Repository navigation
C1: unify work sources and validate recovery - #8266
loopx-agent wants to merge 463 commits into
Conversation
|
This pull request has merge conflicts with Choose the remote for the base repository, not an out-of-date fork. git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEADFor a same-repository clone whose Keep the DCO |
mergify
Bot
added
needs-rebase
|
This pull request has merge conflicts with Choose the remote for the base repository, not an out-of-date fork. git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEADFor a same-repository clone whose Keep the DCO |
mergify
Bot
added
needs-rebase
|
This pull request has merge conflicts with Choose the remote for the base repository, not an out-of-date fork. git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEADFor a same-repository clone whose Keep the DCO |
mergify
Bot
added
needs-rebase
loopx-agent
left a comment
loopx-agent
left a comment
There was a problem hiding this comment.
Reviewer: model_agent, gpt-6.1-sol, OpenAI, runtime_reported, reasoning_effort=max
Request changes conclusion (author-owned PR; GitHub blocks formal self-review)
[P2] C1 仍可从旧捕获取得新租约。 旧版实际生成原捕获并写入 claim，ready 丢失后释放。当前 C1 读取未改动的同一捕获，在 File 和 SQLite 各取得活跃 epoch 2、不同 operation ID，并给原 Turn 返回 ready。 领取入口
[P2] 默认 Turn 预览越过现有预算。 真实默认 JSON turn plan 同一拥挤夹具，无 Vision 从 21,849 增至 54,074 字符，有 Vision 从 25,312 增至 61,473。既有 26,000 上限不变。base 两例通过，当前两例失败。 预览入口
动机 / Motivation
运行 Codex 原生会话、普通 quota、Turn CLI 和恢复流程的操作者依赖同一可信来源。 用户从旧版留下的 Codex 会话恢复，或者在拥挤 Goal 上先读默认计划。需要拿到完整约束并回到原 Turn，无需重新取得旧租约。 当前 C1 可运行同版本恢复和部分统一入口。真实本地入口复现升级恢复和默认预览各一项问题。 当前评审覆盖提交清单、实际 C1 CLI 路径、恢复、预算与主干组合的决定性阻塞。
改动思路 / Approach
quota 和 Turn compose 共享 work_contract，Host 与 journal 从绑定的 source 读取，authority 继续负责 lease 和结算。预览默认直接返回较大的同一工作来源。当前主干已有可复用的分页入口。 保留共享 TypeScript contract 和既有 authority 的职责分配。独立的上下文去重和读回修复可先复用，再验证当前真实单会话切换。 C1 切换 quota 和 Turn/Host 的来源。当前可审的独立传输切片在 #8285。当前 head 已合入 #8284，主干组合成功。恢复和预览需要分别通过实际入口。
具体改动 / Changes
基线为 32167518b3c2646fd9b6a3a6e0aaf74b258a7b70。C1 的单会话切换要求真实入口、完整义务、原身份与一次效果，加 §9 的原 quota 对照。 基线规范
- 原生来源。 当前 C1 在真实 File 和 SQLite 上各一次同版本对照通过。写入后中断并释放，重放同一捕获仍保留退休 epoch 1。
- 历史恢复。 旧版实际生成原捕获并写入 claim，ready 丢失后释放。当前 C1 读取未改动的同一捕获，在 File 和 SQLite 各取得活跃 epoch 2、不同 operation ID，并给原 Turn 返回 ready。
- 有界普通预览。 真实默认 JSON turn plan 同一拥挤夹具，无 Vision 从 21,849 增至 54,074 字符，有 Vision 从 25,312 增至 61,473。既有 26,000 上限不变。base 两例通过，当前两例失败。
- 完成单会话替换。 对更新后的真实组合补证据。
关键代码讲解
execute_codex_execution_preparation 从当前 capture 派生稳定 operation ID，随后让原 claim owner 和 guard 读回。handle_turn_command 将完整来源交给 build_loopx_turn_plan，默认预览省略 session 和 transaction，仍保留完整 work_contract。恢复已有 journal 时，保存的完整 lineage 与历史 decoder 分开走。 claim plan journal
对主干的风险 / Risks
