loki-mode 9.22.4 → 9.22.6

package/docs/EXECUTION-COCKPIT-PLAN.md

@@ -0,0 +1,289 @@
+# Execution Cockpit - build plan
+
+Lane: LOKI-EXECUTION-COCKPIT-70. Scope: `web-app/` only, plus the narrowest
+`web-app/server.py` read adapter if strictly necessary (see "Backend changes").
+
+## 0. What was read, and one correction
+
+The directive says "read AGENTS.md fully". **There is no `AGENTS.md` at the repo
+root** (`find . -maxdepth 3 -name AGENTS.md` returns nothing). Read instead:
+
+- `CLAUDE.md` (root, project instructions) - style rules, release workflow.
+- `BRANDING.md` - Loki (agent/OSS) vs Autonomi (commercial). Local web app is
+  "Loki Mode dashboard", so cockpit copy uses Loki, never Autonomi.
+- `COMPONENTS.md` - component map. **Stale claim corrected**: it labels
+  `web-app/` "deprecated v7.44.0", but web-app is live and shipped -
+  `package.json:99-109` publishes `web-app/dist/` + `server.py`,
+  `prepublishOnly` builds it, `autonomy/loki:7496` serves it via `loki web`, and
+  three feature commits landed in `web-app/src` after v7.44.0 (`9e0cfdb0`,
+  `4d8299c9`, `4831933b`). Building here is correct.
+- `docs/COCKPIT-SPEC.md`, `docs/COCKPIT-UX-MANDATE.md` - prior cockpit work.
+  Both target the **terminal** surface (`loki cockpit`, in-terminal image
+  render). This plan is the **web** cockpit; it inherits their principles
+  (honest always, never fake progress, alive-not-static, identity-first) and
+  does not touch the terminal path.
+- `web-app/server.py` (8782 lines) - the API the web app actually calls.
+  **Not** `dashboard/server.py`, which is a different surface on a different port.
+- `web-app/src/**` - App.tsx routing, `api/client.ts`, `types/api.ts`,
+  `components/ui/*`, `tailwind.config.js`, `ProjectWorkspace.tsx`,
+  `EvidenceReceiptPanel.tsx`.
+
+## 1. The product
+
+Not chat. An **issue-to-PR execution cockpit**: one screen that answers, in
+order, the four questions a reviewer actually has.
+
+1. **What was it asked to do, and how will we know it worked?** - task header
+   with the goal and acceptance criteria.
+2. **Where is it now?** - calm phase timeline plus elapsed / time-to-first-signal.
+3. **What did it change, and what proves it?** - changed-file review surface and
+   evidence attached to the outcome.
+4. **What do I do about it?** - final actions, each either real or honestly
+   disabled, plus risk and rollback.
+
+Agent chatter (logs, per-agent traces) is **secondary and collapsed by default**.
+
+## 2. User journey
+
+```
+  Projects list  ->  /project/:sessionId/cockpit
+                          |
+      +-------------------+-------------------+
+      |                                       |
+  LIVE (this session is the running one)   HISTORICAL (any other session)
+      |                                       |
+  header: goal + acceptance                header: goal + acceptance
+  timeline: current phase pulses           timeline: rendered from final status,
+  metrics: elapsed ticking                   labelled "historical", no ticking clock
+  evidence: gates as they land             evidence: gates as recorded
+  actions: pause / stop (real)             actions: open PR / rollback (real)
+  chatter: live log stream                 chatter: stored session log
+```
+
+Entry: a "Cockpit" affordance on the existing project route. Exit: back to the
+workspace or to the projects list. Deep-linkable; survives reload.
+
+## 3. State model - the load-bearing decision
+
+Live run state on this backend is **global**, not per-session:
+`/api/session/status`, `/api/session/checklist`, `/api/session/logs`,
+`/api/session/agents` and `/ws` all read one module-level `session` singleton
+(`web-app/server.py:140`). There is exactly one running build per server.
+
+Review state is **per-session**: `/api/sessions/{id}/git/status`, `/git/log`,
+`/git/pr`, `/checkpoints`, `/github/prs/*`.
