loki-mode 11.74.2 → 11.75.1

package/docs/v10/CONTROL-PLANE.md

@@ -1,120 +0,0 @@
-# Loki Control Plane (D56)
-
-Architect design, 2026-10-01, base 1dfc87103. Design only. Flag: `LOKI_CONTROL=1` until acceptance (slice CP-17).
-
-## 1. Goal
-1. One service plus one UI, `loki control`, replaces dashboard/, legacy-ui/ and engine10/dashboard. Zero config locally; deployed once for hundreds of runs.
-2. Stateless processes, all state in one DB (SQLite by default, Postgres via DATABASE_URL), self-healing, horizontally scalable on Postgres.
-3. Every number is folded from ingested run events. A panel with no data says "no data ingested", never 0.
-
-## 2. Data sources today
-| Source | Where | Status |
-|---|---|---|
-| Run event log, append-only JSONL, envelope `{v,seq,ts,run,type,stage,data}` | engine10/events.ts:11-23 (validate), :54-89 (single writer), types.ts:26-43 (26 types) | REAL. The spool. |
-| Folded run state: verdict, stages, cost (usd null when any session unpriced) | events.ts:106-140 `fold()`, :143-152 `partialCost()` | REAL. Reuse as is. |
-| Run start data: task_source, issue_ref, provider, model, deep, cap_s, branch, origin_repo | supervisor.ts:194, cli data at supervisor.ts:331-334 | REAL |
-| PR URL | `pr.opened {url,draft,existing}` supervisor.ts:233; `run.completed.pr_url` supervisor.ts:252 | REAL (opened only) |
-| PR merged, issue closed | nowhere | MISSING. No event records merge or close. |
-| Cost per session: usd, tokens, cache tokens, model, source | `cost` event session.ts:127-130 | REAL |
-| Receipt and NOT PROVEN | receipt.json, schema types.ts:139-181; `receipt.sealed {path,receipt_sha256,signed,verdict,not_proven}` stages/seal.ts:292; `run.completed.not_proven` supervisor.ts:252 | REAL |
-| Backlog queue (queued, running, BUDGET_STOP) | autonomy/lib/backlog.py:194-257, in memory only | MISSING from any durable store |
-| Workspace group state | `~/.loki/workspaces/<ws>/<group>/group.json`, docs/v10/D51-PHASE-B.md | NOT BUILT (design only) |
-| engine10 dashboard | engine10/dashboard/server.ts:30-57 (fold-based), routes :116-125 | REAL, but one repo, one process, 127.0.0.1 |
-| Python dashboard, 168 routes | dashboard/server.py (13,171 lines); cost reads `.loki/metrics/efficiency` server.py:7869 | REAL but legacy: reads run.sh state that v10 runs never write |
-| Pricing table | dashboard/server.py:7748, :8582 ("Unverified placeholder rate") | INVENTED |
-| legacy-ui /api/v2 activity, agents/leaderboard, cost/breakdown, memory/graph, pipeline/status, providers/health | legacy-ui/index.js:100-105, issue #203 | INVENTED (no server route) |
-| Secret redaction | util/redact.ts:4-14 `redactSecrets`; seal.ts:30 `sanitizeReason`; output.ts:79 Reason line | REAL. Reuse. |
-
-## 3. Data model (Drizzle, one schema for SQLite and Postgres)
-- `sources(id PK, host_hash, repo_path_hash, origin_repo, first_seen, last_seen)`. id = sha256(hostname + "\0" + realpath(repo)) truncated to 16 hex, computed by the shipper. No raw paths or hostnames stored.
-- `events(source_id, run_id, seq, PK(source_id, run_id, seq), ts, type, stage, data JSON, line_sha256, received_at)`. Index (run_id, seq), (type, ts).
-- `runs(source_id, run_id, PK(source_id, run_id), origin_repo, issue_ref, task_source, provider, model, started_at, ended_at, verdict, outcome, pr_url, pr_draft, cost_usd NULL, partial_usd, measured_sessions, total_sessions, input_tokens, output_tokens, wall_s, last_seq, last_event_at, tampered, conflict)`. A projection, rebuilt from `events` by `fold()` on every ingest batch for the touched runs; never written any other way.
