loki-mode 11.6.0 → 11.7.1

package/autonomy/trigger-server.py

@@ -26,6 +26,12 @@ GitHub, the bearer token authenticates a human operator -- so holding one must
 never grant the other. If no API token is configured the server still starts but
 every /jobs request is rejected with 503 and an audit log line.
 
+Self-healing entry point: POST /sentry accepts a Sentry integration webhook
+authenticated by Sentry's own HMAC (sentry-hook-signature) under a THIRD,
+separate secret (LOKI_SENTRY_WEBHOOK_SECRET or SENTRY_CLIENT_SECRET). A valid
+alert enqueues `loki start "<normalized brief>" --pr --detach`: the output is a
+receipt-gated PR only, never a deploy. No secret means the route answers 503.
+
 Usage:
     python3 autonomy/trigger-server.py [--port PORT] [--secret SECRET] [--dry-run]
                                        [--workers N] [--queue-size N]
@@ -398,6 +404,21 @@ OUTCOME_FAILED = JOB_STATUS_FAILED    # launch failed, or exited non-zero
 OUTCOME_UNKNOWN = JOB_STATUS_UNKNOWN  # detached; exit code never observed
 
 
+# Secrets this server holds that a spawned `loki start` must never inherit: a
+# prompt-injected run could otherwise forge /sentry, /webhook or /jobs requests.
+CHILD_ENV_DENYLIST = (
+    "GITHUB_WEBHOOK_SECRET",
+    "LOKI_API_TOKEN",
+    "LOKI_API_TOKEN_FILE",
+    "LOKI_SENTRY_WEBHOOK_SECRET",
+    "SENTRY_CLIENT_SECRET",
+)
+
+
+def _scoped_child_env():
+    return {k: v for k, v in os.environ.items() if k not in CHILD_ENV_DENYLIST}
+
+
 def run_loki_outcome(args, dry_run=False):
     """Run a loki command and report WHICH of the three outcomes occurred.
 
@@ -414,6 +435,7 @@ def run_loki_outcome(args, dry_run=False):
             cmd,
             stdout=subprocess.PIPE,
             stderr=subprocess.PIPE,
+            env=_scoped_child_env(),
         )
     except (FileNotFoundError, OSError) as e:
         logging.error("Failed to launch %s: %s", " ".join(cmd), e)
@@ -577,6 +599,104 @@ def handle_job_event(payload, dry_run=False):
     return summary, status
 
