loki-mode 7.121.5 → 7.121.6

package/README.md

@@ -15,7 +15,7 @@ _The free, source-available autonomous coding agent by [Autonomi](https://www.au
 
 [Website](https://www.autonomi.dev/) | [Documentation](wiki/Home.md) | [Installation](docs/INSTALLATION.md) | [Changelog](CHANGELOG.md) | [Purple Lab -- deprecated v7.44.0](#purple-lab)
 
-**Current release: v7.121.1**
+**Current release: v7.121.5**
 
 </div>
 

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v7.121.5
+# Loki Mode v7.121.6
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -408,4 +408,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v7.121.5 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**
+**v7.121.6 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**

package/VERSION

@@ -1 +1 @@
-7.121.5
+7.121.6

package/api/openapi.yaml

@@ -704,7 +704,7 @@ components:
           nullable: true
         provider:
           type: string
-          enum: [claude, codex, gemini]
+          enum: [claude, codex, cline, aider]
         status:
           type: string
           enum: [starting, running, paused, stopping, stopped, failed, completed]
@@ -770,7 +770,7 @@ components:
           description: Path to PRD file
         provider:
           type: string
-          enum: [claude, codex, gemini]
+          enum: [claude, codex, cline, aider]
           default: claude
         options:
           type: object
@@ -837,7 +837,9 @@ components:
               type: boolean
             codex:
               type: boolean
-            gemini:
+            cline:
+              type: boolean
+            aider:
               type: boolean
         activeSession:
           type: string

package/api/routes/health.ts

@@ -153,7 +153,8 @@ export async function detailedStatus(_req: Request): Promise<Response> {
 async function checkProviders(): Promise<{
   claude: boolean;
   codex: boolean;
-  gemini: boolean;
+  cline: boolean;
+  aider: boolean;
 }> {
   const checkCommand = async (cmd: string): Promise<boolean> => {
     try {
@@ -169,13 +170,16 @@ async function checkProviders(): Promise<{
     }
   };
 
-  const [claude, codex, gemini] = await Promise.all([
+  // v7.5.18: gemini removed (runtime deprecated); cline + aider are the real
+  // Tier-2/Tier-3 providers. Probe the actually-supported set.
+  const [claude, codex, cline, aider] = await Promise.all([
     checkCommand("claude"),
     checkCommand("codex"),
-    checkCommand("gemini"),
+    checkCommand("cline"),
+    checkCommand("aider"),
   ]);
 
-  return { claude, codex, gemini };
+  return { claude, codex, cline, aider };
 }
 
 /**

package/api/routes/sessions.ts

@@ -38,9 +38,9 @@ export async function startSession(req: Request): Promise<Response> {
 
   // Validate provider
   const provider = data.provider || "claude";
-  if (!["claude", "codex", "gemini"].includes(provider)) {
+  if (!["claude", "codex", "cline", "aider"].includes(provider)) {
     throw new LokiApiError(
-      `Invalid provider: ${provider}. Must be one of: claude, codex, gemini`,
+      `Invalid provider: ${provider}. Must be one of: claude, codex, cline, aider`,
       ErrorCodes.VALIDATION_ERROR
     );
   }
@@ -51,7 +51,7 @@ export async function startSession(req: Request): Promise<Response> {
     "provider",
     provider,
     {
-      alternativesRejected: ["claude", "codex", "gemini"].filter((p) => p !== provider),
+      alternativesRejected: ["claude", "codex", "cline", "aider"].filter((p) => p !== provider),
       context: {
         hasPrd: !!data.prdPath,
         options: data.options,

package/api/server.js

@@ -38,7 +38,7 @@ const DEFAULT_HOST = '127.0.0.1';
 const PROJECT_DIR = process.env.LOKI_PROJECT_DIR || process.cwd();
 
 // Security constants
-const VALID_PROVIDERS = ['claude', 'codex', 'gemini'];
+const VALID_PROVIDERS = ['claude', 'codex', 'cline', 'aider'];
 const MAX_BODY_SIZE = 1024 * 1024; // 1MB limit
 const MAX_LOG_LINES = 1000;
 const LOKI_DIR = path.join(PROJECT_DIR, '.loki');

package/api/services/cli-bridge.ts

@@ -48,7 +48,7 @@ class CLIBridge {
    */
   async startSession(
     prdPath?: string,
-    provider: "claude" | "codex" | "gemini" = "claude",
+    provider: "claude" | "codex" | "cline" | "aider" = "claude",
     options: { dryRun?: boolean; verbose?: boolean } = {}
   ): Promise<Session> {
     const sessionId = `session_${Date.now()}_${crypto.randomUUID().slice(0, 8)}`;

package/api/types/api.ts

@@ -8,7 +8,7 @@
 export interface Session {
   id: string;
   prdPath: string | null;
-  provider: "claude" | "codex" | "gemini";
+  provider: "claude" | "codex" | "cline" | "aider";
   status: SessionStatus;
   startedAt: string;
   updatedAt: string;
@@ -62,7 +62,7 @@ export type TaskStatus =
 // API Request/Response types
 export interface StartSessionRequest {
   prdPath?: string;
-  provider?: "claude" | "codex" | "gemini";
+  provider?: "claude" | "codex" | "cline" | "aider";
   options?: {
     dryRun?: boolean;
     verbose?: boolean;
@@ -116,7 +116,8 @@ export interface HealthResponse {
   providers: {
     claude: boolean;
     codex: boolean;
-    gemini: boolean;
+    cline: boolean;
+    aider: boolean;
   };
   activeSession: string | null;
 }

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "7.121.5"
+__version__ = "7.121.6"
 
 # Expose the control app for easy import
 try:

package/docs/COMPETITIVE-RALPH-ZEROSHOT-2026-07-08.md

@@ -0,0 +1,81 @@
+# Competitive Analysis: Loki vs ralph-tui + zeroshot (2026-07-08, honest)
+
+Source: fanned-out research agent, verified against competitor repos/docs + the
+Loki repo. Lead with the uncomfortable truths.
+
+## The uncomfortable truth
+zeroshot (github.com/the-open-engine/zeroshot) has the SAME trust thesis as Loki
+-- "the verifier stays independent from the model that wrote the code": blind
+validators, fail-closed gates, actionable rejections, complexity tiers, SQLite
+resume -- implemented MORE LEGIBLY and more focused. Loki is NOT uniquely "the
+verification tool." Claiming blind-review / independent-verifier as a Loki-only
+differentiator would be fabrication (the founder's #1 forbidden outcome).
+
+ralph-tui (github.com/subsy/ralph-tui) is a different animal: a terminal-UI
+orchestrator for Geoff Huntley's "Ralph" loop (`while :; do cat PROMPT.md |
+claude-code; done`). It beats Loki on ERGONOMICS + SIMPLICITY + community
+momentum, NOT verification (Ralph pushes verification onto the operator).
+
+## What they do BETTER than Loki (honest)
+- zeroshot: trust story is TIGHTER + more legible ("blind validation + fail-closed
+  + actionable rejections" = one sentence a skeptic trusts). Loki's 8+3+1 gates +
+  council + RARV-C is more thorough but far harder to explain/audit.
+- zeroshot: EVIDENCE STALENESS -- fails closed when evidence is stale / older than
+  IMPLEMENTATION_READY / lacks usable evidence, with published status/timestamp/
+  command/exitCode/output. Better guarantee than Loki's "gates passed."
+- zeroshot: COMPLEXITY-PROPORTIONAL validators (TRIVIAL=0, SIMPLE=1, STANDARD=2,
+  CRITICAL=5) -- only pays for verification the task warrants. Cost/speed win.
+- zeroshot: per-run ISOLATION dial (none/worktree/--docker); native GitLab/Jira/
+  Azure backends; honest scope discipline ("not for 'make it faster'").
+- ralph-tui: the TUI cockpit, multi-machine WebSocket fleet control, radical
+  legibility, 7 agent CLIs, viral community (awesome-ralph, ~2.4k stars).
+
+## What Loki genuinely has that they LACK (verified, not overclaimed)
+- Spec-to-DEPLOYED-PRODUCT scope (both competitors stop at task/issue level).
+- Persistent cross-project MEMORY (episodic/semantic/procedural + RAG). Neither
+  has a learning layer (zeroshot's SQLite is run-state, not learned knowledge).
+- Anti-sycophancy Devil's-Advocate re-review triggered by unanimity.
+- Semantic anti-fake-green DETECTORS (mock-integrity, test-mutation) -- dedicated
+  deterministic catchers for tautological/fitted tests.
+- Legacy-healing mode (brownfield archaeology/stabilize/modernize).
+NOTE: breadth is also a LIABILITY -- spec-to-product implies Loki handles
+everything, a bigger promise; an over-confident run that fabricates progress on an
+ill-defined task is the WORST outcome for a trust brand.
+
+## Honest gaps (where a user would prefer a competitor)
+1. Legibility: a skeptic can trust zeroshot/Ralph in minutes; Loki's surface is
+   hard to audit. A trust product that is itself hard to trust-verify is a real
+   problem.
+2. Cost/speed proportionality: zeroshot scales 0-5 validators; Loki runs a lot
+   for every change.
+3. Terminal ergonomics: ralph-tui's cockpit.
+4. Isolation ergonomics: zeroshot's clean --docker dial.
+5. Community/momentum: Loki is comparatively invisible in the public conversation.
+
+## Prioritized recommendations (impact-ranked; moat-safe)
+1. [HIGHEST, S-M, zero moat cost] Make the trust layer LEGIBLE + PROVABLE in one
+   screen: a one-sentence "why you can trust this" + `loki verify --explain` that
+   prints exactly which gates ran, their evidence, freshness, pass/fail. Loki has
+   MORE verification than zeroshot but COMMUNICATES/PROVES it worse. This
+   STRENGTHENS the moat by making it demonstrable.
+2. [M, moat REINFORCEMENT] Evidence STALENESS + tool-neutral handoff contract:
+   timestamp gate evidence, invalidate on state change, fail closed when stale /
+   older than the ready-marker / lacks usable evidence.
+3. [M, careful] Complexity-proportional verification: wire detect_complexity() to
+   scale the gate/council battery like zeroshot's 0/1/2/5 -- but ONLY ADD
+   validators for hard tasks, NEVER drop below a hard floor for anything
+   shippable. Cost/speed win with the floor as the guard.
+4. [M, no moat cost] Per-run isolation dial incl. Docker (match none/worktree/docker).
+5. [S, moat reinforcement] Scope honesty: when "done" is undescribable, say so +
+   degrade to inconclusive (never fabricate). Make it first-class + visible.
+6. [L, nice-to-have] A real terminal cockpit / strong TUI status view.
+7. [M] Broaden issue backends (GitLab/Jira/Azure) for team parity.
+
+## Single most important move + the one thing NOT to copy
+- DO: make the trust layer provable to a skeptic in 60 seconds (recs 1+2). Loki
+  likely has more verification than zeroshot but demonstrates it worse; in a
+  market where buyers are skeptical, the tool that PROVES trust fastest wins.
+- DO NOT COPY: Ralph's "operator supplies verification / senior babysits / ~90%
+  then human takes over." It is simpler + viral but the OPPOSITE of Loki's thesis.
+  Pushing verification back onto the user deletes the moat to chase a crowd that
+  was never Loki's.

