loki-mode 8.8.0 → 8.9.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v8.8.0
+# Loki Mode v8.9.0
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -469,4 +469,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v8.8.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**
+**v8.9.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**

package/VERSION

@@ -1 +1 @@
-8.8.0
+8.9.0

package/autonomy/loki

@@ -17629,12 +17629,37 @@ else:
             integrations.append(kw)
 
     # Count database mentions
-    db_keywords = ['postgresql', 'postgres', 'mysql', 'mongodb', 'sqlite',
-                   'dynamodb', 'cassandra', 'redis', 'prisma', 'typeorm',
-                   'sequelize', 'drizzle', 'knex', 'database', 'migration']
-    for kw in db_keywords:
-        if kw in content_lower:
-            databases.append(kw)
+    # Count DISTINCT data stores. This feeds a +1-complexity-for-multiple
+    # rule, so what counts as multiple is load-bearing: it pushed a
+    # 322-word issue from moderate to complex, and complex means 18 iterations
+    # instead of 9.
+    #
+    # Three ways the old flat list over-counted a single-database project:
+    #   1. Aliases. 'postgresql' and 'postgres' were separate entries, so one
+    #      PostgreSQL app scored TWO data stores by itself. That alone tripped
+    #      the rule on a real user's issue.
+    #   2. ORMs. prisma/typeorm/sequelize/drizzle/knex are ACCESS LAYERS, not
+    #      stores. Prisma plus PostgreSQL is one database, not two.
+    #   3. Generic words. 'database' and 'migration' matched any PRD that used
+    #      the words at all, so a migration-to-the-database line scored two.
+    #
+    # Aliases collapse to one canonical name, ORMs and generic terms are gone.
+    db_aliases = {
+        'postgresql': 'postgres', 'postgres': 'postgres', 'psql': 'postgres',
+        'mysql': 'mysql', 'mariadb': 'mysql',
+        'mongodb': 'mongodb', 'mongo': 'mongodb',
+        'sqlite': 'sqlite',
+        'dynamodb': 'dynamodb',
+        'cassandra': 'cassandra',
+        'redis': 'redis',
+        'elasticsearch': 'elasticsearch',
+        'clickhouse': 'clickhouse',
+    }
+    _seen_db = set()
+    for kw, canonical in db_aliases.items():
+        if kw in content_lower and canonical not in _seen_db:
+            _seen_db.add(canonical)
+            databases.append(canonical)
 
     # Count UI components
     ui_keywords = ['dashboard', 'form', 'table', 'modal', 'navbar',
@@ -17717,6 +17742,34 @@ iteration_map = {
 }
 min_iter, max_iter = iteration_map[complexity]
 
+# --- Capability-aware iteration budget ---------------------------------------
+# The map above was written when a model could not hold a whole feature in one
+# pass, so work was chopped into many small iterations. On a frontier tier that
+# is now actively harmful: each iteration boundary is a context reset, and
+# re-planning mid-feature is where a run loses the thread and burns money.
+#
+# A frontier model should be handed the whole job and left to finish it. So the
+# budget is divided by the capability tier the run will actually dispatch,
+# rather than assuming the weakest case for everyone. The floor is 1, never 0.
+#
+# This scales the ESTIMATE and the ceiling, not the work. A run that genuinely
+# needs more iterations still takes them; nothing here forces an early stop.
+_tier_raw = (os.environ.get('LOKI_SESSION_MODEL') or '').strip().lower()
+_frontier = ('high', 'planning', 'opus', 'sol')
+_small = ('small', 'fast', 'haiku', 'luna')
+if _tier_raw in _frontier:
+    # Frontier: one pass for anything short of enterprise scope.
+    min_iter = 1
+    max_iter = max(1, max_iter // 4)
+elif _tier_raw in _small:
+    # Small models genuinely benefit from more, smaller steps.
+    pass
+else:
+    # medium / unset: the common default. Halve the legacy budget -- current
+    # workhorse models complete in far fewer passes than this map assumed.
+    min_iter = max(1, min_iter // 2)
+    max_iter = max(min_iter, max_iter // 2)
+
 # Adjust based on specific counts
 if endpoint_count > 10:
     max_iter = max(max_iter, max_iter + endpoint_count // 5)