当前 head 相对主干 32167518b3c2646fd9b6a3a6e0aaf74b258a7b70 的 diff 是 226 个路径。包含 #8284 的无写入主干组合通过。4 项 Anti-Entropy 对照通过，1 项 sparse numeric Effect 失败归因开放。原 capture 兼容反例从旧版真正创建的捕获开始，整个跨版本过程保留原文件。默认 preview 同一实测包含新增的 interaction、replan 与诊断正文。 已落地主干读回 旧 claim 审查
跨版本两例复现，同版本两例通过。默认 plan 的两个固定负载在 base 通过、当前失败。 Quick premerge 的 7 项直接检查和 4 项选中检查通过。当前路径还有 benchmark-sensitive 人工门。 本轮核对了当前 226 路径清单，并聚焦两个可复验的发布阻塞。整套 C1 的逐入口兼容和交付资格仍开放。 远端 CI 未取样。
语义与 CI 对齐
C1 复用了和 #8279 旧审查头相同的 digest 派生代码。旧 Host 写入普通随机 operation ID，当前派生 ID 查不到该操作，于是被既有 managed claim owner 当作新 claim。 通过既有 authority 核验并恢复真正的原 claim。旧捕获无法证明绑定时留作只读，要求使用原 Goal、Agent、Todo 和 Turn 取得新的合格 guard 捕获。保留两种 backend 的跨版本回归。 沿现有有界 preview 和已保存 source reader 分离首读与完整正文，保留所有原约束、可执行 Vision 指导和恢复命令。在 unchanged 上限重跑有无 Vision 的两例。 预算复验用 python -m pytest -q tests/control_plane/test_cli_output_budget.py::test_crowded_turn_plan_budget_preserves_executable_vision_authoring。
我的整体评价 / Verdict
对 fbd4c033e2042786dae637810c1391546ad69fcb 请求修改。先修复旧 capture 和默认预览，再基于包含 #8284 的主干组合复验。当前独立证据支持同版本原租约保护和上述两个反例。 更新后的组合须通过旧捕获恢复、默认预览、同一来源的完整消费和一次结算。全套原 quota 对照、实际安装采用和整题成本仍未验证。
English verdict: REQUEST_CHANGES. C1 still reacquires a released lease from a pre-upgrade capture on File and SQLite. Its default Turn plan also exceeds the existing budget in both matched workloads, while the clean composition with current main resolves the previous conflict.
| raise ValueError("Native execution preparation requires its original capture digest") | ||
| # The same capture can reappear after a lost readiness result. Let the | ||
| # managed claim owner recover the original receipt and current lease. | ||
| claim_operation_id = f"todo-claim:codex-capture:{source_sha256}" |
There was a problem hiding this comment.
[P2] 原租约释放后，旧版捕获仍可领取。 独立对照从旧版真实保存的原捕获和一次已写入的 claim 开始。释放 epoch 1 后，当前 C1 的 hook 取得 epoch 2 并返回原 Turn 的 ready。File 和 SQLite 都复现，同版本控制保留退休状态。请沿原 authority 证明原 operation 关联，或要求新的合格 capture。
| # The current plan has one source, so inspection retains it. | ||
| # Execution still requires its explicit surface, even if a | ||
| # caller restores omitted session/transaction metadata. | ||
| payload = dict(payload) |
There was a problem hiding this comment.
[P2] 默认 JSON 预览超出现有输出预算。 在相同的拥挤 Goal、有无 Vision 两个真实 CLI 用例中，base 为 21,849 和 25,312 字符，当前为 54,074 和 61,473，超过现有 26,000 上限。请保留有界首读和可执行 Vision 指导，把完整工作来源沿原 capture reader 提供，并重新验证两种负载。
|
This pull request has merge conflicts with Choose the remote for the base repository, not an out-of-date fork. git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEADFor a same-repository clone whose Keep the DCO |
mergify
Bot
added
the
needs-rebase
loopx-agent
left a comment
loopx-agent
left a comment
There was a problem hiding this comment.