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v7.121.5
+**Version:** v7.121.6
 
 ---
 
@@ -396,7 +396,7 @@ provider works inside the container. Provide auth with your Anthropic API key:
 # Run Loki Mode in Docker (Claude provider, API-key auth)
 docker run --rm -e ANTHROPIC_API_KEY="$ANTHROPIC_API_KEY" \
   -v $(pwd):/workspace -w /workspace \
-  asklokesh/loki-mode:7.121.5 start ./my-spec.md
+  asklokesh/loki-mode:7.121.6 start ./my-spec.md
 ```
 
 ##### docker compose + .env (no host install)

package/docs/RARV-C-CHANGE-MAP.md

@@ -0,0 +1,165 @@
+# RARV-C Efficiency Change Map (apply-and-measure, from lever investigation)
+
+Both checks resolve cleanly:
+
+**Check 1 (env propagation): CONFIRMED SAFE.** `_base.py:113` does `full_env = dict(os.environ)` then passes it as `env=full_env` to subprocess. The loki adapter (`loki.py:120`) uses `run_env`. So env-prefixing the bench invocation propagates the knob into the loki subprocess, where completion-council.sh:84 reads it at source time. Every `KNOB=x bench run` command in the plan is a real measurement, not a no-op.
+
+**Check 2 (iteration counts): CONFIRMED AVAILABLE.** `iterations` is a canonical per-trial field (`loki.py:35-77` counts `iteration_complete` events; `_base.py:34,92` records it in the result row). So the moment the baseline lands, per-spec iteration counts are readable directly from the result JSON, which is exactly the discriminator the advisor flagged.
+
+The advisor's arithmetic is decisive: 150s / 14k tokens ≈ 1 iteration, so simple-1 almost certainly already stops at iter ~1 via the fast path. The council-knob interval sweep must be pointed at the highest-iteration spec, not the trivial baseline. Here is the final synthesis.
+
+---
+
+# RARV-C EFFICIENCY ARC: ORDERED APPLY-AND-MEASURE CHANGE MAP
+
+## Gate rule (applies to every change below)
+Ships iff it moves >=1 of {iterations, $/build, wall-clock} BEYOND the ~25% noise band AND does not regress verified-pass-rate. Baseline: 5 specs x 3 trials, running now.
+
+**Measurement primitive (all changes):**
+`KNOB=val bash benchmarks/bench/run.sh run <spec> --trials 3 --emit-proof` (env-prefix propagates via `_base.py:113` `dict(os.environ)` -> loki subprocess). Read `iterations`, `cost`, `duration_s` per trial from the result JSON; pass = grader `exit==0` (`runner.py:210-254`).
+
+**Baseline arithmetic that reshapes the whole plan:** 2.5min ≈ 150s and ~14k tokens ≈ ONE iteration (~130s/~10k each per the other two investigations). So the trivial baseline is almost certainly **already stopping at iter ~1 via the explicit-claim fast path** (`completion-council.sh:3519-3521`) - the exact case the council investigation says needs NO change. The council-knob headroom lives in high-iteration specs (`multifail-1-two-modules`, `tokenheavy-1-crm`), not `simple-1`.
+
+---
+
+## DO THIS FIRST (the moment the baseline lands)
+
+**READ per-spec iteration counts from the baseline result JSON** before touching anything. This single read decides whether change #1 (council interval) can ship at all.
+
+Then, change #1 is the first thing to **measure** (zero code, pure env var, cannot regress pass-rate - it changes WHEN not WHETHER the council approves):
+
+**One-line command:**
+```
+LOKI_COUNCIL_CHECK_INTERVAL=2 bash benchmarks/bench/run.sh run multifail-1-two-modules --trials 3
+```
+(Point at whichever spec the baseline shows grinding *past its min-iter floor with no claim*. If NO spec grinds past floor, change #1 is a no-op and does not ship - see #1 below.)
+
+---
+
+## CHANGE TABLE (buckets a -> c -> b)
+
+### BUCKET (a) - constants/gates, no prompt text, no parity blast radius
+
+#### #1. Council check-interval sweep (simple tier) [SHIP FIRST if warranted]
+| Field | Value |
+|---|---|
+| Anchor | `completion-council.sh:84` (`COUNCIL_CHECK_INTERVAL=${LOKI_COUNCIL_CHECK_INTERVAL:-5}`); modulo gate `:3523` |
+| Current | 5 |
+| Proposed | 2 or 3 for simple tier only; keep 5 for standard/complex |
+| Bucket | (a) |
+| Metric | wall-clock + iterations, ONLY on no-claim/no-test-suite specs that grind to the interval boundary |
+| Measure | `LOKI_COUNCIL_CHECK_INTERVAL=2 bash benchmarks/bench/run.sh run <highest-iter-spec> --trials 3`; pass = APPROVE verdict unchanged vs baseline, wall-clock down past noise |
+| Effort | Trivial (1 env default) |
+| Risk | Low. Do NOT go to 1 globally (council convenes every iter -> cost rises on genuine multi-iter builds). |
+| **NO-OP GUARD** | If baseline shows every spec stops at iter ~1 (fast path), this moves nothing and FAILS the gate on trivial specs. **Ships only if a spec is empirically grinding past its floor without a claim.** |
+
+#### #2. Verify explicit fast-path fires at iter 1 (validation run, not a change)
+| Field | Value |
+|---|---|
+| Anchor | claim detection `completion-council.sh:3601-3605`; bypass `:3519-3521`; runner peek `run.sh:18309-18314` |
+| Current | On (structural) |
+| Proposed | No change - run matrix row C to prove it |
+| Measure | `bash benchmarks/bench/run.sh run simple-1-contact-form --trials 3` with `COMPLETION_REQUESTED` touched at end of iter 1; expect stop at iter 1. If it does NOT, that is a **real claim-wiring bug**, not a knob. |
+| Effort | Trivial | Risk | None (read-only validation) |
+
+### BUCKET (c) - need off-worktree / bench validation (parity or regression guard)
+
+#### #3. Complexity -> tier routing (`auto` sentinel)
+| Field | Value |
+|---|---|
+| Anchors | `run.sh:742` (`LOKI_SESSION_MODEL:-sonnet` -> `:-auto`); `run.sh:16932-16943` (case block, add `auto` arm); `_loki_session_pin_opus=1` reuse `run.sh:16953`; parity: estimator `autonomy/loki:15860-15870`, dashboard `server.py:2841,3059` |
+| Current | Session pinned to `sonnet` for whole run; tier NOT complexity-aware |
+| Proposed | `auto` arm: simple->fast+**haiku-enable**, complex->planning+`_loki_session_pin_opus=1`, standard->development. Propagate resolved tier via `.loki/state/session-tier` file for the two parity readers (they lack `DETECTED_COMPLEXITY`). |
+| Bucket | **(c)** - conflicts with task framing (task calls tier-routing a leading "(a)" candidate; its own investigation classified it **(c)** on evidence: 3 parity readers + hard-1 bench guard + gated opus/haiku dispatch). Go with the evidence. |
+| Metric | $/build + tokens (simple drops via haiku); verified-pass-rate must hold (hard-1) |
+| Measure | Bench before/after with auto on: `hard-1-order-api` stays `exit==0` at planning tier; `simple-1`/`simple-2` cost drops AND stays green. If cheap routing drops hard-1 below pass, classifier thresholds (`detect_complexity` 2574-2591) are wrong. |
+| Effort | Medium (~15 lines run.sh + state-file read in 2 ports + parity allowlist for `auto`) |
+| Risk | Med. Silent quality regression if a hard build routes cheap. Guarded by hard-1 held-out acceptance. |
+| **LANDMINES** | L2: `simple->fast` alone == sonnet==sonnet, **zero savings** without `LOKI_ALLOW_HAIKU=true` - the haiku-enable is the load-bearing half. L3: `CURRENT_TIER=planning` dispatches sonnet post-v7.104; must reuse `_loki_session_pin_opus=1` for real opus. |
+
+#### #4. Self-heal from run logs (route app.log error signature into prompt)
+| Field | Value |
+|---|---|
+| Anchors | S1 new helper `app-runner.sh` (~15 lines); S2 call sites `app-runner.sh:1756,1823` + `_loki_write_last_error` `run.sh:1103`; S3 injection edit `run.sh:14941-14942` (the `APP_CRASHED` heredoc line - **verified exact**) |
