() else None
-
-    # Emit resume event
-    emit_event("session_resume", {"pid": pid})
-
-    return ControlResponse(
-        success=True,
-        message="Session resumed",
-        pid=pid
-    )
-
-
-@app.get("/api/control/events")
-async def stream_events():
-    """
-    Stream events as Server-Sent Events (SSE).
-
-    Provides real-time updates to the dashboard frontend.
-    """
-    async def event_generator():
-        # Send initial status
-        status = get_status()
-        yield f"data: {json.dumps(status.model_dump())}\n\n"
-
-        # Track file position for incremental reads
-        last_position = 0
-        if EVENTS_FILE.exists():
-            last_position = EVENTS_FILE.stat().st_size
-
-        # Stream updates
-        while True:
-            # Send status update every 2 seconds
-            status = get_status()
-            yield f"event: status\ndata: {json.dumps(status.model_dump())}\n\n"
-
-            # Check for new events
-            if EVENTS_FILE.exists():
-                current_size = EVENTS_FILE.stat().st_size
-                if current_size > last_position:
-                    with open(EVENTS_FILE, "r") as f:
-                        f.seek(last_position)
-                        for line in f:
-                            line = line.strip()
-                            if line:
-                                yield f"event: log\ndata: {line}\n\n"
-                    last_position = current_size
-
-            await asyncio_sleep(2)
-
-    return StreamingResponse(
-        event_generator(),
-        media_type="text/event-stream",
-        headers={
-            "Cache-Control": "no-cache",
-            "Connection": "keep-alive"
-        }
-    )
-
-
-@app.get("/api/control/logs")
-async def get_logs(lines: int = 50):
-    """
-    Get recent log lines from the session log.
-
-    Args:
-        lines: Number of lines to return (default 50, max 10000)
-    """
-    lines = min(max(lines, 1), 10000)
-    log_file = LOG_DIR / "session.log"
-
-    if not log_file.exists():
-        return {"logs": [], "total": 0}
-
-    content = log_file.read_text()
-    all_lines = [line for line in content.split("\n") if line.strip()]
-    recent_lines = all_lines[-lines:]
-
-    return {"logs": recent_lines, "total": len(all_lines)}
-
-
-# Helper for async sleep
-async def asyncio_sleep(seconds: float):
-    """Async sleep helper."""
-    await asyncio.sleep(seconds)
-
-
-# Run with uvicorn if executed directly
-if __name__ == "__main__":
-    import uvicorn
-    port = int(os.environ.get("LOKI_DASHBOARD_PORT", "57374"))
-    host = os.environ.get("LOKI_DASHBOARD_HOST", "127.0.0.1")
-    uvicorn.run(app, host=host, port=port)

package/docs/ARCHITECTURE.md

@@ -215,8 +215,7 @@ memory/                    Memory system (Python package, ~19 modules)
 
 mcp/                       Model Context Protocol server
   server.py                MCP server (tools + resources + prompts)
-  tools.py / magic_tools.py / managed_tools.py  Tool registries
-  resources.py             MCP resources
+  magic_tools.py / managed_tools.py  Tool registries
   lsp_proxy.py             LSP proxy (references, definitions, symbols)
 
 dashboard/                 FastAPI control-plane backend

package/docs/CLI-CORE-VERBS.md

@@ -98,12 +98,8 @@ The process exit code equals `exit_code`.
 | 3 | Missing component, or verifier error |
 | 64 | Usage error for `verify`, `quick` and `start` (unknown option, missing task) |
 
-Severity rises with the code. `loki verify` exits 0 VERIFIED, 1 CONCERNS, 2
-BLOCKED or not a git directory, 3 verifier error or empty diff, 64 usage error.
-Gate CI with `loki verify || fail` and treat any code of 2 or higher as worse
-than CONCERNS. From 11.4.0 this is a breaking change for scripts that tested
-`rc == 1` on an empty diff or a non-git directory. Per-command detail:
-`docs/exit-codes.md`.
+Severity rises with the code. `loki verify` codes and the CI-gate guidance are
+in `docs/exit-codes.md`.
 