+
+The cockpit spans both, so it must decide which mode it is in. The predicate:
+
+```ts
+// LiveBinding: the global run telemetry belongs to THIS session only when the
+// running process is working in this session's directory.
+isLive = status.running && normalize(status.projectDir) === normalize(session.path)
+```
+
+Both sides are absolute paths: `SessionDetail.path` is `str(target)`
+(`server.py:3831`) and `StatusResponse.projectDir` is `session.project_dir`,
+assigned from the resolved project dir at `server.py:2704`. `normalize` strips a
+trailing slash only; no other coercion, because a coincidental match would be
+worse than a miss.
+
+**When `isLive` is false the cockpit renders zero live facts** - no phase pulse,
+no ticking elapsed, no "running" badge. It shows the historical view sourced from
+`SessionDetail.status` and the per-session endpoints. This is the single rule
+that keeps the screen from inventing a run.
+
+### View states
+
+| State | Predicate | Renders |
+|---|---|---|
+| `loading` | detail fetch in flight | skeletons in the real layout shape |
+| `empty` | detail loaded, no PRD and no changed files | "nothing recorded for this session yet" + what would populate it |
+| `running` | `isLive && !paused` | live timeline, ticking elapsed, live gates |
+| `paused` | `isLive && status.paused` | timeline frozen with an explicit paused marker, Resume enabled |
+| `recovering` | `isLive && status.exit_code == null && phase == 'starting'` | "starting up" - the backend's own synthetic phase, labelled as such, never as progress |
+| `failed` | `!isLive && detail.status == 'failed'`, or `isLive && exit_code not in (null, 0)` | failure header, exit code, last output, rollback surfaced first |
+| `completed` | `!isLive && detail.status == 'completed'` | historical timeline, evidence, final actions |
+| `disconnected` | WS closed while `isLive` | last-known state, dimmed, with a "reconnecting" note and the age of the data |
+
+`disconnected` is not decoration: the WS reconnects on a 3s timer
+(`client.ts:786`) and a stale screen that looks live is an invented fact.
+
+## 4. Phase map - the highest-risk table
+
+The backend's phase vocabulary is **not** the directive's six display phases.
+Real values, traced to source:
+
+| Backend value | Written by | Display phase |
+|---|---|---|
+| `idle` | `server.py:2924` default | Not started |
+| `starting` | `server.py:2996` synthetic (<15s, nothing on disk yet) | Understanding |
+| `BOOTSTRAP` | `run.sh:6270` seed record | Understanding |
+| `REASON` | `run.sh:3485` `get_rarv_phase_name` | Planning |
+| `ACT` | `run.sh:3486` | Editing |
+| `REFLECT` | `run.sh:3487` | Review |
+| `VERIFY` | `run.sh:3488` | Testing |
+| `BUILDING` | `run.sh:26167` `_advance_current_phase` | Editing |
+| `COMPLETED` | `run.sh:26286` | PR-ready |
+| `FAILED` | `run.sh:26289`, `:26294` | Failed |
+| `UNKNOWN` | `run.sh:3489` | Unknown |
+| anything else | - | **renders the raw string verbatim** |
+
+Both routes persist the RARV name: bash at `run.sh:22295`, Bun via
+`updateCurrentPhase` (`loki-ts/src/runner/autonomous.ts:670` ->
+`state.ts:632`). The map lives in one exported constant so it is greppable and
+testable. An unmapped phase is shown as itself - never silently bucketed.
+
+Two honesty notes the UI must carry:
+
+- RARV phases cycle (`iteration % 4`), so the timeline is **not** a monotonic
+  progress bar. It renders as a repeating cycle with the current step marked,
+  and iteration N of max shown alongside. Presenting REASON->VERIFY as a
+  one-way march would misrepresent the engine.
+- `starting` is the server's own placeholder for "process alive, nothing written
+  yet". Labelled "starting up", not counted as work done.