 
+# Pseudo-event for a Sentry alert. Like JOB_EVENT it is NOT a GitHub event and is
+# refused on /webhook: only /sentry, under its own HMAC secret, may enqueue it.
+SENTRY_EVENT = "sentry_issue"
+INTERNAL_EVENTS = (JOB_EVENT, SENTRY_EVENT)
+
+# Sentry actions that mean "a new problem needs a fix". resolved/assigned/etc.
+# are skipped so a state change never starts a build.
+SENTRY_ACTIONS = ("triggered", "created")
+SENTRY_BRIEF_MAX = 1500
+ISSUE_PROVIDERS_SH = Path(__file__).resolve().parent / "issue-providers.sh"
+
+
+def validate_sentry_signature(secret, body, signature_header):
+    """Validate Sentry's `sentry-hook-signature` (hex HMAC-SHA256, no prefix).
+
+    Fails closed: no secret or no header is never valid.
+    """
+    if not secret or not signature_header:
+        return False
+    expected = hmac.new(secret.encode("utf-8"), body, hashlib.sha256).hexdigest()
+    return constant_time_equals(expected, signature_header.strip().lower())
+
+
+def normalize_sentry_payload(payload):
+    """Run the existing normalize_sentry_json over a Sentry webhook payload.
+
+    Reuses autonomy/issue-providers.sh (single owner of the Sentry shape) via a
+    scoped-env bash call. Returns the normalized dict or None.
+    """
+    data = payload.get("data")
+    if not isinstance(data, dict):
+        return None
+    raw = {k: data[k] for k in ("issue", "event") if isinstance(data.get(k), dict)}
+    if not raw:
+        return None
+    env = {"PATH": os.environ.get("PATH", "/usr/bin:/bin")}
+    ev = raw.get("event") or {}
+    env["_LOKI_SENTRY_URL"] = str(ev.get("web_url") or ev.get("url") or "")
+    try:
+        proc = subprocess.run(
+            ["bash", "-c", 'source "$1" && normalize_sentry_json', "_",
+             str(ISSUE_PROVIDERS_SH)],
+            input=json.dumps(raw).encode("utf-8"), capture_output=True,
+            env=env, timeout=20,
+        )
+    except (OSError, subprocess.SubprocessError):
+        return None
+    if proc.returncode != 0:
+        return None
+    try:
+        out = json.loads(proc.stdout.decode("utf-8", errors="replace").strip().splitlines()[-1])
+    except (ValueError, IndexError):
+        return None
+    return out if isinstance(out, dict) else None
+
+
+def build_sentry_brief(norm):
+    """One-line, control-char-free brief that can never parse as a CLI flag."""
+    culprit = ""
+    for line in str(norm.get("body", "")).splitlines():
+        if line.startswith("- Culprit: "):
+            culprit = line[len("- Culprit: "):].strip()
+            break
+    parts = ["Fix Sentry issue %s: %s" % (norm.get("number", "?"), norm.get("title", ""))]
+    if culprit:
+        parts.append("(culprit %s)" % culprit)
+    if norm.get("url"):
+        parts.append("See %s." % norm["url"])
+    parts.append("Reproduce with a regression test, then fix the root cause.")
+    brief = CONTROL_CHARS_RE.sub(" ", " ".join(parts))
+    brief = " ".join(brief.split())
+    return brief.encode("utf-8")[:SENTRY_BRIEF_MAX].decode("utf-8", errors="ignore")
+
+
+def handle_sentry_event(payload, dry_run=False):
+    """Handle a verified Sentry alert: loki start <brief> --pr --detach.
+
+    PR only. Never passes a deploy argument: a fix still has to earn a VERIFIED
+    receipt, and shipping it stays a separate, gated human step.
+    """
+    action = payload.get("action", "")
+    if action not in SENTRY_ACTIONS:
+        return None, "skipped (action=%s)" % action
+    norm = normalize_sentry_payload(payload)
+    if norm is None:
+        return None, "rejected (unparseable sentry payload)"
+    brief = build_sentry_brief(norm)
+    if not valid_spec(brief):
+        return None, "rejected (invalid brief)"
+    args = ["start", brief, "--pr", "--detach"]
+    summary = "sentry issue %s" % norm.get("number", "?")
+    success = run_loki_command(args, dry_run=dry_run)
+    status = "fired" if success else "error"
+    if success:
+        send_notification("Trigger fired: %s" % summary)
+    return summary, status
+
+
 # Map event name -> handler. Keeps do_POST routing declarative. JOB_EVENT rides
 # the same table (and therefore the same bounded queue and worker pool) but is
 # explicitly refused on the /webhook path.
@@ -585,6 +705,7 @@ EVENT_HANDLERS = {
     "pull_request": handle_pull_request_event,
     "workflow_run": handle_workflow_run_event,
     JOB_EVENT: handle_job_event,
+    SENTRY_EVENT: handle_sentry_event,
 }
 
 
@@ -875,6 +996,8 @@ class WebhookHandler(http.server.BaseHTTPRequestHandler):
     # Bearer token for the /jobs API. MUST be a different secret from `secret`
     # above: one authenticates GitHub, the other authenticates a human.
     api_token = ""
+    # Sentry integration client secret for /sentry. Distinct from both above.
+    sentry_secret = ""
     dispatcher = None
     # Ed25519 key that attests receipts, and the retired public keys that keep
     # pre-rotation receipts verifiable. Both default to unconfigured, which
@@ -1179,11 +1302,51 @@ class WebhookHandler(http.server.BaseHTTPRequestHandler):
         log_event(JOB_EVENT, "", job["spec"], "queued")
         self._send_json(202, {"id": job_id, "status": "queued"})
 