-- `receipts(source_id, run_id, PK, receipt_sha256, verdict, not_proven JSON, body JSON)`.
-- `work_items(origin_repo, kind 'issue'|'pr', number, PK(origin_repo, kind, number), state, url, observed_at, run_id NULL)`. Fed only by `work.observed` events (CP-12).
-- Event id = `source_id:run_id:seq`. Same id and same line_sha256 is a no-op (idempotent retry). Same id with a different hash returns 409, sets `runs.conflict = 1` and never overwrites.
-- Derived views (SQL, not tables): in-progress = started, no run.completed, last_event_at within 10 min; stale = same but older (heartbeat lost); per-day cost; verdict counts; issue to PR join on (origin_repo, issue_ref).
-- Seal verification stays with `loki verify` on local files: the shipper redacts, so stored bytes may differ from events.jsonl.
-
-## 4. API (Hono, JSON, prefix /v1)
-- `POST /v1/ingest {source, run_id, events[]}`: at most 500 events or 1 MB, each validated with `validateEnvelope()` (events.ts:11), redacted again server-side with `redactSecrets`. Returns `{accepted, duplicate, conflict, last_seq}`.
-- `PUT /v1/runs/:source/:run/receipt`: receipt.json; 400 unless its receipt_sha256 matches a received `receipt.sealed` event.
-- Reads: `GET /v1/runs?repo=&verdict=&provider=&since=&cursor=`, `/v1/runs/:source/:run` (summary + timeline), `/v1/runs/:source/:run/events?after_seq=`, `/v1/stats`, `/v1/costs?group=day|repo|model`, `/v1/compare?ids=`, `/v1/work`, `/v1/backlog`.
-- `GET /health` (process up; `{service:"loki-control", version, install_path, pid}`, the P0-DASH-STATIC identity); `GET /ready` (DB reachable and migrations at head, else 503).
-- Auth (enforced in `src/server/auth.ts`): binds 127.0.0.1 by default. With `LOKI_CONTROL_TOKEN` set, every `/v1/*` call (ingest, reads, answer) needs `Authorization: Bearer <token>`, compared in constant time; missing or wrong gives 401. `/health` and `/ready` need no token. A non-loopback `LOKI_CONTROL_HOST` with no token exits 2 naming `LOKI_CONTROL_TOKEN` before binding; `LOKI_CONTROL_ALLOW_INSECURE_BIND=1` overrides. On a loopback bind a request whose Host is not `127.0.0.1`, `localhost` or `[::1]` (any port) gets 403, which blocks DNS rebinding. The UI takes `#token=<token>` once, keeps it in sessionStorage and sends it on every call. Ingest and read share the token in v1.
-
-## 5. Shipper and spool
-- events.jsonl is the spool. The shipper never writes to it (the supervisor treats outside writes as tamper). Its acked cursor lives in `.loki/runs/<id>/ship.json {acked_seq, url}`, written atomically.
-- Started by the supervisor next to the log (one hook line, skipped when `LOKI_CONTROL=0`; the url comes from `LOKI_CONTROL_URL` or local discovery, section 6), it uses `tail()` (events.ts:155), batches up to 200 events or 1 s, and POSTs. Backoff 1, 2, 4 ... 60 s with jitter. It never blocks or fails the run: on supervisor exit it flushes for at most 5 s, then leaves the rest for replay.
-- Every string in `data` goes through `redactSecrets` before sending.
-- Cleanup: `loki control prune --repo OWNER/NAME` and/or `--before ISO_DATE` (`--dry-run` previews) deletes matching runs, their events and orphaned sources in one transaction, direct on the SQLite file (WAL, 5 s busy timeout), so it works with the server up or down. `DELETE /v1/runs/:source/:run` (JSON content type, same-host Origin, bearer when a token is set) removes one run and writes an `audit` row first; the UI Run detail page has a Remove button with a confirm step.
-- Replay: `loki control backfill [--repo DIR]` and every `loki` start ship each run whose ship.json acked_seq is below its last seq. Backfill of old .loki/runs uses the same code path.