+
+## 5. Metrics
+
+| Metric | Source | Honesty rule |
+|---|---|---|
+| Elapsed | `status.uptime` (seconds, server-computed) | Ticks locally between 2s pushes; resets to server truth on each push. Only when `isLive`. |
+| Iteration | `status.iteration` / `status.max_iterations` | `max_iterations` falls back to env default 10 (`server.py:2977`); shown as "of ~10" when it came from the fallback is over-claiming, so we show the bare number and the max without an "estimated" claim only when a real value was read. If `max_iterations` came from the env fallback we render iteration alone. |
+| Cost | `status.cost` | Zero renders as "not recorded", never "$0.00 spent". |
+| Time to first result | **client-observed only** | The first transition out of `idle`/`starting` seen *by this mount*. `.loki/app-runner/first-preview.json` exists in the engine but **no web-app endpoint serves it** (`grep -n first-preview web-app/server.py` -> nothing). So TTFR is labelled "first signal seen this session" and is **hidden entirely on a reload that missed the transition**, rather than shown as an authoritative number. |
+
+## 6. Evidence
+
+| Tile | Source | Empty behaviour |
+|---|---|---|
+| Quality gates | `GET /api/session/checklist` -> `.loki/state/checklist.json` | The endpoint returns all-zeros with `items: []` when the file is absent (`server.py:3160`). **Zeros are not "all passing"** - renders "no gate results recorded". |
+| Evidence receipt | `GET /api/proofs`, `/proofs/summary`, `/proofs/{run_id}` | Reuses the existing `EvidenceReceiptPanel`; no second receipt view. `unknown` stays its own bucket. |
+| Changed files | `GET /api/sessions/{id}/git/status` | **Dedupe by path.** The endpoint emits two entries for one path when it is both staged and unstaged-modified (`server.py:5405-5411`), so a naive count is wrong. Staged/unstaged is folded into one row per path. |
+| Tests / build / lint | `POST /sessions/{id}/test`, `/review` | These **run** things and return `{output, returncode}` - they are actions, not passive evidence. The tile shows "not run" until the user triggers it, and never implies a result that was not fetched. |
+
+## 7. Actions - capability table
+
+Every affordance is checked against a real endpoint. Anything without one
+renders disabled **with a visible reason**, never a dead grey button.
+
+| Action | Endpoint | State | Guard |
+|---|---|---|---|
+| Pause | `POST /api/session/pause` | Real | Enabled only when `isLive && !paused` |
+| Resume | `POST /api/session/resume` | Real | Enabled only when `isLive && paused` |
+| Stop | `POST /api/session/stop` | Real | Enabled only when `isLive`; confirm step |
+| Open PR | `POST /api/sessions/{id}/git/pr` (title, body) | Real | Needs title; disabled when no changed files, reason shown |
+| Commit | `POST /api/sessions/{id}/git/commit` | Real | Disabled when working tree clean |
+| Push | `POST /api/sessions/{id}/git/push` | Real | Disabled when nothing ahead |
+| Rollback | `POST /api/sessions/{id}/checkpoints/{cp_id}/restore` | Real, **destructive** | Two-step confirm naming the checkpoint. Disabled with "no checkpoints recorded" when the list is empty. |
+| Request change | `POST /api/sessions/{id}/chat/preview` (dry-run diff) | Real, read-only | Shows what *would* change. Deliberately **not** wired to `chatStart` - that is the chat surface this product is not. |
+| Approve | none | **Disabled / planned** | No endpoint approves a local run. `reviewGitHubPR` approves an *existing GitHub PR*; offered only when a PR number is known, otherwise the button reads "requires an open PR". |
+
+## 8. Responsive behaviour
+
+- **Mobile (<768px) - monitoring.** Single column, sticky task header, timeline
+  as a vertical stepper, metrics as a two-up row, evidence and diff collapsed
+  into disclosures. Actions in a bottom bar (the repo already has
+  `MobileBottomNav.tsx` as precedent). Diff bodies are horizontally scrollable,
+  never squeezed.
+- **Tablet (768-1279px).** Two columns: timeline + metrics left, evidence and
+  diff right.
+- **Desktop (>=1280px) - review.** Three regions: task header full-width;
+  timeline + metrics + risk in a left rail; diff review as the main surface;
+  evidence docked right. Chatter is a collapsed drawer at the bottom.