+| Current | Watchdog restarts blindly; prompt gets crash *count* + "check app.log yourself"; `LAST_ERROR.json` is write-only (never read by `build_prompt`) |
+| Proposed | S1: deterministic `tail -60 app.log` + grep first stack frame (Traceback/Error:/panic:/EADDRINUSE/MODULE_NOT_FOUND). S2: persist as `error_class=app_runtime_error`. S3: append signature + targeted-fix instruction to the injection. No new subsystem; reuses 2 existing mechanisms. |
+| Bucket | (c) - orchestration change, provider-agnostic, needs bench validation on crashing specs |
+| Metric | **iterations-to-green / verified-pass-rate on CRASHING specs** (NOT trivial cost - does nothing on the non-crashing baseline; will look like a gate fail if measured on simple-1) |
+| Measure | Unit-test S1 against fixture `app.log` with a Python traceback (asserts signature) and one without (asserts empty, no fabrication). Then bench on `multifail-1-two-modules` (crashes): expect faster convergence / higher pass-rate. |
+| Effort | Small (1 helper + 2 call sites + 1 edit) |
+| Risk | Low. No-fake-green by construction: only routes info into the prompt; fix still flows through health-check + council + 8 gates. Honest-degrade: no signature -> today's behavior. |
+
+#### #5. MCP/tool-surface scoping for simple builds (prompt-size Lever A)
+| Field | Value |
+|---|---|
+| Anchors | Provider invocation / MCP mount logic (NOT `build_prompt`); lsp-proxy mount + `mcp/server.py` ~34-tool surface |
+| Current | Full MCP surface (loki-mode ~34 tools + lsp-proxy + Claude built-ins) mounted every build; multiple-k of fixed token floor |
+| Proposed | Gate lsp-proxy mount off when no language server helps; reduced MCP toolset for simple-complexity builds |
+| Bucket | (c) - NOT the low-effort/no-regression "(a)" the task framing implies. Same "dropped a tool the build needed -> regression" risk class as tier-routing; mount-time complexity detection is real work. The prompt-size investigation's "do first" is scoped *within prompt-size*, not the whole arc. |
+| Metric | input tokens/build (biggest single token win, no byte-lock unlock) |
+| Measure | Bench simple-1/simple-2 token delta with reduced surface; hard-1 must stay green (needs its tools). |
+| Effort | Medium (mount gating + complexity signal at invocation) |
+| Risk | Med - underscoping breaks a build that needed a dropped tool. |
+
+#### #6. PreToolUse content validation on Write/Edit (Bucket-2 gap, Claude-only)
+| Field | Value |
+|---|---|
+| Anchor | `.claude/settings.json` PreToolUse matcher (mirrors `validate-bash.sh`) |
+| Current | PreToolUse hook exists for Bash command strings only; no content validation on file writes |
+| Proposed | Add `Write|Edit` matcher validating written content (secret patterns, `node --check` syntax) |
+| Bucket | (c) - native hook is right mechanism but **Claude-provider-only** defense-in-depth; real cross-provider containment stays the sandbox (`LOKI_SANDBOX_MODE`) |
+| Metric | Not an efficiency lever - safety. **Does not move any gate metric.** Include only as opportunistic safety, not scored against the efficiency gate. |
+| Effort | Small | Risk | Low (advisory) |
+
+### BUCKET (b) - founder-gated (build_prompt byte-locked + 60-fixture SHA parity)
+
+#### #7. Enable prompt caching / activate `[CACHE_BREAKPOINT]` (prompt-size Lever B)
+| Field | Value |
+|---|---|
+| Anchor | `[CACHE_BREAKPOINT]` marker `run.sh:15119` (inert today); no `cache_control` set |
+| Current | Static ~1.6k prefix + tool/system floor re-billed full price every iteration (each iter is a distinct `claude -p` process) |
+| Proposed | Wire real caching for the static prefix |
+| Bucket | (b)-adjacent, and **CONTINGENT** - benefit is 100% caching, hinges on whether Claude Code CLI folds the prefix into a cached breakpoint reusable across per-iteration processes within the 5-min TTL. **Verify against the CLI before committing.** |
+| Metric | $/build on multi-iteration runs (zero token reduction; converts fixed prefix to ~0.1x on cache reads) |
+| Measure | Compare cost on a multi-iteration spec (tokenheavy-1) before/after; caching shows on iter-2+. |
+| Effort | Med (contingent on CLI mechanics) | Risk | Med - may be a no-op if CLI doesn't wire cache_control for the prefix. Flag "verify before committing," not a committed change. |
+
+#### #8. Trim static boilerplate in `<loki_system>` prefix (prompt-size Lever C)
+| Field | Value |
+|---|---|
+| Anchors | compose (~290t) + LSP (~286t) + USAGE (~209t) + DOC_SCOPE (~143t) strings in `run.sh` + `build_prompt.ts` |
+| Current | All emitted every build |
+| Proposed | Load-on-demand / shorten (~700-900 tokens recoverable) |
+| Bucket | (b) - byte-locked; each string `MUST stay byte-identical` under 60-fixture SHA parity (`loki-ts/tests/parity/build_prompt.test.ts`). Needs founder unlock + fixture regen + dual-route parity re-verify. |
+| Metric | input tokens (~7-9% of 10k) |
+| Effort | Small code, EXPENSIVE unlock | Risk | Low behavior, high process cost. |
+
+---
+
+## NOT WORTH DOING (ponytail: no no-ops)
+
+| Item | Why it's a no-op / not worth it |
+|---|---|
+| `_council_effective_min_iter` simple->1 | **ALREADY SHIPPED** (SaaS #122, verified `completion-council.sh:118-130`). Nothing to do. |
+| `simple->fast` tier route WITHOUT haiku-enable | sonnet==sonnet (L2, `claude.sh:60-62`). Zero savings. The haiku-enable is the only load-bearing half. |
+| Lowering `COUNCIL_STAGNATION_LIMIT` (5->3) for speed | Fires circuit breaker sooner -> force-stop, which is NOT verified-complete (`run.sh:18320-18326`). Pass-rate regression dressed as speedup. Leave at 5. |
+| Council interval on the trivial baseline | If baseline stops at iter ~1 (very likely per arithmetic), lowering the interval moves nothing on simple-1 and fails the gate. Only ships against a spec grinding past floor. |
+| Prompt-size Lever D (move RARV to `--append-system-prompt`) standalone | Saves ZERO without Lever B's caching, and DOUBLE-BILLS if the byte-locked removal half doesn't ship simultaneously. Bundle-with-#7 or drop. Not a standalone change. |
+| Self-heal S5 (dedicated read-only investigate sub-agent) | YAGNI. S3 already gives the RARV agent the error text; RARV's own VERIFY is the remediate half. Add only if S1-S4 measurably under-fix. |
+
+---
+
+## ORDER SUMMARY
+1. **Read baseline iteration counts per spec** (decides #1 viability).
+2. **#1 council interval** - measure first, ship iff a spec grinds past floor (bucket a, zero code).
+3. **#2 fast-path validation** - confirms claimed builds stop at iter 1 (bucket a, read-only).
+4. **#3 tier routing** (bucket c) - biggest $/build lever; needs parity + hard-1 guard, off-worktree.
+5. **#4 self-heal** (bucket c) - pass-rate lever on crashing specs; measure on multifail-1, not simple-1.
+6. **#5 MCP scoping** (bucket c) - biggest token win, but real regression risk; not the "first" the framing suggests.
+7. **#6 PreToolUse content validation** (bucket c, safety, unscored).
+8. **#7 caching** (bucket b, contingent - verify CLI before committing).
+9. **#8 prefix trim** (bucket b, founder-gated - small win, expensive unlock; do LAST, don't spend the unlock for ~300 tokens while ~5k sits in tool schemas).
+
+**Two framing conflicts surfaced (evidence wins):** (a) the task calls tier-routing and MCP-scoping leading "(a)" candidates; their own investigations classify both **(c)** on parity/regression-guard evidence. (b) The council-knob is genuinely the first thing to *measure* (pure env var, no regression path) but is a no-op on the trivial baseline - its real target is high-iteration specs.