package/autonomy/run.sh

@@ -630,6 +630,70 @@ PY
     export LOKI_SPEC_SHA256
 }
 
+# Scoped-change profile: a bug fix or a single feature in an EXISTING repo.
+#
+# Measured on a real user's run: a 322-word GitHub issue against an existing
+# codebase spent 25+ minutes still inside iteration 1. The work itself was
+# genuine, but the build was also running competitor web research, load and
+# performance testing, regression simulation and UAT -- all of which default to
+# true, and none of which a scoped issue fix needs. That is the difference
+# between a 5-minute fix and a 30-minute one.
+#
+# What this NEVER touches: code review, security, tests, E2E, and the
+# completion council all stay on. Speed here comes from not running phases that
+# are irrelevant to the change, never from skipping verification. A greenfield
+# build or a whole-repo refactor does not match this profile and keeps the full
+# suite.
+#
+# Auto-detected rather than another flag the user has to know: an existing git
+# repo with real history, plus a spec that reads as a scoped change. Set
+# LOKI_SCOPED_CHANGE=0 to force the full suite, or =1 to force this profile.
+loki_detect_scoped_change() {
+    # Explicit operator intent always wins, in both directions.
+    case "${LOKI_SCOPED_CHANGE:-}" in
+        0|false) return 1 ;;
+        1|true)  return 0 ;;
+    esac
+
+    # Greenfield is not a scoped change: no repo, or a repo with almost no
+    # history, means we are building something new.
+    local target="${TARGET_DIR:-.}"
+    [ -d "$target/.git" ] || return 1
+    local commits
+    commits="$(git -C "$target" rev-list --count HEAD 2>/dev/null || echo 0)"
+    [ "${commits:-0}" -ge 5 ] || return 1
+
+    # An issue-sourced spec is the canonical scoped change: someone filed a
+    # discrete request against code that already exists.
+    [ -n "${LOKI_ISSUE_REF:-}" ] && return 0
+    case "${LOKI_PRD_FILE:-}" in
+        *prd-issue-*) return 0 ;;
+    esac
+
+    return 1
+}
+
+loki_apply_scoped_change_profile() {
+    loki_detect_scoped_change || return 0
+
+    # Off: cannot affect the correctness of a scoped change to existing code.
+    : "${LOKI_PHASE_WEB_RESEARCH:=false}"
+    : "${LOKI_PHASE_PERFORMANCE:=false}"
+    : "${LOKI_PHASE_REGRESSION:=false}"
+    : "${LOKI_PHASE_UAT:=false}"
+
+    # On: every trust gate, unchanged. These are the moat.
+    : "${LOKI_PHASE_CODE_REVIEW:=true}"
+    : "${LOKI_PHASE_SECURITY:=true}"
+    : "${LOKI_PHASE_UNIT_TESTS:=true}"
+    : "${LOKI_PHASE_E2E_TESTS:=true}"
+
+    export LOKI_PHASE_WEB_RESEARCH LOKI_PHASE_PERFORMANCE LOKI_PHASE_REGRESSION
+    export LOKI_PHASE_UAT LOKI_PHASE_CODE_REVIEW LOKI_PHASE_SECURITY
+    export LOKI_PHASE_UNIT_TESTS LOKI_PHASE_E2E_TESTS
+    export LOKI_SCOPED_CHANGE_ACTIVE=1
+}
+
 loki_apply_build_profile() {
     [ "${LOKI_BUILD_PROFILE:-}" = "simple-web" ] || return 0
     : "${LOKI_PHASE_API_TESTS:=false}"
@@ -772,6 +836,36 @@ print(catalog["providers"]["claude"]["cli_aliases"].get(os.environ["_LOKI_SELECT
     export LOKI_SDK_JUDGE_MODEL LOKI_SDK_PRD_ENRICH_MODEL LOKI_SDK_REVIEW_MODEL
 }
 loki_apply_build_profile
+loki_apply_scoped_change_profile
+
+# Default hang guard for EVERY build, not just simple-web.
+#
+# The two timeouts above are set inside loki_apply_build_profile(), which
+# returns immediately unless LOKI_BUILD_PROFILE=simple-web. So on a normal
+# build both resolved to 0, and 0 means no guard at all -- verified by running
+# the deadline helper directly: `deadline.py 0 0 3 -- sleep 5` runs to
+# completion unkilled. A provider that hung had nothing to stop it.
+#
+# IDLE only, and no retry. That is what keeps this compatible with the standing
+# objection recorded above (search: "former invoke_with_timeout"), whose two
+# reasons remain correct:
+#
+#   1. "No safe generous default" applies to a fixed TOTAL timeout, which
+#      cannot tell a long legitimate iteration from a hang. An idle timeout
+#      can: it measures silence, not duration. Verified both directions --
+#      `sleep 600` under a 120s idle cap dies, while a process emitting output
+#      every second survives indefinitely. A coding agent streams constantly;
+#      one silent for two minutes is not working.
+#   2. "Wrong retry semantics" stands, so nothing here retries. The call is
+#      killed, and the existing failure path handles it. Re-running an agent
+#      that may have already edited files remains off the table.
+#
+# 7200s hard ceiling is a backstop against a process that streams forever
+# without converging; the idle cap is the load-bearing guard. Both are
+# overridable, and setting either to 0 restores the old unguarded behaviour.
+: "${LOKI_PROVIDER_IDLE_TIMEOUT:=120}"
+: "${LOKI_PROVIDER_CALL_TIMEOUT:=7200}"
+export LOKI_PROVIDER_IDLE_TIMEOUT LOKI_PROVIDER_CALL_TIMEOUT
 