 ## Unknown commands
 

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.5.1. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.7.1. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
 
 | Command | Description |
@@ -19,6 +19,7 @@ Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for th
 | `loki memory index` | Show or rebuild the memory index |
 | `loki memory learn` | Learn lessons from a merged PR's review comments |
 | `loki memory lessons` | List PR review lessons with uses and outcomes |
+| `loki memory brief` | Print the lessons and learnings block an engine10 run injects |
 | `loki memory show` | Show one learning |
 | `loki memory search` | Search learnings |
 | `loki memory stats` | Memory statistics |

package/docs/COMPONENTS.md

@@ -249,13 +249,11 @@ search) to MCP clients.
 **Key files:**
 - `server.py` - MCP server (47 tools: 31 in-file + magic + gated managed + 8 cp; plus
   3 resources, 2 prompts).
-- `tools.py` - Core tool implementations.
 - `magic_tools.py` - Magic Modules tools.
 - `cp_tools.py` - Read-only Control Plane data tools (`cp_*`, GET only; the CP URL
   and token come from the MCP child env and are never returned).
 - `managed_tools.py` - Managed-memory tool (`loki_memory_redact`, gated on
   `LOKI_MANAGED_AGENTS=true` and `LOKI_MANAGED_MEMORY=true`).
-- `resources.py` - MCP resources.
 - `lsp_proxy.py` - LSP proxy (find references, go to definition, symbol lookup).
 - `learning_collector.py` - Learning signal collection.
 - `_sdk_loader.py` - Bootstraps the Python MCP SDK on first run.

package/docs/DEPLOY-PLAN.md

@@ -1,17 +1,26 @@
-# DEPLOY-PLAN.md -- `loki deploy` (ADVISORY / PRINT-ONLY)
+# DEPLOY-PLAN.md -- `loki deploy` (original design: advisory print-only; `--execute` now exists)
 
-**Feature:** `loki deploy` -- detect project type + the user's installed cloud CLI,
-PRINT (and best-effort copy) the canonical deploy command(s), and **never run them**.
+**Current behavior (v11.7.0).** `loki deploy` still prints the deploy command by default and
+runs nothing. Loki deploys only behind `--execute` plus a VERIFIED, HEAD-anchored receipt, a
+clean tree, a destructive-op refusal and a policy permission (`.loki/policies.json`
+`autonomy: operate`, or an explicit `actions.deploy` allow). With `--health-url URL` it probes the
+deployed URL after the command. A non-2xx result is recorded as FAILED_HEALTH and exits non-zero;
+with `--auto-rollback` it also runs the provider's documented rollback verb (`vercel rollback`,
+`fly releases rollback <captured version>`; Netlify and Cloudflare print a manual note). With no
+URL, health is recorded as "unchecked", never healthy. The deploy record lives in `.loki/deploys`
+and is not part of the signed receipt. `loki start --deploy [--health-url U] [--auto-rollback]`
+chains the same gated command after a start. Not built: canary or staged rollout, and receipt-bound deploy records.
+
+Everything below is the original print-only design plan and is kept for history.
 
 **Status:** Architecture plan. No implementation code here. Pattern family: the just-shipped
 `loki preview --public` (`_preview_public` at `autonomy/loki:5306`, helpers from `_read_app_state`
 at `:5216`, arg parsing in `cmd_preview` at `:5546`-`:5609`, dispatch arm `preview)` at `:14966`).
 
-**Why this exists / why it is safe.** README states (line 447) *"Does not deploy -- human runs
-deploy commands"* and (line 452) *"It does NOT access your cloud accounts ... Human oversight is
-expected for deployment."* This feature keeps that literally true: it is an **advisory printer**.
-It runs `command -v <cli>` ONLY (never the CLI itself, not even `--version`), prints the exact
-command, and the **human runs it**. Fully reversible; touches no cloud account.
+**Why the original design was print-only.** The README then stated that deploy commands were run by
+a human and that Loki did not access cloud accounts. The first version was an **advisory printer**:
+it ran `command -v <cli>` ONLY (never the CLI itself, not even `--version`), printed the exact
+command, and the **human ran it**. Fully reversible; touched no cloud account.
 