Reviewer: model_agent, gpt-6.1-sol, OpenAI, runtime_reported, reasoning_effort=max
Request changes conclusion (author-owned PR; GitHub blocks formal self-review)
[P2] 默认 Turn 计划超出既有预算。 同一拥挤 Goal 的默认 JSON 计划，有无既有 Vision 均超 26,000 字符。无 Vision 从 21,849 增至 54,074，有 Vision 从 25,312 增至 61,473。两边使用同一 workload、CLI 参数和字符上限。 当前入口 原线程
[P2] 升级前的捕获仍可重开退休租约。 升级前用真实 Host 从旧捕获领取，ready 中断后释放 epoch 1。当前 head 重放同一未改动捕获，在 File 和 SQLite 都生成不同 claim operation，取得活跃 epoch 2，并为原 Turn 返回 ready。当前 main 同样复现旧捕获问题。 当前入口 原线程
动机 / Motivation
在 Codex 上恢复中断工作的操作者，需要判断原任务能否继续。管理拥挤 Goal 的操作者还会先运行默认计划了解下一步。 同一任务在领取后丢失 ready，随后租约被释放。恢复时应先确认原租约状态。计划读取也应在拥挤 Goal 上保留可执行指导并符合原上限。 当前 head 已保住同版本退休租约，准备阶段可按需读取长范围。升级前的捕获仍会重开租约，默认计划也超过既有上限。 本次判断覆盖当前提交的来源和恢复增量，以及两个真实入口的阻塞。完整单会话切换和安装采用仍需独立验收。
改动思路 / Approach
C1 把 quota 和 Turn 的工作输入收进 work_contract，Host 与 journal 再从绑定来源恢复。现有 claim 和 settlement owner 保持权威。最新增量补上普通准备态范围补读，独立验证通过。 保留统一工作来源与既有 authority 的分工。有界预览及升级恢复可以分别修复，并从真实入口验收。 相对前次审查，完整差异有 233 路径。最后一组提交改 5 路径，并复用现有 progressive reader。当前主干合入 #8285 后在 loopx/control_plane/quota/turn_envelope.py 出现组合冲突。
具体改动 / Changes
基线为 94b91e48aa4a2cdafe9d4d31d918fe84d0112b41。C1 切换单位同时要求普通预览、Host 消费、保存捕获和历史恢复保留原义务与身份。CLI 默认计划仍有固定拥挤预算，完整原 quota 对照由主 RFC §9 管理。 基线规范
- 原生来源。 当前 head 的同版本对照在 File 和 SQLite 都保留退休的 epoch 1，也没有 ready。另测长范围的选择/领取指针可读，就绪时还原完整 220 条。
- 历史恢复。 升级前用真实 Host 从旧捕获领取，ready 中断后释放 epoch 1。当前 head 重放同一未改动捕获，在 File 和 SQLite 都生成不同 claim operation，取得活跃 epoch 2，并为原 Turn 返回 ready。当前 main 同样复现旧捕获问题。
- 有界普通预览。 同一拥挤 Goal 的默认 JSON 计划，有无既有 Vision 均超 26,000 字符。无 Vision 从 21,849 增至 54,074，有 Vision 从 25,312 增至 61,473。两边使用同一 workload、CLI 参数和字符上限。
- 单会话切换。 修复后仍需复验同一来源的逐入口消费、原 Turn 的一次结算、安装宿主和 §9 原 quota 对照。
关键代码讲解
handle_turn_command 给普通预览保留整个工作来源。execute_codex_execution_preparation 从捕获摘要生成 operation。progressivePreparationScope 仅把准备态的大范围放入同源按需读取。 默认计划 领取 准备态首读
对主干的风险 / Risks
本次核对了 233 路径清单。真实入口评审集中在默认预览、原生恢复、最近范围增量和关联回归。旧版生产者固定为 172d80d630f424b0b44dd513863ba02b5f13d55c。基于最新主干 8225c89cea 重跑两个默认预览和 File/SQLite 旧捕获，观察保持一致。组合冲突需作者处理，复验应基于处理后的新提交。 原 quota 对照
聚焦 Python 125 项和 TypeScript 199 项通过。默认计划独立配对在主干两项通过、候选两项失败。退休租约在候选同版本两项通过，候选旧版本两项失败。 Quick premerge 的 7 项直接检查和 4 项选中检查通过。仍有一项 benchmark-sensitive 人工门。 两项既有评审线程在当前提交仍开放。保留原线程方便作者对照本轮复验。 远端 CI 未取样。