+    def _handle_sentry(self):
+        """POST /sentry -- Sentry alert, HMAC-verified, enqueues a fix run."""
+        body = self._read_body()
+        if body is None:
+            return
+        event_type = SENTRY_EVENT
+        if not self.sentry_secret:
+            logging.warning("Rejecting /sentry from %s: no Sentry secret configured",
+                            self.address_string())
+            log_event(event_type, "", "", "rejected (no sentry secret configured)")
+            self._send_json(503, {"error": "sentry webhook secret not configured"})
+            return
+        sig = self.headers.get("sentry-hook-signature", "")
+        if not validate_sentry_signature(self.sentry_secret, body, sig):
+            logging.warning("Invalid Sentry signature from %s", self.address_string())
+            log_event(event_type, "", "", "rejected (invalid signature)")
+            self._send_json(401, {"error": "invalid signature"})
+            return
+        try:
+            payload = json.loads(body)
+        except json.JSONDecodeError:
+            self._send_json(400, {"error": "invalid JSON"})
+            return
+        if not isinstance(payload, dict):
+            self._send_json(400, {"error": "payload must be a JSON object"})
+            return
+        action = payload.get("action", "")
+        if self.dispatcher.seen_delivery(self.headers.get("Request-ID", "")):
+            log_event(event_type, action, "", "duplicate")
+            self._send_json(200, {"event": event_type, "status": "duplicate"})
+            return
+        if not self.dispatcher.submit(event_type, payload):
+            log_event(event_type, action, "", "rejected (queue full)")
+            self._send_json(503, {"error": "server busy, retry later"})
+            return
+        self._send_json(202, {"event": event_type, "action": action, "status": "queued"})
+
     def do_POST(self):
         path = self.path.split("?", 1)[0]
         if path == "/jobs":
             self._handle_job_submit()
             return
+        if path == "/sentry":
+            self._handle_sentry()
+            return
         if path != "/webhook":
             self._send_json(404, {"error": "not found"})
             return
@@ -1201,10 +1364,10 @@ class WebhookHandler(http.server.BaseHTTPRequestHandler):
         # never be reachable with the webhook HMAC. Without this, a holder of
         # the webhook secret could POST X-GitHub-Event: loki_job and submit an
         # arbitrary spec, defeating the separate-credential requirement.
-        if event_type == JOB_EVENT:
+        if event_type in INTERNAL_EVENTS:
             logging.warning(
                 "Rejecting %s on /webhook from %s: submits require the /jobs "
-                "API and its own bearer token",
+                "API and its own bearer token (Sentry uses /sentry)",
                 JOB_EVENT,
                 self.address_string(),
             )
@@ -1350,6 +1513,20 @@ def main():
         )
         api_token = ""
 
+    # Sentry secret: env only (never argv). Must differ from the other two
+    # credentials, since each authenticates a different party.
+    sentry_secret = (os.environ.get("LOKI_SENTRY_WEBHOOK_SECRET")
+                     or os.environ.get("SENTRY_CLIENT_SECRET") or "")
+    if sentry_secret and (
+        (secret and constant_time_equals(sentry_secret, secret))
+        or (api_token and constant_time_equals(sentry_secret, api_token))
+    ):
+        logging.error(
+            "The Sentry secret is identical to the webhook secret or API "
+            "token. They MUST differ; disabling /sentry."
+        )
+        sentry_secret = ""
+
     # Persist resolved values, but never write the secret to disk.
     config["port"] = port
     config["dry_run"] = dry_run
@@ -1363,6 +1540,7 @@ def main():
     WebhookHandler.dry_run = dry_run
     WebhookHandler.secret = secret
     WebhookHandler.api_token = api_token
+    WebhookHandler.sentry_secret = sentry_secret
     WebhookHandler.dispatcher = dispatcher
 