+
+Existing `react-resizable-panels` is available, but the cockpit uses plain CSS
+grid - fixed regions, no resize handles to fiddle with. (Noted because
+`resizable-panels` v4 reads a bare numeric `size` as pixels, a known trap here.)
+
+## 9. Accessibility
+
+- **Landmarks**: `header` / `nav` / `main` / `aside` / `footer`, each labelled.
+- **Keyboard**: every action reachable by Tab in visual order; the diff file list
+  is a roving-tabindex listbox (Up/Down to move, Enter to open); `g` then a digit
+  jumps to a region; `?` opens a shortcut sheet; Esc closes any disclosure. No
+  keyboard trap - the chatter drawer uses the existing `useFocusTrap` only while
+  it is modal on mobile.
+- **Live regions**: phase changes and gate results announce via a polite
+  `aria-live` region, throttled so a 2s push does not spam a screen reader.
+  Elapsed does **not** announce.
+- **Reduced motion**: follow the existing `motion-reduce:animate-none` idiom
+  (`ui/Badge.tsx:32`). The phase pulse, progress transitions, and any
+  celebration become static under `prefers-reduced-motion`.
+- **Contrast**: body text on `#FFFEFB` uses `muted-accessible` (`#6B6960`), not
+  `muted` (`#939084`), which fails AA at small sizes.
+- **Status is never colour-only**: every state carries an icon and a text label.
+- **Dark mode**: `darkMode: 'class'` with a full `dark-*` token set - every
+  surface carries a dark variant or half the app looks broken.
+
+## 10. Files
+
+New, all under `web-app/src`:
+
+| File | Role |
+|---|---|
+| `cockpit/phases.ts` | The phase map (section 4), display metadata, `mapPhase()` with verbatim fallback |
+| `cockpit/useCockpitState.ts` | Fetches session detail + status + checklist + git status + checkpoints; owns `isLive`, view state, WS subscription, TTFR observation |
+| `cockpit/TaskHeader.tsx` | Goal + acceptance criteria + provider/branch identity |
+| `cockpit/PhaseTimeline.tsx` | The calm timeline; cycle-aware, reduced-motion aware |
+| `cockpit/RunMetrics.tsx` | Elapsed, iteration, cost, TTFR - each with its empty rule |
+| `cockpit/ChangeReview.tsx` | Deduped changed-file list + diff pane |
+| `cockpit/EvidencePanel.tsx` | Gates, receipt link, test/build/lint "not run" states |
+| `cockpit/RiskPanel.tsx` | Uncertainty + rollback affordance |
+| `cockpit/FinalActions.tsx` | Section 7 table, rendered |
+| `cockpit/AgentChatter.tsx` | Collapsed-by-default log drawer |
+| `cockpit/ExecutionCockpit.tsx` | Composition + layout + keyboard map |
+| `pages/CockpitPage.tsx` | Route shell, error boundary |
+
+Modified:
+
+| File | Change |
+|---|---|
+| `src/App.tsx` | One route: `/project/:sessionId/cockpit` |
+| `src/api/client.ts` | Only if a needed call is missing a wrapper (additive) |
+| `src/types/api.ts` | Add `exit_code` / `last_output` to `StatusResponse` - the server already returns them (`server.py:3025-3026`); the type just never declared them |
+
+### Backend changes
+
+**None planned.** Everything the cockpit needs is already on `web-app/server.py`.
+If a genuine gap appears, the adapter goes in `web-app/server.py` (the server the
+web app talks to), not `dashboard/server.py`. Any such addition is read-only and
+called out in the final report.
+
+## 11. Verification
+
+`web-app` has **no unit-test harness** - only Playwright e2e (`tests/e2e/`,
+baseURL `127.0.0.1:57375`) and pytest for the server. No new dependencies. So:
+
+1. `npm run build` (`tsc -b && vite build`) - typecheck + build.
+2. `npm run lint` - eslint.
+3. A deterministic Playwright spec, `tests/e2e/cockpit.spec.ts`, driving every
+   view state via `page.route()` interception of the API - no live build needed.
+   Fixtures cover: loading, empty, running, paused, recovering, failed,
+   completed, disconnected, and the **non-live** case (a session that is not the
+   running one must show zero live facts).