+
+Read-only synthesis; no edits, no processes, no temp files. Clean.

package/docs/RARV-C-LOOP-EFFICIENCY-PLAN.md

@@ -0,0 +1,465 @@
+# RARV-C Loop-Efficiency Upgrade Plan (ultracode phase)
+
+Architect: synthesis of the six cookbook pattern sets against the current
+Loki RARV-C loop. This is a PLAN, not code. Every proposed change carries a
+constraint bucket and a bench-gate. No benchmark numbers are asserted here --
+the harness (Deliverable #1) produces them.
+
+Grounded against v7.121.5 source. Line numbers drift; re-verify with grep
+before editing.
+
+---
+
+## 0. The one-line thesis
+
+The competitors' edge is INFRASTRUCTURE, not loop rigor. Our proof /
+never-fake-green RARV-C is the moat. So this plan optimizes the loop's
+EFFICIENCY (cost, wall-clock, iterations-to-completion) and NEVER trades away
+verification rigor. The lever that proves it is a bench that measures the
+moat's OUTPUT (verified pass rate, from a deterministic grader) independently
+of the loop's own self-assessment.
+
+---
+
+## 1. The gap split
+
+### 1a. Already-scoped INFRASTRUCTURE (NOT this plan's target)
+
+Yesterday's competitor research (reuse, do not re-run) found the
+Replit/Emergent/Bolt advantage is mostly infrastructure: per-build sandbox
+isolation, snapshot/checkpoint, warm pools, fast provisioning. That work is
+already scoped as #2b / #8b / #10 in
+`autonomi-saas/docs/NEXT-AFTER-2026-07-08.md`.
+
+The entire `sandboxes-production` cookbook maps 1:1 onto that scoped k8s work.
+Treat it as a reference implementation, do NOT re-derive it, and do NOT rank
+it here:
+
+| Cookbook technique | Already-scoped item |
+|---|---|
+| Pod-per-session = blast radius | Per-build isolation (#2b) |
+| Per-session volume + SessionStore mirror (local-first, async, non-fatal) | Snapshot/resume, durability C->A (#10) |
+| Lease + heartbeat + reclaim-on-lapse | dead-run-holds-worker (#14) |
+| Idempotent get-or-create keyed on session id | (implicit in per-build spawn) |
+| Standby warm pool, egress NetworkPolicy, gateway auth, OTel | k8s tier-3 infra |
+
+Their loops are NOT more rigorous (Replit ships zero tests). We are ahead on
+verification. Do not re-architect that lead.
+
+Three `sandboxes-production` techniques are net-new for Loki but are
+SAFETY/HEALING, not cost/speed/iterations, so they are explicitly OUT of this
+plan's ranked list (name them, do not smuggle them in):
+- Two-phase investigate(read-only) -> remediate(write) split for
+  self-heal-from-logs.
+- Narrow-scoped write tools + `PreToolUse` content-validation hooks
+  (block-and-let-agent-adapt).
+- archive-vs-delete + optimistic-concurrency version check on state updates.
+
+### 1b. LOOP EFFICIENCY (THIS plan's target)
+
+Cost, wall-clock, iterations-to-completion, at constant verified-pass-rate.
+The `managed-agents`, `agent-patterns`, and `evals-observability` cookbooks
+target this. Techniques: evaluator-optimizer to converge in fewer passes,
+outcome-grader discipline to stop early when genuinely done, cheaper model
+routing, root-cause-clustered parallel fix-loops, plan-big-execute-small
+coordinator economics.
+
+**Honest caveat up front (ponytail rung 2 -- reuse what exists):** the biggest
+iterations-win is LARGELY ALREADY SHIPPED. The framework already has
+explicit-completion-claim, tunable `COUNCIL_CHECK_INTERVAL`, the tier-aware
+`_council_effective_min_iter` floor (v7.105), and the
+`COUNCIL_STAGNATION_LIMIT` circuit breaker. The cookbook's outcome-grader and
+evaluator-optimizer patterns ARE, structurally, the completion council plus
+findings-injection we already run. So most items below are "TUNE an existing
+knob and let the bench prove the setting," NOT "build a new grader." Proposing
+to build what exists would itself be a fabrication.
+
+---
+
+## 2. Deliverable #1: the metric harness (BUILD THIS FIRST)
+
+We cannot claim "least cost / fewer iterations" without measured before/after.
+Founder rule: measurable before/after every commit; an unmeasured claim is a
+fabrication under anti-fake-green. So the harness ships before any loop change.
+
+### 2a. Reuse, do not rebuild (the lazy path is the correct path)
+
+Verified against source: the harness is ~95% already built.
+
+- `benchmarks/bench/` already has the frozen contract (`bench_schema.py`,
+  `SCHEMA_VERSION = "1.0"`), a runner (`runner.py`), a deterministic grader
+  (`success = exit==0`, held-out `acceptance.overlay` copied in AFTER the
+  agent finishes), a loki adapter (`adapters/loki.py`), a price table
+  (`prices.json`), and `loki bench` + `loki bench verify`.
+- `bench_schema.py` ALREADY carries the fields we need: `iterations`
+  (`setdefault("iterations", 0)`), `duration_s`, `cost_usd`, `tokens_in/out`,
+  `cache_read_tokens`, `success` (grader-set).
+- `adapters/loki.py` ALREADY reads iteration count from `.loki` state
+  (`_read_iteration_count`, session.json/autonomy-state.json) and captures
+  `duration_s`.
+- The credibility invariant is ENFORCED in code: `validate_adapter_output()`
+  REJECTS any adapter dict carrying `success/quality/passed/score/verdict`.
+  Only the grader sets outcome. This is exactly the "grade the artifact, never
+  the loop's self-assessment" rule -- already a code invariant, not a
+  convention.
+- `benchmarks/speed-benchmark.sh` ALREADY parses the target's
+  `.loki/events.jsonl` for `act_iterations` and `wall_clock_s` from an
+  ISOLATED source copy (never the worktree).
+
+So Deliverable #1 is NOT a build. It is: lock a corpus, reconcile one metric
+source, baseline, and wire the gate.
+
+### 2b. The four target metrics -> where each comes from
+
+| Metric | Source (already exists) |
+|---|---|
+| verified-pass-rate | grader `success = exit==0` on held-out acceptance -> `success_rate` = n_success/n_trials. NEVER council/`completion_claimed`. |
+| $/build | `cost_usd` per task (adapter tokens x frozen `prices.json`); `cost_usd_per_solved` aggregate already in schema. |
+| iterations-to-completion | `iterations` field, populated by `adapters/loki.py` `_read_iteration_count`. |
+| wall-clock/build | `duration_s` (adapter wall-clock around the subprocess). |
+
+### 2c. The genuine delta (small, concrete)
+
+1. **Reconcile the iterations source (harden, do not duplicate).**
+   `adapters/loki.py` reads `iteration` from `session.json`;
+   `speed-benchmark.sh` parses `events.jsonl`. These CAN disagree. Pick ONE
+   canonical source so both harnesses agree -- prefer the `events.jsonl`
+   `iteration_complete` count (it is the real per-session timeline; session
+   state can be mid-write). Make `adapters/loki.py` read events.jsonl with
+   session.json as fallback. One parser, copied from
+   `speed-benchmark.sh` lines ~119-179. Bucket (a).
+2. **Confirm wall-clock coverage.** `duration_s` already exists; verify it is
+   the full subprocess wall-clock, not per-iteration. If it is, no new field
+   is needed and we avoid touching the frozen schema at all. If a distinct
+   `wall_clock_s` is truly required, it is an ADDITIVE optional field
+   (`setdefault`), but the schema header says "do not change without updating
+   SCHEMA_VERSION and every slice" -- so treat any field add as a
+   SCHEMA_VERSION bump + all-slice update. PREFER reusing `duration_s`.
+3. **Lock the corpus.** 5-15 fixed specs under `benchmarks/bench/tasks/` (or