-
-## 6. Local discovery (on by default)
-- `LOKI_CONTROL` defaults on; `LOKI_CONTROL=0` makes `loki control` print one "off" line and exit 0, and disables discovery.
-- `loki control serve` reads the child's "listening on" line and writes `~/.loki/control/instance.json {pid, port, url, version, install_path, db}` (mode 0600), removed when the CLI exits.
-- A run ships when `LOKI_CONTROL_URL` is set, or when `instance.json` names a live pid (`kill -0`) whose `/health` answers `service=loki-control` within 300 ms (`packages/control-plane/src/shipper/discover.ts`). A run never starts a server and never kills a process it did not record.
-- The server binds loopback by default; discovery only reads the url the local serve published. The DB defaults to `~/.loki/control/control.db`. Tests always pass a temp HOME, an ephemeral port and `LOKI_NO_BROWSER=1`, and stop by recorded PID.
-
-## 7. Deploy
-- One image: `oven/bun` base, the service plus built UI assets, `bun packages/control-plane/dist/server.js`. Probes: liveness /health, readiness /ready.
-- Helm chart `deploy/helm/loki-control`: replicas 1 with SQLite on a PVC (single writer, documented); replicas N only with DATABASE_URL. Migrations run on boot under a Postgres advisory lock. No in-process pub/sub: the UI polls with a cursor, so any replica serves any request.
-- Clients set `LOKI_CONTROL_URL` and `LOKI_CONTROL_TOKEN`; containers and Helm runs of `loki start` ship the same way.
-
-## 8. Migration and deletion
-1. Build in packages/control-plane/ behind LOKI_CONTROL=1. The old UIs keep running; old-dashboard bug work is retired (D56.6).
-2. Acceptance (CP-17): real runs in, correct counts out, on SQLite and Postgres; first-run gate passes with the flag on.
-3. Flip the default. One release later, delete dashboard/, legacy-ui/, engine10/dashboard/ (and its registry.ts:19 line), `loki dashboard` becomes an alias of `loki control`, and the dashboard tests are removed (CP-18).
-
-## 9. v0 (ships in 1 to 2 hours on a D46 train)
-CP-00 corpus, then CP-01, CP-02 and CP-03 in parallel, then CP-04 to wire them: SQLite service with ingest, the shipper with backfill, and a UI with the Runs list and detail, all behind the flag.
-
-## 10. Slices
-Rules for every card: file sets do not overlap; only CP-02 touches supervisor.ts and registry.ts, only CP-04 touches autonomy/loki and root package.json. Every Wall check feeds the CP-00 corpus through the real ingest path and asserts exact counts, starting the service on an ephemeral port with a temp DB under LOKI_RUN_TMP. Any new tests/*.sh needs runner registration, a shard row, `timeout -k` and shellcheck.
-
-| ID | Scope and file set | Wall check (fixture in, counts out) | Tier | Deps |
-|---|---|---|---|---|
-| CP-00 | Corpus: events.jsonl and receipts written by the real supervisor under the engine10 e2e fake sessions (VERIFIED, PARTIAL, FAILED, BLOCKED, cap.hit, tampered, unpriced cost, resumed). `packages/control-plane/test/fixtures/runs/` + `EXPECTED.json` | EXPECTED.json counts equal a direct `fold()` over each file | LOW | none |
-| CP-01 | **Parallel A.** Service + DB: `src/server/{app,ingest,runs}.ts`, `src/db/{schema,migrate}.ts`, `drizzle/`, `package.json` | ingest corpus twice: run count, verdict counts, cost_usd (null where expected), duplicate=all on 2nd pass; changed line gives 409 | MEDIUM | CP-00 |
-| CP-02 | **Parallel B.** Shipper + backfill: `src/shipper/{ship,backfill}.ts`, hook `loki-ts/src/e10ext/ship_hook.ts`, one line each in supervisor.ts and registry.ts | backfill corpus into a CP-01 stub server; kill mid-batch, rerun: every event exactly once; redacted token never appears in the posted body; ship.json advances | MEDIUM | CP-00 |