+4. A pure-function check on `mapPhase()` over every row of the section-4 table
+   plus an unmapped value - the one place a silent bug would be invisible.
+
+Screenshots: captured with the installed Playwright only if a browser binary is
+already present. If `npx playwright install` would be required, screenshots are
+skipped and that is reported, not silently omitted.
+
+## 12. Acceptance criteria
+
+- [ ] No live phase, elapsed, or running badge renders when `isLive` is false.
+- [ ] Every phase in the section-4 table maps to its stated display phase; an
+      unmapped phase renders verbatim.
+- [ ] An absent checklist renders "no gate results recorded", never a green 0/0.
+- [ ] Changed-file count matches distinct paths when a file is both staged and
+      unstaged-modified.
+- [ ] Every disabled action states its reason in visible text.
+- [ ] Rollback requires a confirm naming the checkpoint.
+- [ ] Full keyboard traversal of header, timeline, diff list, and actions.
+- [ ] Every animation is inert under `prefers-reduced-motion`.
+- [ ] Mobile layout is single-column with no horizontal page scroll.
+- [ ] Dark mode renders every cockpit surface.
+- [ ] `npm run build` and `npm run lint` pass; the Playwright cockpit spec passes.
+
+## 13. Out of scope
+
+Version bump, release, commit, push. Any external or public mutation. Changes to
+`dashboard/`, the terminal cockpit, or the chat surface.

package/docs/HARNESS-INTELLIGENCE-PLAN.md

@@ -0,0 +1,194 @@
+# Harness Intelligence Plan (features 5-8)
+
+Lane: LOKI-HARNESS-INTELLIGENCE-69. Status: plan + MVP implemented, unreleased.
+
+## Preconditions, stated honestly
+
+**AGENTS.md is not present in this repository.** Verified with
+`find . -name AGENTS.md -not -path "*/node_modules/*"` -> no results. The binding
+instruction set used for this work is `CLAUDE.md` (repo root) plus the global
+`~/.claude/CLAUDE.md`. If an AGENTS.md is expected to exist, this plan needs
+re-review against it.
+
+**Feature numbering is taken from the directive, not from an in-repo backlog.**
+No numbered backlog entry for features 5-8 was found; `docs/V8-MAJOR-RELEASE-PLAN.md`
+numbers its harness-intelligence items `3a`-`3d` (all shipped in v8.0.0). The
+mapping used here comes from the approved decomposition in the directive:
+
+| # | Feature | Module |
+|---|---------|--------|
+| 5 | Deterministic task-class -> capability-tier router | `loki-ts/src/runner/capability_router.ts` |
+| 6 | Local evidence-backed repository profile | `loki-ts/src/runner/repo_profile.ts` |
+| 7 | Parallel execution manifest | `loki-ts/src/runner/exec_manifest.ts` |
+| 8 | Deterministic recovery policy | `loki-ts/src/runner/recovery_policy.ts` |
+
+## The binding architectural constraint: parity is fixture-locked
+
+`loki-ts/tests/parity/build_prompt.test.ts` asserts **60 SHA-256 byte-exact
+fixtures** over `buildPrompt()`. Each fixture supplies its own env object
+(`const env = { ...fx.env }`), so any new env var is *absent* during parity runs.
+
+This makes default-off gating an architectural requirement, not a preference:
+
+> **Every one of the four modules reads its flag first and returns the
+> identity/passthrough value when the flag is unset.**
+
+This is the existing codebase idiom, already used by `tierRouteModel`
+(`loki-ts/src/providers/claude_flags.ts:84`):
+
+```ts
+if (process.env["LOKI_TIER_ROUTING"] !== "1") return model;
+```
+
+Consequence: with all four flags unset, `buildPrompt()` output is byte-identical,
+model resolution is byte-identical, and the bash route is untouched. No bash
+mirror obligation is incurred, because no default-path behavior changes.
+
+## Ownership boundaries (exact)
+
+Deliberately narrow, to keep `autonomy/run.sh` collision-free. Each module is a
+new file with a small pure-function interface; none of them edit `run.sh`.