     signing_key, signing_kid = load_signing_key(auto_generate=False)
@@ -1404,6 +1582,11 @@ def main():
             "503. Set LOKI_API_TOKEN or LOKI_API_TOKEN_FILE to enable remote "
             "submits."
         )
+    if not sentry_secret:
+        logging.warning(
+            "No Sentry secret configured: POST /sentry is rejected with 503. "
+            "Set LOKI_SENTRY_WEBHOOK_SECRET or SENTRY_CLIENT_SECRET."
+        )
     if not secret:
         logging.warning(
             "No webhook secret configured: ALL webhooks will be rejected with "

package/autonomy/verify.sh

@@ -2584,6 +2584,10 @@ OPTIONS:
                        is exactly as without --hosted (fail-open, never a silent
                        pass). Without --hosted, output is byte-identical to prior
                        releases.
+    --seal-composite <run-dir>
+                       Seal a workspace run into one signed composite receipt
+                       (composite.json). `loki verify <composite.json>` then
+                       re-checks it offline. Routed to the engine10 verifier.
     -h, --help         Show this help.
 
 GATES (deterministic, reproducible by construction):

package/completions/_loki

@@ -313,6 +313,10 @@ function _loki_start {
     _arguments \
         '--provider[AI provider]:provider name:(claude cline codex aider opencode)' \
         '--parallel[Parallel mode]' \
+        '--workspace[Run a loki.yaml workspace for the brief]:workspace name:' \
+        '--deploy[Deploy after a VERIFIED run via loki deploy --execute]' \
+        '--health-url[With --deploy: health probe URL]:url:' \
+        '--auto-rollback[With --deploy: roll back on a failed health probe]' \
         '--background[Background mode]' \
         '--bg[Background mode]' \
         '--simple[Force simple complexity]' \

package/completions/loki.bash

@@ -27,7 +27,7 @@ _loki_completion() {
 
             # If the word starts with a dash, show flags
             if [[ "$cur" == -* ]]; then
-                local flags="--provider --max-iterations --parallel --background --bg --simple --complex --github --no-dashboard --sandbox --skip-memory --spec --spec-first --yes --budget --attempts --model --isolation --max-cost --no-pr --explain-route --help"
+                local flags="--provider --max-iterations --parallel --background --bg --simple --complex --github --no-dashboard --sandbox --skip-memory --spec --spec-first --yes --budget --attempts --model --isolation --max-cost --no-pr --explain-route --workspace --deploy --health-url --auto-rollback --help"
                 COMPREPLY=( $(compgen -W "${flags}" -- "$cur") )
                 return 0
             fi
@@ -57,7 +57,11 @@ _loki_completion() {
             ;;
 
         memory)
-            local memory_cmds="list show search stats export clear dedupe index timeline consolidate economics retrieve lessons learn forget episode pattern skill vectors help"
+            local memory_cmds="list show search stats export clear dedupe index timeline consolidate economics retrieve lessons learn forget episode pattern skill vectors brief help"
+            if [[ "$cur" == -* ]]; then
+                COMPREPLY=( $(compgen -W "--task --help" -- "$cur") )
+                return 0
+            fi
             COMPREPLY=( $(compgen -W "${memory_cmds}" -- "$cur") )
             ;;
 
@@ -136,6 +140,20 @@ _loki_completion() {
             fi
             ;;
 