-| CP-03 | **Parallel C.** UI: `ui/` (Vite, React, Tailwind), Runs list with filters, run detail timeline, receipt and NOT PROVEN panel; empty states | build, render against section 4 JSON captured from the corpus: row count, verdict badges and NOT PROVEN items match EXPECTED.json; empty DB shows "no runs ingested" | MEDIUM | CP-00 |
-| CP-04 | Wire: service serves `ui/dist`; `loki control [serve,backfill,status]` in autonomy/loki + loki-ts cli; bundle into the npm package (`files[]`) | `npm pack` tarball contains server and UI; `loki control serve` + backfill corpus: /v1/runs count = corpus | MEDIUM | 01,02,03 |
-| CP-05 | Local lifecycle: `src/local/lifecycle.ts` (instance.json, reuse rule, restart, replay) | stale-version instance not reused; dead pid restarted and replayed; never touches unrecorded pid | MEDIUM | CP-04 |
-| CP-06 | Auth and bind: `src/server/auth.ts` | non-loopback bind without token exits non-zero; wrong token 401 on ingest and read; loopback no token 200 | HIGH | CP-01 |
-| CP-07 | Postgres: `src/db/pg.ts`, advisory-lock migrations | with DATABASE_URL: two instances ingest corpus concurrently, counts equal SQLite run | MEDIUM | CP-01 |
-| CP-08 | Receipts: `src/server/receipts.ts` + `ui/src/receipt/` | receipt PUT accepted only with matching sealed hash; NOT PROVEN items equal receipt.json | MEDIUM | 01,03 |
-| CP-09 | Overview: `src/server/stats.ts`, `ui/src/overview/` | totals, verdict split, in-progress and stale counts equal EXPECTED.json | LOW | 01,03 |
-| CP-10 | Costs: `src/server/costs.ts`, `ui/src/costs/` | per-day and per-model usd; unpriced run shows partial "N of M sessions", never 0 | MEDIUM | 01,03 |
-| CP-11 | Compare: `src/server/compare.ts`, `ui/src/compare/` | two runs: stage times, cost, verdict, not_proven diff match fixtures | LOW | 01,03 |
-| CP-12 | Work: issues to PRs; `loki control sync` turns `gh pr view`/`gh issue view` on the client into `work.observed` events (no token on the server). `src/sync/`, `src/server/work.ts`, `ui/src/work/` | open, merged, blocked, pending counts from fixture gh JSON; without sync the panel says "merge state not ingested" | MEDIUM | 01,03 |
-| CP-13 | Backlog: backlog.py writes envelope events (`backlog.queued`, `backlog.dispatched`, `backlog.stopped`) to `.loki/backlog/<batch>/events.jsonl`; backfill ships it. `autonomy/lib/backlog.py`, `src/server/backlog.ts`, `ui/src/backlog/` | 5-issue fixture batch: queued, running, done and BUDGET_STOP counts | MEDIUM | 02,03 |
-| CP-14 | Live: cursor polling `ui/src/live/`, `?after_seq=` | append 3 events to a fixture run while open: detail shows them within 2 polls | LOW | 01,03 |
-| CP-15 | Deploy: `packages/control-plane/Dockerfile`, `deploy/helm/loki-control/` | image boots, /ready 200 after migrations; `helm template` renders probes; replicas>1 without DATABASE_URL fails render | MEDIUM | CP-07 |
-| CP-16 | Self-heal: /ready gating, stale-run derivation, replay on boot | DB file removed while up: /ready 503, recovers; stale run flagged after heartbeat gap | LOW | 01,05 |
-| CP-17 | Acceptance + flag flip | full corpus and one real first-run demo run on SQLite and Postgres: every view's counts equal EXPECTED.json | HIGH | all above |
-| CP-18 | Delete dashboard/, legacy-ui/, engine10/dashboard/, their tests and references | `rg` finds no imports; local-ci fast tier green; first-run gate opens the control UI | HIGH | CP-17 + 1 release |
-
-Dependencies to add (none present today; web-app/package.json pins react 19, vite 6, tailwind 3, so align): hono, drizzle-orm, drizzle-kit (dev), react, react-dom, vite, @vitejs/plugin-react, tailwindcss. SQLite uses built-in `bun:sqlite`. Postgres uses drizzle's `bun-sql` driver if the pinned drizzle-orm exports it, otherwise `postgres` is the one extra. No hard blocker found: Bun is already the runtime (bin/loki:94).