+
+### Feature 5 - capability router owns model identity
+
+`capability_router.ts` is **the only module that may emit a provider/model ID.**
+
+- Consumes `getRarvTier()` (`rarv.ts:81`) for the session/RARV tier.
+- Reuses `envPinned()` semantics from `claude_flags.ts` for explicit overrides.
+- Precedence, highest first: **explicit model override** (`LOKI_CLAUDE_MODEL_*` /
+  `LOKI_MODEL_*`) > **session ceiling** (`LOKI_SESSION_MODEL` pin) > task-class
+  routing > passthrough.
+- The session ceiling is a *ceiling*: routing may move down from it, never up.
+- Recovery (feature 8) may request only a **tier**; it never names a model.
+
+### Feature 6 - repository profile owns learned/profile state
+
+- Writes `.loki/profile/repo-profile.json` via `lokiDir()` (`util/paths.ts:47`)
+  and `atomicWriteFileSync` (`state.ts:208`).
+- Record carries a **content hash** (over the evidence inputs) and a
+  **freshness** timestamp. A profile whose hash no longer matches, or that is
+  older than the TTL, is stale and is not injected.
+- **Namespace/privacy:** the profile is namespaced per repository, and only
+  evidence-backed *facts derived from files in the repo* are recorded. No
+  absolute host paths, no environment values, no secrets.
+- **Bounded injection:** the prompt fragment is hard-capped in characters. An
+  over-cap profile is truncated, never injected whole.
+
+### Feature 7 - execution manifest owns worktree/result validation
+
+- Declares streams with **acceptance criteria**, **non-overlapping path scopes**,
+  a **base SHA**, and exactly **one integration owner**.
+- Overlapping path scopes are **serialized**, not run in parallel.
+- A stream result whose base SHA no longer matches HEAD is **rejected as stale**.
+- **Reads** the repo-profile snapshot; **never writes** learned memory. This
+  matters because `create_worktree` (`autonomy/run.sh:5205`) does `cp -r .loki`
+  into each worktree, so a worktree-local write would fork the profile per
+  stream. The profile is read-only from the parent.
+- Recovery does **not** own merges; the manifest's integration owner does.
+
+### Feature 8 - recovery policy owns failure -> action mapping
+
+Builds on the seams that already exist:
+- `classifyFailure()` (`retry_class.ts:80`) for provider-wire failure classes.
+- `LAST_ERROR.json` (schema at `autonomy/run.sh:1800`) for the current failure.
+- The append-only bounded archive written by `_loki_archive_last_error`
+  (`autonomy/run.sh:1845`, capped at 50 entries) is **the repeated-signature
+  circuit-breaker input.** It already exists; recovery reads it.
+
+Mapping (deterministic, table-driven):
+
+| Classified failure | Action |
+|---|---|
+| auth / unknown model / bad request / quota | `stop` (no retry) |
+| transient (rate limit, network, 5xx) | `retry` under caps |
+| compile / test failure | `revise` |
+| corrupted working tree | `checkpoint_rollback` |
+| provider unavailable | `failover` (tier request only) |
+| caps exhausted / repeated signature | `escalate` then `stop` |
+
+Caps: max attempts, max wall-clock seconds, max cost. Any cap exceeded -> escalate.
+
+**Hazard, load-bearing.** `retry_class.ts` carries a long comment explaining that
+the text it classifies is *the agent's entire 64KB captured output*, not a provider
+error envelope; patterns matching ordinary application vocabulary previously fired
+on benign output and killed healthy builds. Compile failures are exactly that
+category (an agent that builds a compiler test emits the trigger text). Therefore:
+
+> **Compile classification is driven by a build exit code / build-command capture,
+> never by a regex over agent prose.**
+
+## Rollout flags (all default OFF)
+
+| Flag | Feature | Unset behavior |
+|---|---|---|
+| `LOKI_CAPABILITY_ROUTER=1` | 5 | passthrough: returned model unchanged |
+| `LOKI_REPO_PROFILE=1` | 6 | no profile read, no prompt injection |
+| `LOKI_EXEC_MANIFEST=1` | 7 | no manifest planned or validated |
+| `LOKI_RECOVERY_POLICY=1` | 8 | existing `shouldStopRetrying` behavior verbatim |
+
+Cap overrides (only meaningful when feature 8 is on):
+`LOKI_RECOVERY_MAX_ATTEMPTS` (3), `LOKI_RECOVERY_MAX_SECONDS` (1800),
+`LOKI_RECOVERY_MAX_COST` (unset = uncapped), `LOKI_RECOVERY_SIGNATURE_THRESHOLD` (3).