+   a new `benchmarks/corpus/`), each with machine-checkable held-out
+   acceptance (exit code / http status / file exists / regex). Dev on 2, run
+   on all. `task_hash` (spec + acceptance + model, already computed) is the
+   reproducibility anchor.
+4. **Ship the 2-spec smoke sanity check:** one spec that MUST pass, one
+   deliberately-underspecified that MUST fail; assert
+   `verified_pass == [True, False]`. If the grader cannot tell those apart it
+   measures nothing. This is the single runnable check the harness leaves
+   behind.
+
+### 2d. Reproducibility contract (frozen across every before/after)
+
+- Corpus, grader (acceptance harness), and `prices.json` are FROZEN across a
+  before/after pair. Changing any of them destroys comparability exactly like
+  swapping a grader model would. Adding output fields is safe (`task_hash`
+  covers spec+acceptance+model); changing the corpus is not.
+- Every results file persists `loki_version` + `task_hash` + price-table hash
+  so any past number is reproducible and its config travels with it
+  (`benchmarks/results/<version>-<stamp>.json`, already the pattern).
+- Baseline = N real off-worktree builds = real dollars and hours. Run from an
+  isolated source copy with cwd AND `LOKI_TARGET_DIR` pinned to scratch, per
+  the never-run-from-worktree rule. Per-build try/except + hard timeout: a
+  crashed/hung build scores 0 (fail), never aborts the batch. Retry a build
+  only on infra error (network/rate-limit), NEVER on a real failure.
+
+### 2e. The gate rule (operationalizes anchors 1 + 3)
+
+> A loop-efficiency change SHIPS iff it improves at least one of
+> {iterations-to-completion, $/build, wall-clock} BEYOND THE BASELINE'S NOISE
+> BAND AND does not regress verified-pass-rate, measured on the frozen corpus
+> vs the committed baseline.
+
+No change ships unless the bench moves the right way. That one rule is anchor
+1 (optimize efficiency, never trade the proof-moat) and anchor 3
+(bench-gated, no unmeasured claims) made mechanical.
+
+### 2e-HARDENING (advisor 2026-07-08 - blocking; decided BEFORE any results)
+
+Three holes that make an unhardened bench produce fake-green "wins":
+
+1. **NOISE FLOOR (blocking).** Agentic builds are non-deterministic; iterations
+   /$/wall-clock vary run-to-run. "Improves the right direction" with no variance
+   threshold ships random noise as a win ~half the time. RULE: the baseline
+   reports SPREAD (std dev or min-max across trials), not just means. A change
+   ships only if its metric moves BEYOND the baseline's noise band (mean delta >
+   baseline trial std, or non-overlapping min-max). If an effect is smaller than
+   trial variance at N trials, either raise trials or report "no measurable
+   effect" and DO NOT ship. The noise bar is decided now, not rationalized after.
+2. **RECONCILE-METRICS-FIRST (blocking).** Fix the iterations source (2c.1 ->
+   events.jsonl canonical) BEFORE baselining. Baselining on an ambiguous source
+   (session.json vs events.jsonl disagree) corrupts every iterations before/after.
+   This is a PREREQUISITE step, not parallel.
+3. **CORPUS FROM DISCRIMINATORS (expensive to reverse - frozen at baseline).**
+   Do NOT pick "5-15 representative specs." Derive the corpus BACKWARD from what
+   each ranked change must discriminate:
+   - Rank 2 (tier routing): MUST include HARD specs that must stay on the strong
+     model without pass-rate regression, else the anchor-1 guard (cheap tier must
+     not regress hard builds) is untestable and you ship a silent regression.
+   - Rank 3 (parallel fix-loops): MUST include specs that produce MULTI-CLUSTER
+     failures.
+   - Rank 5 (distilled returns): MUST include TOKEN-HEAVY specs.
+   Mix: simple + hard + multi-failure + token-heavy. Frozen once baselined (2d).
+
+### 2f. Cost envelope + honesty pre-commit
+- Envelope: ~5-10 specs x 3 trials x (1 baseline + ~7 ranked changes) ~= 120-240
+  real builds = real dollars + hours. START SMALL: prove the full pipeline
+  (baseline->one change->measure->gate) on a 3-spec corpus FIRST to validate the
+  machinery mechanically, THEN build the real discriminator-derived corpus and
+  baseline. Grow corpus only if variance demands it.
+- HONESTY PRE-COMMIT: the plan already says most iteration wins are shipped;
+  expect single-digit-% to maybe-2x from tuning, NOT 100x. Pre-commit to reporting
+  the real number even if unimpressive, and to stating plainly: "the loop is
+  near-optimal; the real 100x is the INFRA work (already scoped #2b/#10), not
+  here." Do not let the measurement spend create pressure to dress up a small
+  delta - that would be fake-green.
+
+---
+
+## 3. Ranked upgrade list
+
+Ranked by (impact / effort), bucket-(a) first. Every item names its cookbook
+pattern, expected effect, bucket, bench validation, and rough effort.
+
+Bucket key:
+- **(a)** ORCHESTRATION-LEVEL -- changeable now (run.sh model routing, council
+  gating, iteration control constants, sub-invocation that does NOT feed the
+  next prompt). No `build_prompt()` change.
+- **(b)** NEEDS FOUNDER AUTHORIZATION -- requires unlocking `build_prompt()`
+  (60-fixture byte-mirror parity lock).
+- **(c)** NEEDS OFF-WORKTREE REAL-BUILD VALIDATION -- cannot be proven without
+  real builds that must NOT run from the worktree.
+
+Discriminator for (a) vs (b): *does the change alter `build_prompt()` output
+text?* If it changes what text enters the next prompt (findings, rubric,
+feedback), it is (b). If it only changes WHEN the council convenes, WHICH model
+runs, or a sub-invocation whose output is not concatenated into the next
+prompt, it is (a). Prompt-touching patterns are SPLIT into their (a) and (b)
+halves below -- do not file a whole pattern under one bucket.
+
+---
+
+### Rank 1 -- Tune the completion-council convergence knobs
+
+- **Pattern:** outcome-grader "stop early when genuinely done" +
+  evaluator-optimizer "PASS gate stops the loop the moment criteria are met"
+  (`managed-agents`, `agent-patterns`). We already HAVE the grader (the
+  council). This item TUNES it, does not build it.
+- **Concrete:** sweep `COUNCIL_CHECK_INTERVAL` (default 5,
+  `completion-council.sh:84`), `_council_effective_min_iter`
+  (`:3555`), and `COUNCIL_STAGNATION_LIMIT` (default 5, `:132`) on the corpus;
+  pick the settings that cut iterations-to-completion without regressing
+  verified-pass-rate. Also verify the explicit-completion-claim fast path
+  (`:3601`) fires on the corpus (the v7.105 lever: a done-at-1 build should
+  stop near iter 1, not grind to the next interval).
+- **Effect:** fewer wasted idle iterations -> lower $/build + wall-clock.
+  Largest iterations lever that is NOT already maxed.
+- **Bucket:** (a). Constants + gating only; no prompt text.
+- **Bench validation:** iterations + $/build must drop, verified-pass-rate
+  flat. If pass-rate drops, the interval is too aggressive -- revert.
+- **Effort:** LOW (constant sweep + bench runs). Cost is the real-build $.
+
+### Rank 2 -- Model-tier routing by task complexity
+
+- **Pattern:** Routing (`agent-patterns`) -- a cheap classifier routes easy
+  inputs to the cheap model, hard ones to the strong model; plan-big-
+  execute-small coordinator economics (`managed-agents`).
+- **Concrete:** `LOKI_SESSION_MODEL` is the single largest cost lever
+  (`run.sh:16932`) and today it is one pinned tier for the whole run. Wire
+  `detect_complexity()` (`run.sh:1338`) -> session tier so simple specs pin