-
-## 11. Open questions
-1. Merge state source: client-side `loki control sync` (chosen default, no server secret) versus a GitHub webhook or App into the service. Webhooks need a public endpoint and a secret.
-2. Legacy run.sh runs (`LOKI_ENGINE=legacy`) write no events.jsonl. Proposed: not shown. Confirm.
-3. web-app/ is a fourth UI (Purple Lab, already deprecated). In scope for deletion or not?
-4. Retention: keep events forever, or prune `heartbeat` after N days?
-5. One shared token for ingest and read, or separate ingest-only tokens per team (D54 scale, team budgets)?
-6. Workspaces: once D51 Phase B lands, should group.json also be shipped as envelope events, the same way as backlog (CP-13)?
-
-## BLOCKED answer and default entry (D65)
-
-A run blocked on a spec conflict shows its question in the run view with an answer box. The answer is POSTed to `/v1/runs/<source>/<run>/answer` (application/json, `answer` up to 4000 chars, the run must be blocked, ids are validated, the server binds 127.0.0.1) and written to `$LOKI_CONTROL_ANSWER_DIR` (default `~/.loki/control/answers`) as `<source>/<run>.answer.txt`, mode 0600. The engine has no in-place resume reader, so resuming starts a fresh run with the answer as task context: `loki answer <run>`.
-
-### Answering a BLOCKED run
-
-`loki answer [<run-id>] [--text "..."]` reads the run's task and question from `.loki/runs/<run>/events.jsonl` and the answer from `--text` or the answer file above, then launches `bin/loki "<task>\n\nClarification answering \"<question>\": <answer>"` and prints the new run id. The default run is the newest BLOCKED run in the current repo. The child env drops every `SLACK_*` variable and `LOKI_CONTROL_TOKEN` and sets `LOKI_NO_BROWSER=1`. A run that is not BLOCKED, or has no answer, exits 2 with the reason.
-
-`LOKI_CONTROL_DEFAULT=1` (off by default) makes `loki dashboard` open the Control Plane.
-
-### Integrity and the display verdict (D86, FC-08)
-
-Ingest runs a pure verifier (`src/server/integrity.ts`) over every stored run and persists `tampered`, `attested`, `sig_checked` and `integrity_reasons`. Only the sealed prefix (events through `log.sealed`) supplies the verdict; a second `run.completed`, or any verdict-bearing event after `log.sealed`, is TAMPERED. The `log.sealed` kid must equal the signed receipt kid, and with keys configured an unknown kid is TAMPERED.
-
-Display verdicts (`effective_verdict`, mirrored by `ui/src/api.ts`): TAMPERED; UNVERIFIED (a VERIFIED claim that is not attested); "VERIFIED (signature not checked)" (attested, but no key in `LOKI_CP_RECEIPT_PUBKEYS` checked the seal signature); VERIFIED (attested and signature-checked). With no keys configured nothing can be plain VERIFIED. Choice for the list filter: `?verdict=VERIFIED` lists signature-checked runs only; `?verdict=VERIFIED (signature not checked)` lists the rest. ALREADY_SATISFIED is a success outcome and needs a seal exactly like VERIFIED (same UNVERIFIED and signature-not-checked rules). Any other verdict on an unattested run shows `<verdict> (unattested)`, so an edited or redacted FAILED or PARTIAL never reads as plain. The Overview VERIFIED tile counts only plain VERIFIED; a separate tile counts signature-not-checked runs. Redaction (Q17-05b): the engine redacts event data with `redactEnvelope` (`loki-ts/src/util/redact.ts`) before it hashes the log and signs the seal; the shipper and ingest apply the same function, which is a fixpoint, so on an engine-written line both are no-ops. Seal crypto fields of the exact engine shape are exempt. A log whose bytes no longer match its seal, including one rewritten by redaction after sealing, is TAMPERED; there is no UNVERIFIED escape for redaction. Rows are recomputed at boot in chunks (one transaction each) when attested is NULL or the stored key-set fingerprint (`integrity_key_fp`) differs from the configured one; rows whose events are gone are marked unattested once and not retried.