 ---
 

package/docs/EVALUATING.md

@@ -211,6 +211,12 @@ Not measured: human effort, recovery success, review quality. Output: `--out-dir
 
 ---
 
+## 9. Factory-vs-Loki task set (reproducible, partly unmeasured)
+
+`benchmarks/attribution/tasks/coord-1-api-web/` (multi-repo coordination) and `benchmarks/attribution/tasks/longspec-1-three-units/` (long spec, three units) ship with held-out acceptance kept outside the workspace. `benchmarks/bench/attribution.py` has three arms: `raw_claude`, `loki` and an optional `droid` arm. The droid arm probes `droid exec --help`; when `droid exec` is unavailable every droid cell is recorded UNMEASURED with a reason, never zero. `python3 benchmarks/bench/attribution.py --dry-run` lists the tasks and arms and makes no model call. No Factory result is published: Factory publishes no Missions benchmark and no droid run has been measured here. Axis where Loki is ahead on documented features: offline-recheckable signed receipts, now composite receipts for multi-repo change sets; Factory documents none.
+
+---
+
 ## What we do not have
 
 Stating this plainly, because you will find it out anyway and it is cheaper for
@@ -228,6 +234,8 @@ both of us if you find it here.
   Replit Agent ship no local CLI and are not covered at all. Treat this as
   "unclaimed on every surface we can reach", which is stronger than the earlier
   "unclaimed as far as we can verify" and still short of a proven first.
+- **No scale measurement for multi-repo runs.** No test covers dozens of repos, so none is claimed.
+- **No Factory comparison run.** The droid arm is UNMEASURED until a run exists (section 9).
 - **Generation is not air-gapped.** See section 2.
 
 ---

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 Loki Mode, by [Autonomi](https://www.autonomi.dev/), turns a spec or an issue into a verified pull request with a receipt you can check. This page covers installing it, a first run, and the options around it.
 
-**Version:** v11.5.1
+**Version:** v11.7.1
 
 **Engine note:** `loki start` is the primary command. `loki start`, `loki "<task>"`, `loki owner/repo#N` and `loki quick` all run the Loki 10 engine, whatever the flag order or input form (PRD file, issue ref, task or one-word brief). The previous loop runs only on `--engine legacy`, `LOKI_ENGINE=legacy`, or for one call when a flag Loki 10 cannot honor is present. See the [user guide](v10/GUIDE.md) and the [5-minute quickstart](QUICKSTART.md).
 