+  cheaper (haiku/sonnet) and complex specs pin higher, instead of a flat
+  default. Keep it a unified intelligent default (opt-out knob), never a
+  fragmented set of flags.
+- **Effect:** direct $/build reduction on the simple-spec majority; strong
+  model reserved for the hard tail. Dominant cost lever.
+- **Bucket:** (a). Model selection, no prompt text.
+- **Bench validation:** $/build drops on simple-spec corpus members,
+  verified-pass-rate flat across ALL members (guard: cheaper tier must not
+  regress pass on the hard ones -- that is the anchor-1 trap).
+- **Effort:** LOW-MED. `detect_complexity` already exists; wire it to the tier
+  map and gate on the bench.
+
+### Rank 3 -- Root-cause-clustered parallel fix-loops
+
+- **Pattern:** iterate-fix-failing-tests + "cluster before you parallelize"
+  (`managed-agents`); Parallelization for independent slices
+  (`agent-patterns`).
+- **Concrete:** on a code-review/test BLOCK, bucket failures by root module
+  and fan out ONE fix-worker per INDEPENDENT cluster (worktree per cluster),
+  then re-run the WHOLE suite once at merge as the independent verify. Do NOT
+  fan out per-test -- failures share root causes, per-test workers duplicate
+  the same fix and conflict (the cookbook's own `test_mean` caveat).
+- **Effect:** wall-clock collapse on multi-cluster failures (parallel vs
+  serial); fewer iterations via root-cause (not symptom) fixes.
+- **Bucket:** (a) for the orchestration (fan-out + merge + whole-suite
+  re-verify happen in run.sh / fleet, no prompt-text change). (c) for
+  proving it -- parallel worktree fix-loops must be validated off-worktree on
+  real multi-failure builds.
+- **Bench validation:** wall-clock drops on corpus members that produce
+  multi-cluster failures; verified-pass-rate flat (the merge whole-suite
+  re-run is the non-negotiable guard against over-fix/regression).
+- **Effort:** MED. Clustering heuristic + worktree fan-out + merge verify.
+
+### Rank 4 -- Per-role tool-scoping in the SDLC fleet
+
+- **Pattern:** coordinate-specialist-team "narrowest tool allowlist per role"
+  (`managed-agents`); tool descriptions drive behavior.
+- **Concrete:** give each fleet role (architect, dev, SDET, reviewer) the
+  minimal allowed-tools list it needs (reviewer: read-only; researcher:
+  web+read only). Claude and Codex both support per-invocation tool
+  restriction -- provider-agnostic.
+- **Effect:** fewer wrong-turn iterations (a reviewer cannot wander into
+  bash); smaller blast radius. Iterations lever, modest.
+- **Bucket:** (a). Invocation tool lists, no prompt text.
+- **Bench validation:** iterations flat-or-down, verified-pass-rate flat. This
+  one mostly de-risks; expect small bench movement. If the bench does not
+  move, ship only if it reduces wrong-turn incidents in the transcript
+  (secondary signal), else defer (ponytail: do not ship a no-op).
+- **Effort:** LOW.
+
+### Rank 5 -- Structured distilled-return contract for workers (coordinator economics)
+
+- **Pattern:** plan-big-execute-small "workers return DISTILLED summaries, not
+  raw material" + XML/JSON structured handoff (`managed-agents`,
+  `agent-patterns`).
+- **Concrete:** enforce that fleet workers return a small structured payload
+  (JSON) up to the coordinator, never dump raw file/log/page content back up
+  the chain. Keeps the coordinator context small -> cheaper, sharper
+  synthesis. Gate the fan-out on a granularity heuristic (only shard genuinely
+  token-heavy INDEPENDENT slices; the cookbook warns over-sharding RAISES the
+  bill and narrow tasks do not pay).
+- **Effect:** $/build reduction on token-heavy multi-worker builds; guards
+  against the degenerate "one frontier round-trip for nothing" case.
+- **Bucket:** (a) for the worker return contract and fan-out granularity
+  gate (fleet orchestration). NOTE: if the distilled summaries are
+  concatenated into the NEXT `build_prompt()` iteration, that concatenation
+  path is (b) -- keep the contract change on the worker->coordinator hop, not
+  the coordinator->next-prompt hop, to stay in (a).
+- **Bench validation:** $/build drops on token-heavy corpus members;
+  verified-pass-rate flat (guard: distillation must not summarize away
+  nuance the grader checks).
+- **Effort:** MED.
+
+### Rank 6 -- Confidence-calibrated escalation lane (already partly shipped)
+
+- **Pattern:** gate-human-in-the-loop decide/escalate calibration
+  (`managed-agents`).
+- **Concrete:** the uncertainty-gated escalation is already default-on
+  (`run.sh:18236`). This item TUNES the confidence threshold so the confident
+  majority stays in the fast/cheap autonomous lane and only the genuinely
+  low-confidence + unsafe tail escalates/handoffs (never fake-greens, never
+  blocks-to-ask -- honors the no-human-in-loop runtime rule). Route the
+  low-confidence tail to a stronger model rather than a human where the action
+  is reversible.
+- **Effect:** avoids MAX_ITERATIONS burn on stuck loops (caps wasted
+  iterations); reserves expensive lane for the tail.
+- **Bucket:** (a). Threshold + routing, no prompt text.
+- **Bench validation:** iterations drop on corpus members that currently
+  thrash toward the cap; verified-pass-rate flat.
+- **Effort:** LOW.
+
+### Rank 7 -- Enriched findings-injection text (FOUNDER-GATED)
+
+- **Pattern:** evaluator-optimizer "feed specific feedback + prior attempts
+  back to the generator" + outcome-grader rubric discipline
+  (`agent-patterns`, `managed-agents`). This is our highest-leverage
+  iterations lever AND the most likely to be byte-locked.
+- **Concrete:** `LOKI_INJECT_FINDINGS` already injects structured per-finding
+  records into the next prompt (default-on). ENRICHING that injected TEXT
+  (better-targeted, rubric-shaped, one-bullet-per-failure format) would make
+  each retry more directed and converge in fewer passes. BUT the injected text
+  flows through `build_prompt()`, whose output is pinned by the 60-fixture
+  SHA-256 parity lock (`loki-ts/tests/parity/build_prompt.test.ts`,
+  `loki-ts/src/runner/build_prompt.ts`, gold under
+  `loki-ts/tests/fixtures/build_prompt/`).
+- **Split (per anchor 2):**
+  - (a) part: tuning WHEN findings are injected / WHICH findings are selected
+    (selection logic upstream of the prompt) -- changeable now if it does not
+    alter the emitted text bytes.
+  - (b) part: changing the injected TEXT / format / rubric wording -- requires
+    founder authorization to unlock the byte-lock, then regenerate all 60
+    fixtures via `run-bash.sh` and keep bash<->TS parity 60/60.
+- **Effect:** fewer iterations-to-completion (directed retries). Potentially
+  large, but gated.
+- **Bucket:** (b) for the text change; (a) for the selection-logic half.
+- **Bench validation:** iterations drop, verified-pass-rate flat-or-up. Prove
+  off-worktree (hermetic Bun integration test with stub judge, then real
+  builds).
+- **Effort:** MED code + HIGH process (founder unlock + fixture regen +
+  full council + local-ci). Do NOT start the (b) half without authorization.
+
+---
+
+## 4. Sequencing for the ultracode phase
+
+1. **Deliverable #1 first: lock the harness + baseline.** Reconcile the
+   iterations source (2c.1), confirm wall-clock coverage (2c.2), lock the 5-15
+   spec corpus (2c.3), ship the 2-spec smoke check (2c.4), then run the
+   baseline: N real off-worktree builds -> committed