package/docs/v10/CONTROL.md

@@ -1,36 +0,0 @@
-# Control
-
-Mission: ship correct, reviewed, verified slices to npm continuously, faster
-than drift can accumulate.
-
-Priority order when anything conflicts: moat > seal accuracy > delivered
-accuracy > cost > speed. Never trade a higher one for a lower one.
-
-## Decisions (one line each; full text and Why/Reverse in DECISIONS.md)
-
-- D12: unanimous APPROVE required; a reproduced blocking finding always
-  vetoes; a bucket-(b) pre-existing gap the diff doesn't worsen is a new
-  slice, never a veto (D21).
-- D13: every review agent pins its model, never inherits the session's.
-- D14-D17: root-caused session terminations to an unscoped `pkill -f`;
-  fixed by scoping to the process group; the regression test itself
-  twice reintroduced the bug (unsafe decoys, shared process group) until
-  self-recorded PIDs, unique tokens, and self-isolation closed it.
-- D18: a hot file was emptied by a scripted write with no read-back
-  guard; Read-then-Edit or diff-verify before any scripted hot-file write.
-- D19: a "confirmed solid" verdict only covers what was tested.
-
-## Velocity targets
-
-- Releases (D37): a cut at :00, :20 and :40 whenever main is green and
-  a merged-unreleased slice exists; trains overlap after publish-npm.
-- Ready slices: at least 8 at all times.
-- Active builders: at least 6 while ready slices exist.
-- Review-pending age: fix or escalate past 45 minutes.
-- Merged-but-unreleased age: cut a release past 30 minutes while CI is
-  green.
-
-## Rule
-
-The first action of every turn addresses the top VIOLATION from
-`scripts/v10-pulse.sh`, before anything else.

package/docs/v10/CP-ASK-PLAN.md

@@ -1,85 +0,0 @@
-# CP-ASK slice plan (Architect, 2026-10-04T00:05Z)
-
-Founder 22:03Z: the CP home box stops being "what should Loki build" and becomes Ask Loki.
-- What it does: search, learn and compare across runs, receipts, repos and issues.
-- How it runs: asynchronously, on the user's provider (default claude).
-
-Everything ships behind LOKI_CP_ASK=1 (default off). Ask is a read-only async job: the provider calls tools from the existing MCP server, and threads are stored in control.db. It never starts a build.
-
-## Findings (file:line; CP = packages/control-plane)
-- **The box today:** CP/ui/src/pages/home/Hero.tsx:45-68, mounted at home/index.tsx:8.
-  - Submit (:26-40) calls POST /v1/start, which reaches spawn.ts:52 planStart, then spawnStart (:73), which runs `loki start --brief`.
-  - Compose (ui/src/pages/compose/index.tsx:75) is a second start path, so builds keep a home.
-- **CP data that already exists:**
-  - control.db holds events, runs, audit, local_repos and actions (src/db/schema.ts:3-89).
-  - HTTP reads: /v1/runs (app.ts:55), /v1/runs/:s/:r (:63), events and the artifact allowlist (artifacts.ts:53, :68), plus stats, cost, fleet, metrics, memory, audit, checkpoints and providers.
-  - There is no /v1/compare route (CONTROL-PLANE.md:41 lists one).
-- **mcp/server.py (3028 lines) mixes read and write tools.**
-  - Read tools: memory_retrieve, state_get, metrics_efficiency, v10_status, project_status, agent_metrics, quality_report, code_search, mem_search, timeline, get, hotspots, co_changes, doc_coverage, findings, learnings, graph_query.
-  - Write or spawn tools: store_pattern, task_queue_add, task_queue_update, capture_session_summary, consolidate_memory, complete_task, v10_run, start_project, checkpoint_restore, loki_start, verify_fast, v10_verify.