 loki_background_services_enabled() {
     ! loki_is_supervised_simple_web

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "8.8.0"
+__version__ = "8.9.0"
 
 # Expose the control app for easy import
 try:

package/dashboard/server.py

@@ -678,6 +678,37 @@ async def _push_loki_state_loop() -> None:
                             except (json.JSONDecodeError, KeyError):
                                 pass
 
+                        # Third source: the .loki/pids/ registry, which a
+                        # CLI-started background run DOES write. Without this
+                        # the dashboard reported STOPPED for a healthy build:
+                        # `loki start` writes neither loki.pid nor session.json
+                        # (run.sh only UPDATES session.json when it already
+                        # exists), so both checks above failed and every such
+                        # run fell through to "stopped" while it was actively
+                        # working. Confirmed against a live build: STATUS.txt
+                        # said BUILDING and iterations were advancing while the
+                        # dashboard showed STOPPED with 0 agents.
+                        #
+                        # Liveness is proven with os.kill(pid, 0), never by the
+                        # file's presence -- a stale entry from a crashed run
+                        # must NOT read as alive, which is the same
+                        # anti-stale rule BUG-NEW-006 established above.
+                        if not _pid_alive:
+                            try:
+                                _pid_dir = loki_dir / "pids"
+                                for _entry in _pid_dir.glob("*.json"):
+                                    _rec = _safe_json_read(_entry, {})
+                                    if _rec.get("kind") not in ("wrapper", "runner"):
+                                        continue
+                                    try:
+                                        os.kill(int(_rec.get("pid", 0)), 0)
+                                    except (ValueError, OSError, ProcessLookupError):
+                                        continue
+                                    _pid_alive = True
+                                    break
+                            except OSError:
+                                pass
+
                         status_str = raw.get("mode", "autonomous")
                         # Control files are the AUTHORITY, and they are checked
                         # first. dashboard-state.json's "mode" is written by the
@@ -2925,7 +2956,7 @@ def _provider_model_offers(provider: str) -> list[dict]:
     Every other provider is offered the generic tiers (small/medium/high), which
     are provider-independent, each annotated with the concrete model id the
     catalog says that provider dispatches. That is what makes the picker read
-    "medium -> gpt-5.3-codex" on codex and "medium -> claude-sonnet-5" on claude
+    "medium -> gpt-5.6-terra" on codex and "medium -> claude-sonnet-5" on claude
     without the frontend knowing a single model id.
     """
     if provider == "claude":
@@ -7267,6 +7298,15 @@ _DEFAULT_PRICING = {
     "haiku":  {"input": 1.00, "output": 5.00},
     # OpenAI Codex
     "gpt-5.3-codex": {"input": 1.50, "output": 12.00},
+    # gpt-5.6 line: sol (high) / terra (medium, default) / luna (small).
+    # UNVERIFIED RATES. The model IDs are confirmed against
+    # developers.openai.com/api/docs/models, but OpenAI's published per-token
+    # prices for this line were not, so these are placeholders scaled from the
+    # gpt-5.3 rate. They drive a display estimate only, never a gate. Replace
+    # from the pricing page; tools/probe-model-catalog.py is the refresh path.
+    "gpt-5.6-sol":   {"input": 2.50, "output": 20.00},
+    "gpt-5.6-terra": {"input": 1.50, "output": 12.00},
+    "gpt-5.6-luna":  {"input": 0.50, "output": 4.00},
 }
 