默认 plan 的展示分支仅移除 session 和 transaction，仍把完整 v1 work_contract 放进预览。基线使用有界 v0 envelope。拥挤候选保留了新的 interaction、replan、Todo 和诊断正文。 复用现有有界计划和原捕获 reader。保留可执行的 Vision 写回字段和其他当前约束，在既有 26,000 上限复验两个默认预览。 新 Host 用捕获摘要构造稳定 claim ID。同版本可沿原 managed claim 回读；旧版留下的原 operation ID 与新派生值不同，managed claim 因此进入新领取。 先沿原 authority 核验旧捕获对应的原 claim 和状态。不能证明绑定时让旧捕获保持只读，要求新的合格 guard，复验升级与同版本的 File/SQLite 路径。 计划上限 回归夹具
我的整体评价 / Verdict
对 726ab94ccfecad83a8a0b8346e699ec62ca46c62 请求修改。准备态补读和同版本恢复的局部进展已复验，普通计划和升级恢复仍各有一项待修。 修复后仍需复验同一来源的逐入口消费、原 Turn 的一次结算、安装宿主和 §9 原 quota 对照。
English verdict: REQUEST_CHANGES. Both matched default Turn plans exceed the existing 26,000-character ceiling. Pre-upgrade captures still reacquire a retired lease on File and SQLite, while same-version replay is blocked.
mergify
Bot
removed
the
needs-rebase
|
This pull request has merge conflicts with Choose the remote for the base repository, not an out-of-date fork. git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEADFor a same-repository clone whose Keep the DCO |
mergify
Bot
added
needs-rebase
loopx-agent
left a comment
loopx-agent
left a comment
There was a problem hiding this comment.
Reviewer: model_agent, gpt-6.1-sol, OpenAI, runtime_reported, reasoning_effort=max
Request changes conclusion (author-owned PR; GitHub blocks formal self-review)
[P2] 显式 quota envelope 超过现有 JSON 和 Markdown 上限。 相同小型夹具下，显式 --context-delivery off --turn-envelope 的 JSON 为 9,113 → 24,248（上限 13,000），Markdown 为 2,425 → 24,527（上限 4,800），且标题从 LoopX Turn Envelope 变为 LoopX Turn。
[P2] 显式 Turn 事务详情超过原上限。 相同小型夹具的 turn plan --include-transaction-detail 由 11,283 增至 26,886 字符，越过 15,000 的原上限。该分支保留事务，但默认首屏的按需投影并不覆盖它。
动机 / Motivation
quota 和 Turn 的现有模型、机器读取方及原生 Codex 恢复都依赖保留原身份与工作义务。 同一小型、拥挤和多 Agent CLI 夹具与实际旧捕获恢复，对照当前 main 与目标提交。 原两条旧阻塞的针对性复验通过；当前整条切换对三个显式输出产生最新主干没有的预算失败。 核对关键 CLI、原生 Hook 及恢复路径。PR 同时改动核心协议、客户端适配、测试和文档，结果不能外推到全部真实 Host 或安装采用。
改动思路 / Approach
quota 与 Turn 复用同一完整决定，展示器保留 typed route、当前权限和必读项；原生准备恢复由原租约证明裁定。显式模式仍走完整输出。 合成 owner 复用有价值，普通计划的同源读取也修复了上一轮问题。当前默认 cutover 使两种显式入口改用完整 C1 输出，仍需与现有支持面一起验收。 核对关键 CLI、原生 Hook 及恢复路径。PR 同时改动核心协议、客户端适配、测试和文档，结果不能外推到全部真实 Host 或安装采用。
具体改动 / Changes
基线为 8a4d4f9dab17b01d6fe3546936155b4d718fc20d。既有明确 off/原始输出及调用方迁移约束，以及冻结的 CLI 输出上限。 基线规范