package/docs/WORKSPACES.md

@@ -10,9 +10,13 @@ workspaces:
     repos:
       - {repo: acme/api, path: ~/src/api, setup: "npm ci"}
       - {repo: acme/web, path: ~/src/web, after: [acme/api]}
-    integration: {command: "make e2e", timeout_s: 900}
+    integration: {command: "make e2e", timeout_s: 900, per_stage: false}
+    concurrency: 2
+    plan: false
 ```
 
+The `workspaces:` block is validated and fails closed: a misspelled key (for example `afer`) or a wrong type exits 2 and names the key.
+
 Repos with no pending `after` run in parallel, at most `concurrency` at a time (default 2; set `LOKI_WORKSPACE_CONCURRENCY` to change it).
 
 Then:
@@ -21,6 +25,8 @@ Then:
 loki workspace list
 loki workspace show shop
 loki workspace run shop acme/api#12
+loki start --workspace shop "<brief>"   # same runner, from the primary command
+loki workspace infer shop        # print suggested after: edges
 loki workspace status            # every recorded run, one row per repo
 loki workspace status <run-id>
 ```
@@ -30,7 +36,10 @@ loki workspace status <run-id>
 - A failing repo does not stop the others (continue and report). The command exits 0 only when every repo succeeded and the integration step did not fail. It exits 3 when the only non-ok outcomes are budget stops (a child exited 3, or a dependent was skipped behind one), and 1 for any other failure. Ctrl-C (SIGINT) stops the recorded child process groups like SIGTERM.
 - The repo that owns the issue ref gets the ref; other repos get a task text naming the ref and the sibling worktree paths as read-only context.
 - After all repos finish, the `integration` command runs once from the run directory with `LOKI_WS_DIR_<OWNER>_<REPO>` pointing at each worktree. A timeout counts as failed. With no integration configured the status is `not_configured`.
-- Evidence is written to `.loki/workspaces/<name>/<run-id>/integration.json`: head SHA per repo, exit code, log sha256. It is not part of the Seal.
+- Evidence is written to `.loki/workspaces/<name>/<run-id>/integration.json`: head SHA per repo, exit code, log sha256. When every repo succeeded, integration did not fail and every child sealed a receipt, the run also seals a signed `composite.json` that binds integration.json and every child receipt (see "Verify a workspace run").
+- `loki workspace infer <name>` prints suggested `after:` edges read from package.json, go.mod and pyproject.toml dependencies on other listed repos. It is print-only and cycle-checked; it never edits loki.yaml. Manifests only: no OpenAPI or import inference.
+- `plan: true` (or `LOKI_WORKSPACE_PLAN=1`) makes one provider call that decomposes the brief per repo into `<run-dir>/plan.json`. A valid plan gives each listed repo its own task; an invalid one falls back to the generic text and prints the reason.
+- `integration: {per_stage: true}` also runs the integration command after each topological layer. A failing stage SKIPs every later layer, so a broken contract stops before downstream repos build on it.
 - Without `path`, a repo is cloned to `~/.loki/repos/owner__name`.
 - After the integration step, a PR comment is posted on each repo PR that exists for its run branch, showing the integration status (PASSED, FAILED, TIMEOUT or NOT CONFIGURED) and every head SHA. It uses your own `gh` login or GH_TOKEN, skips silently when there is no PR, never fails the run, and is disabled with `LOKI_WORKSPACE_COMMENT=0`.
 - Metrics: each run records `timing` (per repo `started_at` and `finished_at`, epoch seconds) in integration.json. `python3 autonomy/lib/workspace_metrics.py <run-dir> --attention-min 30` prints `prs` (repos with outcome ok), `wall_clock_seconds` (earliest start to latest finish), `prs_per_hour` and `prs_per_attention_minute`. Runs recorded before timing existed, and any run where `--attention-min` is not given, print `unmeasured` for the affected rate, never zero.
@@ -46,5 +55,9 @@ After `loki workspace run <name> <ref>` finishes, check the evidence rather than
 3. `.loki/workspaces/<name>/<run-id>/integration.json` holds `status`, the head SHA per repo and `timing`.
 4. `python3 autonomy/lib/workspace_metrics.py <run-dir> --attention-min <minutes>` prints `prs`, `prs_per_hour` and `prs_per_attention_minute`; any value it cannot measure prints `unmeasured`.
 5. Each repo PR for the run branch carries exactly one integration comment.
+6. `loki verify <run-dir>/composite.json` re-checks the composite offline (add `--pubkey FILE` on another machine). It recomputes the composite hash, re-verifies every child receipt from disk and checks the signature. A tampered, swapped or stale-head child makes it TAMPERED or UNCHECKED; an unsigned child under a signed composite is UNCHECKED. Exit codes are the single-receipt ones: 0 VERIFIED, 1 TAMPERED, 2 UNCHECKED, 3 UNSIGNED. The composite never reads higher than its weakest child: one PARTIAL child caps it at PARTIAL.
+7. A run that could not seal prints `composite not sealed: <reason>` (for example a repo with no receipt). Seal by hand with `loki verify --seal-composite <run-dir>`; it refuses unless every child has a receipt.
+
+Not measured: no scale test exists for large repo counts. Claim only what you have run.
 
 `tests/workspace/99-e2e.sh` runs this whole check through both `autonomy/loki` and `bin/loki` with a stub launcher and a stub `gh`.