+        deploy)
+            if [[ "$cur" == -* ]]; then
+                COMPREPLY=( $(compgen -W "--execute --health-url --auto-rollback --help" -- "$cur") )
+                return 0
+            fi
+            ;;
+
+        verify)
+            if [[ "$cur" == -* ]]; then
+                COMPREPLY=( $(compgen -W "--base --out --block-on --no-llm --json --explain --check-fresh --hosted --seal-composite --help" -- "$cur") )
+                return 0
+            fi
+            ;;
+
         chat)
             if [[ "$cur" == -* ]]; then
                 COMPREPLY=( $(compgen -W "--attach --tui --help" -- "$cur") )

package/dashboard/__init__.py

@@ -7,6 +7,6 @@ Modules:
     control: Session control helpers (status, atomic writes, origin check)
 """
 
-__version__ = "11.6.0"
+__version__ = "11.7.1"
 
 __all__ = ["__version__"]

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.6.0. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.7.1. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
 
 | Command | Description |
@@ -19,6 +19,7 @@ Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for th
 | `loki memory index` | Show or rebuild the memory index |
 | `loki memory learn` | Learn lessons from a merged PR's review comments |
 | `loki memory lessons` | List PR review lessons with uses and outcomes |
+| `loki memory brief` | Print the lessons and learnings block an engine10 run injects |
 | `loki memory show` | Show one learning |
 | `loki memory search` | Search learnings |
 | `loki memory stats` | Memory statistics |

package/docs/DEPLOY-PLAN.md

@@ -1,17 +1,26 @@
-# DEPLOY-PLAN.md -- `loki deploy` (ADVISORY / PRINT-ONLY)
+# DEPLOY-PLAN.md -- `loki deploy` (original design: advisory print-only; `--execute` now exists)
 
-**Feature:** `loki deploy` -- detect project type + the user's installed cloud CLI,
-PRINT (and best-effort copy) the canonical deploy command(s), and **never run them**.
+**Current behavior (v11.7.0).** `loki deploy` still prints the deploy command by default and
+runs nothing. Loki deploys only behind `--execute` plus a VERIFIED, HEAD-anchored receipt, a
+clean tree, a destructive-op refusal and a policy permission (`.loki/policies.json`
+`autonomy: operate`, or an explicit `actions.deploy` allow). With `--health-url URL` it probes the
+deployed URL after the command. A non-2xx result is recorded as FAILED_HEALTH and exits non-zero;
+with `--auto-rollback` it also runs the provider's documented rollback verb (`vercel rollback`,
+`fly releases rollback <captured version>`; Netlify and Cloudflare print a manual note). With no
+URL, health is recorded as "unchecked", never healthy. The deploy record lives in `.loki/deploys`
+and is not part of the signed receipt. `loki start --deploy [--health-url U] [--auto-rollback]`
+chains the same gated command after a start. Not built: canary or staged rollout, and receipt-bound deploy records.
+
+Everything below is the original print-only design plan and is kept for history.
 
 **Status:** Architecture plan. No implementation code here. Pattern family: the just-shipped
 `loki preview --public` (`_preview_public` at `autonomy/loki:5306`, helpers from `_read_app_state`
 at `:5216`, arg parsing in `cmd_preview` at `:5546`-`:5609`, dispatch arm `preview)` at `:14966`).
 
-**Why this exists / why it is safe.** README states (line 447) *"Does not deploy -- human runs
-deploy commands"* and (line 452) *"It does NOT access your cloud accounts ... Human oversight is
-expected for deployment."* This feature keeps that literally true: it is an **advisory printer**.
-It runs `command -v <cli>` ONLY (never the CLI itself, not even `--version`), prints the exact
-command, and the **human runs it**. Fully reversible; touches no cloud account.
+**Why the original design was print-only.** The README then stated that deploy commands were run by
+a human and that Loki did not access cloud accounts. The first version was an **advisory printer**:
+it ran `command -v <cli>` ONLY (never the CLI itself, not even `--version`), printed the exact
+command, and the **human ran it**. Fully reversible; touched no cloud account.
 