+   `benchmarks/results/<baseline>.json`. Nothing else ships until this exists.
+2. **Bucket-(a) wins, ranked, each bench-gated.** In order: Rank 1 (council
+   knob sweep) -> Rank 2 (complexity->tier routing) -> Rank 6 (escalation
+   threshold) -> Rank 4 (per-role tool scoping) -> Rank 3 orchestration half
+   -> Rank 5 worker-return contract. Each one: change, re-run corpus, apply
+   the gate rule (2e). If the bench does not move the right way, do not ship
+   it (ponytail: no no-ops).
+3. **Bucket-(c) validation for anything needing real parallel builds** (Rank 3
+   fix-loop fan-out): prove off-worktree on real multi-failure builds before
+   shipping.
+4. **Founder-gated items LAST.** Rank 7 (b) half only after: (i) bucket-(a)
+   wins are banked and measured, (ii) explicit founder authorization to unlock
+   `build_prompt()`, (iii) fixture regen + 60/60 parity + full 3-reviewer
+   council + local-ci green. Do the (a) selection-logic half of Rank 7 in
+   step 2 if it stands alone.
+5. **Every ship:** full gate is back (Wednesday 2026-07-08, the 1-week
+   relaxation has expired). Runtime/council changes = full 3-reviewer council
+   (2 Opus + 1 Sonnet, unanimous APPROVE, loop to 3/3) + `local-ci.sh` green +
+   watch all GH workflows. Prove RARV-C changes with hermetic Bun integration
+   tests (stub judge, `LOKI_OVERRIDE_REAL_JUDGE=0`, mkdtemp scratch, no token
+   cost) -- pattern already established in
+   `loki-ts/tests/integration/override_on_block.test.ts`.
+
+---
+
+## 5. Explicit "do NOT do" list
+
+Tempting things that re-architect the moat, hit the byte-lock, or fabricate
+numbers:
+
+1. **Do NOT replace the completion council with a single-LLM outcome-grader.**
+   That kills the 3-reviewer rigor moat -- the exact thing we are ahead on.
+   Lift the rubric DISCIPLINE (checkable criteria, evidence-earned pass,
+   one-bullet-per-failure feedback, same-gap non-convergence detection), NOT
+   the single-judge architecture.
+2. **Do NOT add an LLM-judge to the bench grader.** The grader is
+   deterministic (`success = exit==0` on held-out acceptance) and the
+   credibility invariant is enforced in code
+   (`validate_adapter_output` rejects any self-judged key). An LLM judge is a
+   second thing you must hold fixed and it breaks the invariant. Specs are
+   code -- acceptance is machine-checkable for free.
+3. **Do NOT trust `completion_claimed` / council APPROVE as the bench pass
+   signal.** That is grading the loop's self-assessment -- the fake-green
+   failure mode. Pass = independent deterministic acceptance only.
+4. **Do NOT touch `build_prompt()` output text without founder authorization.**
+   60-fixture SHA-256 byte-mirror parity lock. Any text change = regenerate
+   gold + keep bash<->TS 60/60 or CI (`parity-drift`) fails. This gates
+   Rank 7's (b) half.
+5. **Do NOT change the corpus, grader, or price table across a before/after
+   pair.** Comparability dies; the number becomes a fabrication. Additive
+   output fields are safe; corpus churn is not.
+6. **Do NOT cite the cookbook's headline numbers as ours.** "~2.5x cheaper /
+   ~3x faster" (plan-big-execute-small) and "84-98% billed at worker rate" are
+   THEIR task on THEIR corpus. Our numbers come from our harness, later.
+7. **Do NOT over-shard plan-big-execute-small or fan fix-workers per-test.**
+   The cookbook's own caveats: over-sharding RAISES the bill (delegation floor
+   cost), narrow tasks do not pay, and per-test workers duplicate shared-root
+   fixes and conflict. Cluster by root cause first, then parallelize across
+   clusters.
+8. **Do NOT run a real engine build from the worktree to validate any of
+   this.** TARGET_DIR resolves onto the worktree and self-mutates it. Baseline
+   and all (c) validation run from an isolated source copy with cwd +
+   `LOKI_TARGET_DIR` pinned to scratch (the speed-benchmark.sh discipline).
+9. **Do NOT re-scope the sandboxes-production infra work here.** It is already
+   #2b/#8b/#10 in autonomi-saas. Reference the cookbook as an impl, do not
+   re-derive or re-rank it.
+10. **Do NOT ship a change that does not move the bench the right way.** The
+    gate rule (2e) is binding: improve >=1 of {iterations, $/build,
+    wall-clock} AND no verified-pass-rate regression, or it does not ship.

package/loki-ts/dist/loki.js

@@ -1,5 +1,5 @@
 // @bun
-var q8=Object.defineProperty;var J8=($)=>$;function V8($,Q){this[$]=J8.bind(null,Q)}var b=($,Q)=>{for(var Z in Q)q8($,Z,{get:Q[Z],enumerable:!0,configurable:!0,set:V8.bind(Q,Z)})};var P=($,Q)=>()=>($&&(Q=$($=0)),Q);var J$=import.meta.require;var m1={};b(m1,{lokiDir:()=>j,homeLokiDir:()=>T$,findRepoRootForVersion:()=>$1,REPO_ROOT:()=>h});import{resolve as t,dirname as e$}from"path";import{fileURLToPath as W8}from"url";import{existsSync as N$}from"fs";import{homedir as H8}from"os";function G8(){let $=v1;for(let Q=0;Q<6;Q++){if(N$(t($,"VERSION"))&&N$(t($,"autonomy/run.sh")))return $;let Z=e$($);if(Z===$)break;$=Z}return t(v1,"..","..","..")}function $1($){let Q=$;for(let Z=0;Z<6;Z++){if(N$(t(Q,"VERSION"))&&N$(t(Q,"autonomy/run.sh")))return Q;let z=e$(Q);if(z===Q)break;Q=z}return t($,"..","..","..")}function j(){return process.env.LOKI_DIR??t(process.cwd(),".loki")}function T$(){return t(H8(),".loki")}var v1,h;var C=P(()=>{v1=e$(W8(import.meta.url));h=G8()});import{readFileSync as U8}from"fs";import{resolve as Y8,dirname as B8}from"path";import{fileURLToPath as M8}from"url";function S$(){if(Q$!==null)return Q$;let $="7.121.5";if(typeof $==="string"&&$.length>0)return Q$=$,Q$;try{let Q=B8(M8(import.meta.url)),Z=$1(Q);Q$=U8(Y8(Z,"VERSION"),"utf-8").trim()}catch{Q$="unknown"}return Q$}var Q$=null;var Q1=P(()=>{C()});var p1={};b(p1,{runOrThrow:()=>S8,run:()=>R,readStreamCapped:()=>c1,commandVersion:()=>C8,commandExists:()=>u,ShellError:()=>Z1,MAX_STDOUT_BYTES:()=>u1});async function c1($,Q=u1){let Z=$.getReader(),z=new TextDecoder,X="",q=0;try{while(q<Q){let{done:K,value:W}=await Z.read();if(K)break;if(!W)continue;if(q+=W.byteLength,q>Q){let V=W.byteLength-(q-Q);X+=z.decode(W.subarray(0,V),{stream:!0});break}X+=z.decode(W,{stream:!0})}X+=z.decode()}finally{try{await Z.cancel()}catch{}Z.releaseLock()}return X}async function R($,Q={}){let Z=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:Q.env?{...process.env,...Q.env}:process.env,cwd:Q.cwd}),z,X;if(Q.timeoutMs&&Q.timeoutMs>0)z=setTimeout(()=>{try{Z.kill("SIGTERM")}catch{}X=setTimeout(()=>{try{Z.kill("SIGKILL")}catch{}},2000)},Q.timeoutMs);try{let[q,K,W]=await Promise.all([c1(Z.stdout),new Response(Z.stderr).text(),Z.exited]);return{stdout:q,stderr:K,exitCode:W}}finally{if(z)clearTimeout(z);if(X)clearTimeout(X)}}async function S8($,Q={}){let Z=await R($,Q);if(Z.exitCode!==0)throw new Z1(`command failed (${Z.exitCode}): ${$.join(" ")}`,Z.exitCode,Z.stdout,Z.stderr);return Z}async function u($){let Q=D8($),Z=await R(["sh","-c",`command -v ${Q}`],{timeoutMs:5000});if(Z.exitCode===0)return Z.stdout.trim()||null;return null}function D8($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function C8($,Q="--version"){if(!await u($))return null;let z=await R([$,Q],{timeoutMs:5000});if(z.exitCode!==0)return null;return((z.stdout||z.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var u1=16777216,Z1;var o=P(()=>{Z1=class Z1 extends Error{message;exitCode;stdout;stderr;constructor($,Q,Z,z){super($);this.message=$;this.exitCode=Q;this.stdout=Z;this.stderr=z;this.name="ShellError"}}});function r($){return b8?"":$}var b8,M,S,_,tZ,L,k,y,J;var p=P(()=>{b8=(process.env.NO_COLOR??"").length>0;M=r("\x1B[0;31m"),S=r("\x1B[0;32m"),_=r("\x1B[1;33m"),tZ=r("\x1B[0;34m"),L=r("\x1B[0;36m"),k=r("\x1B[1m"),y=r("\x1B[2m"),J=r("\x1B[0m")});import{existsSync as l8}from"fs";async function Z$(){if(A$!