+
+Profile knobs: `LOKI_REPO_PROFILE_TTL_SECONDS` (86400),
+`LOKI_REPO_PROFILE_MAX_CHARS` (2000).
+
+## Acceptance
+
+1. With all flags unset, `bun test tests/parity/` stays 60/60 byte-exact.
+2. Override precedence: an explicit `LOKI_CLAUDE_MODEL_PLANNING` survives routing.
+3. Session ceiling is never exceeded upward by task-class routing.
+4. A profile with a mismatched content hash or expired TTL is not injected.
+5. Profile injection is bounded to `LOKI_REPO_PROFILE_MAX_CHARS`.
+6. Overlapping path scopes serialize; a stale base SHA is rejected.
+7. An auth failure produces `stop` with zero retries.
+8. A transient failure produces `retry` while under caps.
+9. A compile failure produces `revise`.
+10. A repeated failure signature at threshold produces `stop`.
+11. State artifacts are truthful: no artifact claims an action that did not run.
+
+## Migration and recovery
+
+- **Migration: none required.** All four features are additive and default-off.
+  An existing `.loki/` directory needs no change; a missing `.loki/profile/`
+  is created on first write when feature 6 is enabled.
+- **Forward compatibility:** every persisted record carries a `schema_version`.
+  A record with an unrecognized `schema_version` is treated as absent, never as
+  an error, so an older binary reading a newer artifact degrades to default-off
+  behavior rather than crashing.
+- **Recovery from corrupt state:** an unparseable profile / manifest / recovery
+  artifact is treated as absent. Delete `.loki/profile/` or `.loki/manifest/` to
+  reset; nothing else depends on them.
+- **Rollback:** unset the flag. No persisted state needs cleanup, because no
+  default path reads these artifacts.
+
+## What is WIRED vs what ships as a SEAM
+
+Stated explicitly, because an unstated seam reported as a feature is not honest.
+
+| # | Module | Status |
+|---|---|---|
+| 8 | recovery policy | **WIRED.** `autonomy`'s retry branch calls `decideRecovery` (`loki-ts/src/runner/autonomous.ts:878`), replacing the direct `shouldStopRetrying` call. Default-off delegates to it verbatim. |
+| 5 | capability router | **SEAM.** Exercised by feature 8's `failover` tier request; no call site yet resolves a dispatch model through it. |
+| 6 | repository profile | **SEAM.** `buildProfile()` never self-triggers, so nothing builds a profile in a live run yet. Trigger belongs at run start, next to the existing memory-context assembly in `build_prompt`. |
+| 7 | execution manifest | **SEAM.** Planning/validation are pure functions; the parallel path (`create_worktree`, `autonomy/run.sh:5205`) does not consult them yet. |
+
+The vertical slice is coherent rather than four demos: feature 8 is live on the
+real retry path, and its `failover` action requests a tier that feature 5 owns
+resolving. The remaining call sites are deliberately deferred, not forgotten.
+
+## Integration order
+
+1. Feature 5 (router) - no dependencies.
+2. Feature 6 (profile) - independent; only feature 7 reads its snapshot.
+3. Feature 8 (recovery) - depends on 5 for tier-request resolution.
+4. Feature 7 (manifest) - reads 6's snapshot, and uses 8's classification for
+   stream-level failures.
+
+## Non-goals for this MVP
+
+- No provider network calls anywhere in these modules.
+- No version bump, no release, no commit, no push.
+- No edits to `autonomy/run.sh` (collision avoidance is the point).
+- No automatic merge behavior; the manifest records an integration owner and
+  validates results, and a human or the existing merge path performs merges.