 ---
 

package/docs/EVALUATING.md

@@ -211,6 +211,12 @@ Not measured: human effort, recovery success, review quality. Output: `--out-dir
 
 ---
 
+## 9. Factory-vs-Loki task set (reproducible, partly unmeasured)
+
+`benchmarks/attribution/tasks/coord-1-api-web/` (multi-repo coordination) and `benchmarks/attribution/tasks/longspec-1-three-units/` (long spec, three units) ship with held-out acceptance kept outside the workspace. `benchmarks/bench/attribution.py` has three arms: `raw_claude`, `loki` and an optional `droid` arm. The droid arm probes `droid exec --help`; when `droid exec` is unavailable every droid cell is recorded UNMEASURED with a reason, never zero. `python3 benchmarks/bench/attribution.py --dry-run` lists the tasks and arms and makes no model call. No Factory result is published: Factory publishes no Missions benchmark and no droid run has been measured here. Axis where Loki is ahead on documented features: offline-recheckable signed receipts, now composite receipts for multi-repo change sets; Factory documents none.
+
+---
+
 ## What we do not have
 
 Stating this plainly, because you will find it out anyway and it is cheaper for
@@ -228,6 +234,8 @@ both of us if you find it here.
   Replit Agent ship no local CLI and are not covered at all. Treat this as
   "unclaimed on every surface we can reach", which is stronger than the earlier
   "unclaimed as far as we can verify" and still short of a proven first.
+- **No scale measurement for multi-repo runs.** No test covers dozens of repos, so none is claimed.
+- **No Factory comparison run.** The droid arm is UNMEASURED until a run exists (section 9).
 - **Generation is not air-gapped.** See section 2.
 
 ---

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 Loki Mode, by [Autonomi](https://www.autonomi.dev/), turns a spec or an issue into a verified pull request with a receipt you can check. This page covers installing it, a first run, and the options around it.
 
-**Version:** v11.6.0
+**Version:** v11.7.1
 
 **Engine note:** `loki start` is the primary command. `loki start`, `loki "<task>"`, `loki owner/repo#N` and `loki quick` all run the Loki 10 engine, whatever the flag order or input form (PRD file, issue ref, task or one-word brief). The previous loop runs only on `--engine legacy`, `LOKI_ENGINE=legacy`, or for one call when a flag Loki 10 cannot honor is present. See the [user guide](v10/GUIDE.md) and the [5-minute quickstart](QUICKSTART.md).
 