- 旧捕获。 File/SQLite 四组真实旧版复验，无新认领、租约代次或 ready。
- 默认只读。 普通只读计划按同一来源补读，单／多 Agent 首屏 12,279／11,931 字符，拥挤重规划 21,760 字符；有 Vision 另测 23,688，均在相应原上限内。旧捕获恢复在 File 和 SQLite 未产生新的 claim、ready 或租约代次。
- 显式 quota envelope。 相同小型夹具下，显式 --context-delivery off --turn-envelope 的 JSON 为 9,113 → 24,248（上限 13,000），Markdown 为 2,425 → 24,527（上限 4,800），且标题从 LoopX Turn Envelope 变为 LoopX Turn。
- 显式事务详情。 相同小型夹具的 turn plan --include-transaction-detail 由 11,283 增至 26,886 字符，越过 15,000 的原上限。该分支保留事务，但默认首屏的按需投影并不覆盖它。
关键代码讲解
quota 合成 与 Turn 路由 保留完整决定；默认只读投影 可以按需读回。当前既有预算继续涵盖显式入口。
对主干的风险 / Risks
我把最新主干作为归因基线：这些失败可能在旧 C1 已存在，但不是当前 main 的既有失败。旧 review 的租约与拥挤首屏两例已通过。独立复验也没有把源码读取视为模型采用。
128 项 Turn/租约测试、53 项原生准备和只读回归、102 项 TypeScript 通过；旧版跨升级回放 4 项通过。 Quick premerge 的 7 项直接检查和 4 项选中检查通过。 合并树与 DCO 核对通过；保留 benchmark 人工门。 这里只报告相同输入已完成的 11×2 行实测。作者列出的其余矩阵失败未重新归因，不计入本评审通过项。 远端 CI 未取样。
我的整体评价 / Verdict
保留可用的原有显式读取路径，或通过既有 owner 交付同等语义且满足原预算的版本化契约。确需迁移时逐个核对调用方和退役安排，再提交同一主干/候选对照以及完整回读证据。 保留 C1 未完成：显式调用方预算与兼容性、原 quota 单会话模型采用及完整成本、Windows 实际私有恢复。
English verdict: REQUEST_CHANGES. Request changes. The historical lease replay and crowded default-plan findings pass on this head. Three supported explicit outputs exceed unchanged ceilings that the same fixture passes on current main; qualify those callers before the cutover.
| # A decided refusal has the same complete contract as an admission. `ok` | ||
| # still controls exit status and host handoff; composition grants no work. | ||
| if args.quota_command == "should-run" and isinstance(payload.get("interaction_contract"), Mapping): | ||
| payload = _export("compose_turn_decision")(payload, |
There was a problem hiding this comment.
[P2] Keep the explicit quota envelope within its existing caller contract
相同小型夹具下，显式 --context-delivery off --turn-envelope 的 JSON 为 9,113 → 24,248（上限 13,000），Markdown 为 2,425 → 24,527（上限 4,800），且标题从 LoopX Turn Envelope 变为 LoopX Turn。 同一 main 通过原门槛。请保留合格的兼容输出，或先完成现有调用方的版本化迁移与匹配验证。
| iteration_context_policy=args.iteration_context, | ||
| session_scope=session_scope, | ||
| goal_ref=goal_ref, | ||
| inspect_plan=(args.turn_command == "plan" and not args.include_transaction_detail |
There was a problem hiding this comment.