==void 0)return A$;let $="/opt/homebrew/bin/python3.12";if(l8($))return A$=$,$;let Q=await u("python3.12");if(Q)return A$=Q,Q;let Z=await u("python3");return A$=Z,Z}async function z$($,Q={}){let Z=await Z$();if(!Z)return{stdout:"",stderr:"python3 not found",exitCode:127};return R([Z,"-c",$],Q)}var A$;var V$=P(()=>{o()});var V0={};b(V0,{runStatus:()=>U3});import{existsSync as v,readFileSync as H$,readdirSync as $0,statSync as Q0}from"fs";import{resolve as D,basename as z3}from"path";import{homedir as X3}from"os";function Z0($){let Q=Math.trunc($);if(Q>=1e6)return`${(Math.trunc(Q/1e6*10)/10).toFixed(1)}M`;if(Q>=1000)return`${(Math.trunc(Q/1000*10)/10).toFixed(1)}K`;return String(Q)}function z0($,Q,Z){if(Q===0)return null;let z=Math.trunc($*100/Q),X=Math.trunc($*C$/Q);if(X>C$)X=C$;let q=C$-X,K=S;if(z>=80)K=M;else if(z>=50)K=_;let W="=".repeat(Math.max(0,X))+" ".repeat(Math.max(0,q)),V=Z0($),H=Z0(Q);return`  ${k}${Z}${J} ${K}[${W}]${J} ${z}% (${V} / ${H})`}async function q3(){if(await u("jq"))return!0;return process.stdout.write(`${M}Error: jq is required but not installed.${J}
+var q8=Object.defineProperty;var J8=($)=>$;function V8($,Q){this[$]=J8.bind(null,Q)}var b=($,Q)=>{for(var Z in Q)q8($,Z,{get:Q[Z],enumerable:!0,configurable:!0,set:V8.bind(Q,Z)})};var P=($,Q)=>()=>($&&(Q=$($=0)),Q);var J$=import.meta.require;var m1={};b(m1,{lokiDir:()=>j,homeLokiDir:()=>T$,findRepoRootForVersion:()=>$1,REPO_ROOT:()=>h});import{resolve as t,dirname as e$}from"path";import{fileURLToPath as W8}from"url";import{existsSync as N$}from"fs";import{homedir as H8}from"os";function G8(){let $=v1;for(let Q=0;Q<6;Q++){if(N$(t($,"VERSION"))&&N$(t($,"autonomy/run.sh")))return $;let Z=e$($);if(Z===$)break;$=Z}return t(v1,"..","..","..")}function $1($){let Q=$;for(let Z=0;Z<6;Z++){if(N$(t(Q,"VERSION"))&&N$(t(Q,"autonomy/run.sh")))return Q;let z=e$(Q);if(z===Q)break;Q=z}return t($,"..","..","..")}function j(){return process.env.LOKI_DIR??t(process.cwd(),".loki")}function T$(){return t(H8(),".loki")}var v1,h;var C=P(()=>{v1=e$(W8(import.meta.url));h=G8()});import{readFileSync as U8}from"fs";import{resolve as Y8,dirname as B8}from"path";import{fileURLToPath as M8}from"url";function S$(){if(Q$!==null)return Q$;let $="7.121.6";if(typeof $==="string"&&$.length>0)return Q$=$,Q$;try{let Q=B8(M8(import.meta.url)),Z=$1(Q);Q$=U8(Y8(Z,"VERSION"),"utf-8").trim()}catch{Q$="unknown"}return Q$}var Q$=null;var Q1=P(()=>{C()});var p1={};b(p1,{runOrThrow:()=>S8,run:()=>R,readStreamCapped:()=>c1,commandVersion:()=>C8,commandExists:()=>u,ShellError:()=>Z1,MAX_STDOUT_BYTES:()=>u1});async function c1($,Q=u1){let Z=$.getReader(),z=new TextDecoder,X="",q=0;try{while(q<Q){let{done:K,value:W}=await Z.read();if(K)break;if(!W)continue;if(q+=W.byteLength,q>Q){let V=W.byteLength-(q-Q);X+=z.decode(W.subarray(0,V),{stream:!0});break}X+=z.decode(W,{stream:!0})}X+=z.decode()}finally{try{await Z.cancel()}catch{}Z.releaseLock()}return X}async function R($,Q={}){let Z=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:Q.env?{...process.env,...Q.env}:process.env,cwd:Q.cwd}),z,X;if(Q.timeoutMs&&Q.timeoutMs>0)z=setTimeout(()=>{try{Z.kill("SIGTERM")}catch{}X=setTimeout(()=>{try{Z.kill("SIGKILL")}catch{}},2000)},Q.timeoutMs);try{let[q,K,W]=await Promise.all([c1(Z.stdout),new Response(Z.stderr).text(),Z.exited]);return{stdout:q,stderr:K,exitCode:W}}finally{if(z)clearTimeout(z);if(X)clearTimeout(X)}}async function S8($,Q={}){let Z=await R($,Q);if(Z.exitCode!==0)throw new Z1(`command failed (${Z.exitCode}): ${$.join(" ")}`,Z.exitCode,Z.stdout,Z.stderr);return Z}async function u($){let Q=D8($),Z=await R(["sh","-c",`command -v ${Q}`],{timeoutMs:5000});if(Z.exitCode===0)return Z.stdout.trim()||null;return null}function D8($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function C8($,Q="--version"){if(!await u($))return null;let z=await R([$,Q],{timeoutMs:5000});if(z.exitCode!==0)return null;return((z.stdout||z.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var u1=16777216,Z1;var o=P(()=>{Z1=class Z1 extends Error{message;exitCode;stdout;stderr;constructor($,Q,Z,z){super($);this.message=$;this.exitCode=Q;this.stdout=Z;this.stderr=z;this.name="ShellError"}}});function r($){return b8?"":$}var b8,M,S,_,tZ,L,k,y,J;var p=P(()=>{b8=(process.env.NO_COLOR??"").length>0;M=r("\x1B[0;31m"),S=r("\x1B[0;32m"),_=r("\x1B[1;33m"),tZ=r("\x1B[0;34m"),L=r("\x1B[0;36m"),k=r("\x1B[1m"),y=r("\x1B[2m"),J=r("\x1B[0m")});import{existsSync as l8}from"fs";async function Z$(){if(A$!==void 0)return A$;let $="/opt/homebrew/bin/python3.12";if(l8($))return A$=$,$;let Q=await u("python3.12");if(Q)return A$=Q,Q;let Z=await u("python3");return A$=Z,Z}async function z$($,Q={}){let Z=await Z$();if(!Z)return{stdout:"",stderr:"python3 not found",exitCode:127};return R([Z,"-c",$],Q)}var A$;var V$=P(()=>{o()});var V0={};b(V0,{runStatus:()=>U3});import{existsSync as v,readFileSync as H$,readdirSync as $0,statSync as Q0}from"fs";import{resolve as D,basename as z3}from"path";import{homedir as X3}from"os";function Z0($){let Q=Math.trunc($);if(Q>=1e6)return`${(Math.trunc(Q/1e6*10)/10).toFixed(1)}M`;if(Q>=1000)return`${(Math.trunc(Q/1000*10)/10).toFixed(1)}K`;return String(Q)}function z0($,Q,Z){if(Q===0)return null;let z=Math.trunc($*100/Q),X=Math.trunc($*C$/Q);if(X>C$)X=C$;let q=C$-X,K=S;if(z>=80)K=M;else if(z>=50)K=_;let W="=".repeat(Math.max(0,X))+" ".repeat(Math.max(0,q)),V=Z0($),H=Z0(Q);return`  ${k}${Z}${J} ${K}[${W}]${J} ${z}% (${V} / ${H})`}async function q3(){if(await u("jq"))return!0;return process.stdout.write(`${M}Error: jq is required but not installed.${J}
 `),process.stdout.write(`Install with:
 `),process.stdout.write(`  brew install jq    (macOS)
 `),process.stdout.write(`  apt install jq     (Debian/Ubuntu)
@@ -814,4 +814,4 @@ Set LOKI_LEGACY_BASH=1 to force the bash CLI for every command.
 `),2}default:return process.stderr.write(`Unknown command: ${Q}
 `),process.stderr.write(K8),2}}e1();process.on("SIGINT",()=>process.exit(130));process.on("SIGTERM",()=>process.exit(143));var SZ=await NZ(Bun.argv.slice(2));process.exit(SZ);
 
-//# debugId=F475C3772E2E83E064756E2164756E21
+//# debugId=85EBA4135307848464756E2164756E21

package/mcp/__init__.py

@@ -57,4 +57,4 @@ try:
 except ImportError:
     __all__ = ['mcp']
 
-__version__ = '7.121.5'
+__version__ = '7.121.6'

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "loki-mode",
   "mcpName": "io.github.asklokesh/loki-mode",
-  "version": "7.121.5",
+  "version": "7.121.6",
   "description": "Loki Mode by Autonomi. Autonomous spec-to-product system: takes a PRD, GitHub issue, OpenAPI/JSON/YAML, or one-line brief to a deployed app via the RARV-C closure loop with 8 quality gates. Provider-agnostic (Claude Code, OpenAI Codex, Cline, Aider).",
   "keywords": [
     "agent",

package/plugins/loki-mode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "loki-mode",
   "displayName": "Loki Mode",
-  "version": "7.121.5",
+  "version": "7.121.6",
   "description": "Autonomous spec-to-product build system with a built-in trust layer (RARV-C closure loop, 8 quality gates, completion council). Ships Loki's spec-hardening, drift-detection, and deterministic PR verification commands plus the Loki MCP server.",
   "author": {
     "name": "Autonomi",