package/docs/WORKSPACES.md

@@ -10,9 +10,13 @@ workspaces:
     repos:
       - {repo: acme/api, path: ~/src/api, setup: "npm ci"}
       - {repo: acme/web, path: ~/src/web, after: [acme/api]}
-    integration: {command: "make e2e", timeout_s: 900}
+    integration: {command: "make e2e", timeout_s: 900, per_stage: false}
+    concurrency: 2
+    plan: false
 ```
 
+The `workspaces:` block is validated and fails closed: a misspelled key (for example `afer`) or a wrong type exits 2 and names the key.
+
 Repos with no pending `after` run in parallel, at most `concurrency` at a time (default 2; set `LOKI_WORKSPACE_CONCURRENCY` to change it).
 
 Then:
@@ -21,6 +25,8 @@ Then:
 loki workspace list
 loki workspace show shop
 loki workspace run shop acme/api#12
+loki start --workspace shop "<brief>"   # same runner, from the primary command
+loki workspace infer shop        # print suggested after: edges
 loki workspace status            # every recorded run, one row per repo
 loki workspace status <run-id>
 ```
@@ -30,7 +36,10 @@ loki workspace status <run-id>
 - A failing repo does not stop the others (continue and report). The command exits 0 only when every repo succeeded and the integration step did not fail. It exits 3 when the only non-ok outcomes are budget stops (a child exited 3, or a dependent was skipped behind one), and 1 for any other failure. Ctrl-C (SIGINT) stops the recorded child process groups like SIGTERM.
 - The repo that owns the issue ref gets the ref; other repos get a task text naming the ref and the sibling worktree paths as read-only context.
 - After all repos finish, the `integration` command runs once from the run directory with `LOKI_WS_DIR_<OWNER>_<REPO>` pointing at each worktree. A timeout counts as failed. With no integration configured the status is `not_configured`.
-- Evidence is written to `.loki/workspaces/<name>/<run-id>/integration.json`: head SHA per repo, exit code, log sha256. It is not part of the Seal.
+- Evidence is written to `.loki/workspaces/<name>/<run-id>/integration.json`: head SHA per repo, exit code, log sha256. When every repo succeeded, integration did not fail and every child sealed a receipt, the run also seals a signed `composite.json` that binds integration.json and every child receipt (see "Verify a workspace run").
+- `loki workspace infer <name>` prints suggested `after:` edges read from package.json, go.mod and pyproject.toml dependencies on other listed repos. It is print-only and cycle-checked; it never edits loki.yaml. Manifests only: no OpenAPI or import inference.
+- `plan: true` (or `LOKI_WORKSPACE_PLAN=1`) makes one provider call that decomposes the brief per repo into `<run-dir>/plan.json`. A valid plan gives each listed repo its own task; an invalid one falls back to the generic text and prints the reason.
+- `integration: {per_stage: true}` also runs the integration command after each topological layer. A failing stage SKIPs every later layer, so a broken contract stops before downstream repos build on it.
 - Without `path`, a repo is cloned to `~/.loki/repos/owner__name`.
 - After the integration step, a PR comment is posted on each repo PR that exists for its run branch, showing the integration status (PASSED, FAILED, TIMEOUT or NOT CONFIGURED) and every head SHA. It uses your own `gh` login or GH_TOKEN, skips silently when there is no PR, never fails the run, and is disabled with `LOKI_WORKSPACE_COMMENT=0`.
 - Metrics: each run records `timing` (per repo `started_at` and `finished_at`, epoch seconds) in integration.json. `python3 autonomy/lib/workspace_metrics.py <run-dir> --attention-min 30` prints `prs` (repos with outcome ok), `wall_clock_seconds` (earliest start to latest finish), `prs_per_hour` and `prs_per_attention_minute`. Runs recorded before timing existed, and any run where `--attention-min` is not given, print `unmeasured` for the affected rate, never zero.
@@ -46,5 +55,9 @@ After `loki workspace run <name> <ref>` finishes, check the evidence rather than
 3. `.loki/workspaces/<name>/<run-id>/integration.json` holds `status`, the head SHA per repo and `timing`.
 4. `python3 autonomy/lib/workspace_metrics.py <run-dir> --attention-min <minutes>` prints `prs`, `prs_per_hour` and `prs_per_attention_minute`; any value it cannot measure prints `unmeasured`.
 5. Each repo PR for the run branch carries exactly one integration comment.
+6. `loki verify <run-dir>/composite.json` re-checks the composite offline (add `--pubkey FILE` on another machine). It recomputes the composite hash, re-verifies every child receipt from disk and checks the signature. A tampered, swapped or stale-head child makes it TAMPERED or UNCHECKED; an unsigned child under a signed composite is UNCHECKED. Exit codes are the single-receipt ones: 0 VERIFIED, 1 TAMPERED, 2 UNCHECKED, 3 UNSIGNED. The composite never reads higher than its weakest child: one PARTIAL child caps it at PARTIAL.
+7. A run that could not seal prints `composite not sealed: <reason>` (for example a repo with no receipt). Seal by hand with `loki verify --seal-composite <run-dir>`; it refuses unless every child has a receipt.
+
+Not measured: no scale test exists for large repo counts. Claim only what you have run.
 