-  - It is stdio and works relative to its cwd's .loki.
-- **Repos:** ~/.loki/dashboard/projects.json (spawn.ts:34) plus local_repos.
-- **GitHub:** nothing in the CP; gh is on the host.
-- **Read-only primitives per provider:**
-  - claude: --mcp-config (loki-ts/src/providers/mcp_config.ts) and --allowedTools/--disallowedTools, with deny taking precedence (claude_flags.ts:472-512).
-  - codex: `exec --sandbox read-only`.
-  - opencode: MCP (opencode.sh:72).
-  - cline and aider: no MCP on our path.
-- **Reusable CP helpers:** the SSE helper stream.ts:20-44 and child env scrubbing spawn.ts:14 childEnv.
-
-## Decisions
-- **Data access is tools only (ADOPT, no prompt stuffing).**
-  - mcp/server.py gets `--read-only`, which registers only the read allowlist.
-  - A new mcp/cp_tools.py calls the CP's own HTTP read API: runs_search, run_get, run_events, run_artifact, runs_compare, stats, cost and repos_list (names only).
-  - gh_issues and gh_prs use fixed argv (`gh issue list|view`, `gh pr list|view`), with the repo validated against a known origin_repo.
-  - The CP token reaches only the MCP child env, never the model.
-- **Async job.**
-  - POST /v1/ask writes ask_threads and ask_messages rows, then spawns a detached ask worker (argv, no shell, childEnv).
-  - The worker parses the provider's stream-json into ask_events and records cost.
-  - A message ends as done, failed, timeout (600s), over_budget or interrupted.
-  - The UI streams over SSE; the user can leave and come back, and follow-ups replay prior turns.
-- **Security boundary, three layers:**
-  1. Tools: claude gets --strict-mcp-config with allowedTools Read,Grep,Glob,mcp__loki__* and disallowedTools Write,Edit,NotebookEdit,Bash,WebFetch,WebSearch; codex gets --sandbox read-only.
-  2. cwd is an empty 0700 per-job scratch dir, never a repo, removed at the end.
-  3. The MCP surface is read-only and gh runs with fixed argv.
-  - The ask module never imports planStart or spawnStart (guard test).
-  - All run, event and issue text is untrusted data.
-  - POST requires loopback or a bearer token, accepts JSON only and questions up to 4000 chars, and allows at most 2 concurrent jobs.
-  - cline and aider are refused with "Ask needs a provider with MCP; use claude, codex or opencode".
-
-## Founder questions (decided by the CoS under the standing mandate; FOUNDER-QUEUE row 20, reversible)
-- (a) With the flag on, the home box is Ask only, with a visible "Start a build" link to Compose. This follows the founder's words directly.
-- (b) Defaults are $1.00 per ask (LOKI_ASK_MAX_USD) and a 600s timeout, both configurable. Ask spend is tracked and shown on the Cost page apart from run budgets.
-- (c) Scope:
-  - CP-level data (runs, receipts and events across every repo, since they are already in control.db) is always available.
-  - Per-repo memory and code tools use one repo per ask (the repo chip, default the CP repo).
-  - All-repos memory fan-out is a later slice.