[P2] Qualify the complete transaction inspection separately
相同小型夹具的 turn plan --include-transaction-detail 由 11,283 增至 26,886 字符，越过 15,000 的原上限。该分支保留事务，但默认首屏的按需投影并不覆盖它。 默认首屏的修复通过。显式入口仍应保留有界、可用且可回读的原事务，或完成经验证的调用迁移。
|
This pull request has merge conflicts with Choose the remote for the base repository, not an out-of-date fork. git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEADFor a same-repository clone whose Keep the DCO |
mergify
Bot
added
the
needs-rebase
loopx-agent
left a comment
loopx-agent
left a comment
There was a problem hiding this comment.
Reviewer: model_agent, gpt-6.1-sol, OpenAI, runtime_reported, reasoning_effort=max
Request changes conclusion (author-owned PR; GitHub blocks formal self-review)
对 f73bf1c 请求修改。当前提交仍复现两个显式调用分支的原预算回归。
[P2] 显式quota输出仍越过原预算。 同一小型夹具，JSON为9,113→24,248／13,000，Markdown为2,425→24,527／4,800。正文仍完整inline，Markdown标题由LoopX Turn Envelope变为LoopX Turn。8a与最新df主干相同输入都通过原门槛。原线程
[P2] 完整事务检视仍超限。 turn plan --include-transaction-detail 为11,283→26,886／15,000。inspect_plan明确排除该分支，默认首屏按需投影无法覆盖它。原线程
动机 / Motivation
通过quota读取原工作约束、检查完整事务及恢复原生会话的操作者依赖可用的输出。 同一小型合成Goal在main与当前C1执行显式envelope及事务详情，分别保留原阈值与结果。 相同小型真实 CLI，显式 quota JSON 为 9,113→24,248／13,000，Markdown 为 2,425→24,527／4,800，事务详情 JSON 为 11,283→26,886／15,000。 本轮判断当前切换及其决定性回归。模型成果、安装采用和全部241路径的逐行资格另有未验证范围。
改动思路 / Approach
C1沿同一typed composition组织quota与Turn的完整来源，原捕获与结算owner继续负责身份和效果。普通计划已有同源按需读取，新增量让已观察Goal正文可复用，并在正文纠正、换源、不完整和压缩后恢复完整读取。当前有用边界是这些来源与恢复路径可连贯工作。显式输出也是当前writer切换的下游消费入口，需要一并资格验证。
具体改动 / Changes
按改动前 docs/architecture/rfcs/controller-executor-unified-contract-v0/contract-and-context.md、修订 8a4d4f9 审查。C1 caller replacement and cutover unit 要求入口及下游消费一起资格验证，当前显式入口仍有上述发现。Configuration and migration 的off路径仍提供完整正文，版本和预算兼容性继续收口。Delivery acceptance 中的原失败和预算均保留。基线规范
- 相对上次公开评审f352142c6f682e4fbd903cb07ebbd353403671a4，新增10路径、+270/−46。quota.py、turn.py、默认renderer和显式预算owner未改。
- 本轮完成11×2行真实File CLI对照，另以最新df主干补查。三项显式超限保持原数值，普通单/多Agent和拥挤计划在原绝对上限内。
- 新首读和原恢复相关103项Python、103项TypeScript通过，覆盖正文纠正、改源、不完整及PostCompact恢复。
- 完整PR为241路径、+20,607/−2,534。本轮重新核对清单与增量，执行范围限于明确列出的CLI和恢复路径。
对主干的风险 / Risks
基于8a的原合并树无冲突，61个commit均有DCO。主干现已更新到 df67371，当前组合在quota_capture.py、quota_presentation.py、turn_envelope.ts和test_replan_staged_read.py四处冲突。作者需处理后在新head复验。Quick的7项直接和4项所选机械检查通过，精确提交质量回执及benchmark人工门另行保留。
两项发现继续使用原讨论线程。旧租约和拥挤默认计划的历史发现保留各自复验版本，本轮通过当前入口作判断。作者其余98行、241路径逐行全面覆盖、所有Host及安装态均未在本轮资格验证。远端CI未取样。
我的整体评价 / Verdict
在既有 typed owner 中资格验证这两个显式分支，提供有界且完整可回读的输出，或用同一 workload 的语义、成本与调用方迁移证据修订版本化展示契约及预算。 本轮支持默认预览和新增恢复的局部进展，同时确认两个显式入口仍有当前回归。C1整体资格继续开放。源码CLI以外的视觉界面未检查，模型采用、安装态与完整成本未实测。
English verdict: REQUEST_CHANGES. Two supported explicit CLI branches still exceed three unchanged ceilings on f73bf1c, while the same fixture passes on both tested main revisions. Current main composition also conflicts in four paths.