 `tests/workspace/99-e2e.sh` runs this whole check through both `autonomy/loki` and `bin/loki` with a stub launcher and a stub `gh`.

package/docs/dev/architecture-reference.md

@@ -105,3 +105,11 @@ These knobs together implement the RARV-C (closure) loop: findings -> override c
 ## Project memory across runs
 
 extract_learnings_from_session (autonomy/run.sh) mirrors learnings and decisions into .loki/memory/learnings/project-*.jsonl. get_relevant_learnings adds a bounded newest-first project_memory list (15 entries, LOKI_PROJECT_MEMORY_MAX_CHARS, default 2000) to .loki/state/relevant-learnings.json at run start. LOKI_PROJECT_MEMORY=0 disables both. Test: tests/test-project-memory.sh.
+
+## Verdicts, composite receipts and the autonomy ladder (v11.7.0)
+- Two sets: receipt verdicts (`engine10/types.ts` Verdict: VERIFIED, PARTIAL, ALREADY_SATISFIED, SPEC_CONFLICT, FAILED) and run outcomes (`engine10/output.ts` Outcome adds BUDGET_STOP, BLOCKED, STALLED, CANCELLED; exit ladder EXIT). Only receipt verdicts are sealed.
+- Composite: `features/speed/seal_group.ts` composeComposite/verifyComposite (schema `loki.v10.composite/1`), sealed by `loki verify --seal-composite <run_dir>`, signed with the existing `signReceipt`, capped by `capGroupVerdict`. Workspace runs seal it after integration.json.
+- Autonomy ladder: `src/policies/engine.js` allowedActions(level) (propose = none, execute = pr, operate = pr + deploy; merge never). engine10 `supervisor.ts` prGate consults `src/policies/check.js`; `loki deploy --execute` consults it for `deploy` and fails closed. `loki trust` graduationAdvice is advisory and never writes the policy file.
+- Parallel units: `route.ts` maybeRunGroup defaults to `features/speed/run_group.ts`, which freezes per-unit acceptance (`features/contract.ts`), runs units, merges with `engine10/integrate.ts` and seals once via sealGroup.
+- Lessons: every sealed run appends a receipt fact (`LOKI_AUTO_LEARN_PR`, default on) outside the receipt body; `implement.ts` injects lessons and relevant learnings inside the untrusted-data fence; `loki memory brief --task T` prints the same block.
+

package/docs/sentry-intake.md

@@ -11,3 +11,14 @@ From a URL (needs `SENTRY_AUTH_TOKEN`; without it nothing is fetched):
     SENTRY_AUTH_TOKEN=... loki start https://sentry.io/organizations/acme/issues/4001/
 
 The token is sent only to the Sentry host through a curl config on stdin, never on argv, and is never printed. Implementation: `autonomy/issue-providers.sh` (`normalize_sentry_json`).
+
+## Webhook: self-healing entry point
+
+`autonomy/trigger-server.py` accepts `POST /sentry`, a Sentry integration webhook authenticated by Sentry's own HMAC (`sentry-hook-signature`, hex HMAC-SHA256 of the body).
+
+1. Set the client secret: `LOKI_SENTRY_WEBHOOK_SECRET` (or `SENTRY_CLIENT_SECRET`). It must differ from the GitHub webhook secret and the API token. With no secret the route answers 503 and nothing is enqueued.
+2. Start the server: `python3 autonomy/trigger-server.py --port 8080` and point the Sentry alert webhook at `/sentry`.
+3. A valid alert is normalized with `normalize_sentry_json` and enqueues `loki start "<brief>" --pr --detach`. A bad signature gets 401.
+
+The output is a receipt-gated PR only, never a deploy. Whether the PR opens is still decided by the policy file (`autonomy`).
+

package/docs/v10/CLI-MODERN.md

@@ -11,7 +11,7 @@ Classes: KEEP-MODERN (v10-native or engine-neutral), UPDATE (live but needs mode
 - DROP-LEGACY: 32
 - DELETE: 14
 - Total rows: 137
-- Registry paths (commands and nested subcommands): 190
+- Registry paths (commands and nested subcommands): 191
 
 ## Commands