-
-## Slices (no shared files)
-| # | Slice | Tier | Needs | Files | Wall checks |
-|---|---|---|---|---|---|
-| 1 | MCP read-only mode | HIGH | none | mcp/server.py, mcp/tests/test_read_only.py, tests/test-mcp-tool-surface-guard-rejects.sh | The tool list equals the read allowlist exactly; each write tool is absent (re-adding store_pattern goes red); default mode is unchanged. |
-| 2 | CP data tools | HIGH | 1 | mcp/cp_tools.py, mcp/tests/test_cp_tools.py, mcp/tests/fixtures/cp_api/*.json | runs_compare of two fixture runs returns both ids, verdicts and costs; an artifact outside the allowlist is refused; no CP URL or token is returned. |
-| 3 | gh read tools | HIGH | 2 | mcp/gh_tools.py, mcp/tests/test_gh_tools.py | Only list/view argv is spawned; an unknown repo is refused; gh api is unreachable. |
-| 4 | DB schema | MEDIUM | none | CP/src/db/schema.ts, CP/drizzle/0005_ask.sql, CP/drizzle/meta/*, CP/test/db/ask_schema.test.ts | Migrating a 0004 db keeps runs rows byte-equal. |
-| 5 | Ask store | MEDIUM | 4 | CP/src/ask/store.ts, CP/test/server/ask_store.test.ts | Append order is kept; markInterrupted flips only dead-pid running rows. |
-| 6 | Policy and job dir | HIGH | none | CP/src/ask/policy.ts, CP/test/server/ask_policy.test.ts | The deny list covers the loki-ts REVIEW denylist; mcp.json names --read-only; the scratch dir is 0700 and outside every repo. |
-| 7 | Provider argv | HIGH | 6 | CP/src/ask/invoke.ts, CP/test/server/ask_invoke.test.ts | claude has --strict-mcp-config and the deny list and has no --dangerously-skip-permissions; codex has --sandbox read-only; cline and aider are refused; the default model is omitted (L1). |
-| 8 | Stream parser | MEDIUM | none | CP/src/ask/parse.ts, CP/test/server/ask_parse.test.ts, CP/test/fixtures/ask/{claude,codex}-stream.jsonl | Deltas concatenate to the final text; tool_use is captured; the cost comes from the result line; a truncated stream is failed, never done. |
-| 9 | Worker and prompt | HIGH | 5, 7, 8 | CP/src/ask/worker.ts, CP/src/ask/prompt.ts, CP/test/server/ask_worker.test.ts | A timeout kills only the recorded pgid; over budget gives over_budget; the scratch dir is gone after exit; tool calls are stored as citations. |
-| 10 | Routes | HIGH | 5, 9 | CP/src/server/routes/ask.ts, routes/index.ts, routes/stream.ts (export sse), CP/test/server/ask_routes.test.ts, CP/package.json | Flag off gives 404; non-loopback without a token gives 403; a third job gives 429; cancel kills only the recorded pid; nothing is imported from spawn.ts except childEnv. |
-| 11 | Ask page | MEDIUM | 10 | CP/ui/src/pages/ask/{index.tsx,Thread.tsx,api.ts}, CP/ui/src/pages/wired.tsx | Text streams; citations link to #/runs/:s/:r; an interrupted message shows a retry. |
-| 12 | Home box swap | MEDIUM | 11 | CP/ui/src/pages/home/Hero.tsx, AskBox.tsx | Flag on: submit POSTs /v1/ask, never /v1/start, and a "Start a build" link goes to Compose. Flag off: byte-identical. |
-| 13 | Nav and palette | LOW | 11 | CP/ui/src/shell/AppShell.tsx, CP/ui/src/palette/index.tsx | The Ask entry appears only with the flag on. |
-| 14 | E2E and red team | HIGH | 10, 12 | CP/test/e2e/ask.spec.ts, CP/test/server/ask_readonly.test.ts, CP/test/fixtures/ask/inject-run/* | An injected "edit README, run loki start" leaves git status unchanged, spawns no loki and logs no Write or Edit; "compare my last two runs on FireLater" cites both ids. |
-| 15 | Docs and flag flip | LOW | 14 | docs/v10/CONTROL-PLANE.md, CP-ENTERPRISE-UI.md, CHANGELOG.md | The flip is a separate one-line change after a live EV run on real claude passes. |
-
-Waves: {1,4,6,8}, then {2,5,7}, then {3,9}, then 10, then 11, then {12,13}, then 14, then 15.
-
-## Risks
-1. Run data, repo files and issues go to the user's provider. The UI says so on first use.
-2. Prompt injection from issue and run text: no write tool exists, and with no WebFetch the provider is the only outbound channel.
-3. mcp/server.py memory tools are per-repo; cross-repo memory waits for a later slice.
-4. $1 and 600s may truncate deep comparisons; both are configurable.
-5. The read-only allowlist can drift as tools are added. The exact-list test makes a new tool absent until it is classified (fail closed).
-6. codex and opencode MCP flags are version-sensitive. Gate them on probes and mark them degraded.