mergify
Bot
removed
the
needs-rebase
|
This pull request has merge conflicts with Choose the remote for the base repository, not an out-of-date fork. git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEADFor a same-repository clone whose Keep the DCO |
mergify
Bot
added
the
needs-rebase
…-signed-integration-20261115 Signed-off-by: LoopX Agent <[email protected]>
Signed-off-by: LoopX Agent <[email protected]>
Signed-off-by: LoopX Agent <[email protected]>
…-signed-integration-20261115 Signed-off-by: LoopX Agent <[email protected]>
…-signed-integration-20261115 Signed-off-by: LoopX Agent <[email protected]>
Signed-off-by: LoopX Agent <[email protected]> (cherry picked from commit 0e6b5c7) Signed-off-by: LoopX Agent <[email protected]>
Signed-off-by: LoopX Agent <[email protected]>
…-signed-integration-20261115 Signed-off-by: LoopX Agent <[email protected]>
…ontract Signed-off-by: LoopX Agent <[email protected]> (cherry picked from commit fa5f8ac) Signed-off-by: LoopX Agent <[email protected]> (cherry picked from commit 737e34f) Signed-off-by: LoopX Agent <[email protected]>
There was a problem hiding this comment.
Reviewer: model_agent / gpt-6.1-sol / OpenAI / runtime_reported / reasoning effort max
Request changes conclusion (author-owned PR; GitHub blocks formal self-review)
动机 / Motivation
本次复审提交 1c578cf，主干 8ade78c。C1 把各宿主的选题、完整来源、派发及恢复绑定到原 Turn，同时保持原回执和一次扣额。涉及已启动过一次并用原身份重试的原生 CLI 操作者，以及生成 Codex CLI 可见 Goal 启动命令的调用方。旧失败 Turn 保留原捕获。重试前给同一 Todo 增加 Host 未提供的必需能力，然后补齐能力并重试原 Turn。File 和 SQLite 的原扣额回执补写已成功。缺能力导致的派发前拒绝仍会阻断原 Turn 恢复。本地证据来自源检出及隔离的合成 Host。现提交原生 Windows、生产安装态和 Benchmark 人工验收待复核。原 quota 单会话成果及完整成本待匹配测量。
改动思路 / Approach
TypeScript 继续校验共享契约与扣额，宿主边界可直接证明派发前拒绝，执行器负责把该事实写入原 journal。在本 PR 闭合已知拒绝的原轮恢复，并让测试断言与 Codex CLI profile 的交付契约一致。已绑定 App SSH 默认从 profile 选完整契约，settlement plan 沿原 visible-goal 身份。Codex CLI JSON 同样选择完整来源，Agent 按原计划验证后写回及扣额。相应回归读回真实生成命令、旧启动器和旧捕获。分阶段派发在发布捕获与预留前重新校验，外部 stdin 与进程内 Host 使用同一份请求。远程权威按选定注册 Goal 显式启用，本地禁用和其他 Goal 启用的 File/SQLite 对照均保持原决策。运行配置 · 分阶段契约
具体改动 / Changes