 # Active pricing - starts with defaults, updated from .loki/pricing.json
@@ -7843,6 +7883,9 @@ _PROVIDER_LABELS = {
     "sonnet": "Sonnet 5",
     "haiku": "Haiku 4.5",
     "gpt-5.3-codex": "GPT-5.3 Codex",
+    "gpt-5.6-sol": "GPT-5.6 Sol",
+    "gpt-5.6-terra": "GPT-5.6 Terra",
+    "gpt-5.6-luna": "GPT-5.6 Luna",
 }
 
 # Display-only pricing notes, keyed by model. These annotate the pricing table in

package/loki-ts/data/model-pricing.json

@@ -1,13 +1,38 @@
 {
-  "$schema_version": 1,
-  "_comment": "Rolling pricing table consumed by loki-ts/src/runner/budget.ts. Update this file when Anthropic / OpenAI / others publish new prices; no code change required. Pricing is USD per 1 million tokens. Aliases (opus/sonnet/haiku) point to the latest model of that family per providers/model_catalog.json.",
-  "_updated": "2026-06-30",
-  "_source": "https://www.anthropic.com/pricing + provider docs. sonnet=claude-sonnet-5 (list $3/$15; intro $2/$10 through 2026-08-31). opus=claude-opus-4-8. codex=gpt-5.3-codex standard tier.",
-  "pricing": {
-    "fable": { "input": 10.0, "output": 50.0 },
-    "opus": { "input": 5.0, "output": 25.0 },
-    "sonnet": { "input": 3.0, "output": 15.0 },
-    "haiku": { "input": 1.0, "output": 5.0 },
-    "gpt-5.3-codex": { "input": 1.75, "output": 14.0 }
+ "$schema_version": 1,
+ "_comment": "Rolling pricing table consumed by loki-ts/src/runner/budget.ts. Update this file when Anthropic / OpenAI / others publish new prices; no code change required. Pricing is USD per 1 million tokens. Aliases (opus/sonnet/haiku) point to the latest model of that family per providers/model_catalog.json.",
+ "_updated": "2026-06-30",
+ "_source": "https://www.anthropic.com/pricing + provider docs. sonnet=claude-sonnet-5 (list $3/$15; intro $2/$10 through 2026-08-31). opus=claude-opus-4-8. codex=gpt-5.3-codex standard tier. Cache tiers: read 0.1x input, write 1.25x input (Anthropic + OpenAI published multipliers).",
+ "pricing": {
+  "fable": {
+   "input": 10.0,
+   "output": 50.0,
+   "cache_read": 1.0,
+   "cache_write": 12.5
+  },
+  "opus": {
+   "input": 5.0,
+   "output": 25.0,
+   "cache_read": 0.5,
+   "cache_write": 6.25
+  },
+  "sonnet": {
+   "input": 3.0,
+   "output": 15.0,
+   "cache_read": 0.3,
+   "cache_write": 3.75
+  },
+  "haiku": {
+   "input": 1.0,
+   "output": 5.0,
+   "cache_read": 0.1,
+   "cache_write": 1.25
+  },
+  "gpt-5.3-codex": {
+   "input": 1.75,
+   "output": 14.0,
+   "cache_read": 0.175,
+   "cache_write": 2.1875
   }
+ }
 }