验收依据为 docs/reference/protocols/turn-envelope-v0.md，固定修订 8ade78c。original-source-and-effect 和 staged-capture-fidelity 已通过定向复测。known-pre-dispatch-rejection 和 profile-source-regression-validation 仍有下述失败。原轮协议 · C1 验收
关键代码讲解
- [P2] 持久化能力门的明确未派发结果。 current_turn_host_launch_decision 先检查当前能力，再比较原工作。首次重试在派发前返回 goal_launch_not_allowed。原 journal 已记第 2 次尝试，状态仍是 in_progress，且无 host_failure。补齐能力后原 Turn 被 Original Host attempt outcome is unknown 拒绝，无法进行原工作比较。两次拒绝均未启动新 Host、写回业务或扣额，原捕获仍可按原摘要读取。File/SQLite × 两种原捕获的四个复现实例，在 737e34f 与当前提交分别得到相同归一结果。正文、写范围和可用能力变更走 current_turn_work_changed，可由 _run_host_runner 给原尝试写 contract_rejected。缺能力抛出更早，_run_host_runner 在 journal 计数之后将异常重抛。从可信的 native 启动检查传递明确的未派发结果，并将该失败持久化到原尝试。继续检查当前权限和原捕获；确有派发但效果未明时保留原尝试对账。测试在补齐能力后应能进入原工作检查，变更仍在时拒绝，恢复原契约且获授权时再正常重试。启动资格 · 执行器 · 尝试落盘
- [P2] 让两个来源测试与新 profile 契约一致。 _publish_quota_result 依据 JSON 与精确运行配置选择完整来源，并由绑定命令传递该配置。该 profile 现以完整 envelope 交付。现头仍在两个 ordinary 用例断言初次及已绑定结果没有 schema_version 和 contract_binding。File 与 SQLite 均在测试第 751 行失败，前一正式复审提交 dd3a239 中同测的四个组合均通过。让两个 profile 用例验证当前设计的完整来源与原身份，并用编写时实际仍走紧凑输出的通用调用保留 compact 对照。同时保留两个后端、显式 off 的原交付以及逐字绑定命令的验证。新 launcher 与原 visible-goal 扣额验证另有四组通过。选择完整来源 · 仍在断言旧来源的用例
- 扣额与 staged readback。 readQuotaSettlement 核对原索引与扣额产物。补写使用原 slots/source，按同一身份重放成功，保留一个 debit。错指同 Goal 另一 Turn 的 artifact，以及明示条款冲突均拒绝。五条旧分阶段意见均复测通过。预算拒绝给出可读恢复指引，无新增私有件。临时硬链接、发布和新副本故障保留原源。上次正式评审 · 扣额读回 · 分阶段旧意见 1 · 2 · 3 · 4 · 5
对主干的风险 / Risks
当前 diff 共 284 个文件。比较两次评审的 base/head 对象，254 个 patch 逐字一致，22 个变更、8 个新增。另有 10 个路径已在当前主干含同一内容。此次重新检查增量中的启动/结算、profile 和读回、远程 opt-in、POSIX 无标志时的拒绝、smoke fixture 的原任务身份与文档。验证范围为当前源检出及相同变更的既有评审。
语义与 CI 对齐
339 项 TS 测试、类型检查、RFC 双语 diff 检查均通过。七个源回归模块结果 2 failed, 463 passed, 1 skipped。失败项 test_visible_goal_binding_command_preserves_explicit_source[ordinary-file], test_visible_goal_binding_command_preserves_explicit_source[ordinary-sqlite]。定向反例使用真实 CLI、File/SQLite 和本地确定性 Host。现提交的原生 Windows 与安装态待确认，已提供的 Windows 证据对应 737e34f。Benchmark 人工验收与同原 quota 的单会话成果和完整成本仍待确认。旧 Windows 作业
我的整体评价 / Verdict
需修复已知启动拒绝的原轮状态，并修正 Codex CLI 来源切换后失败的回归。先保留可证明的启动边界和原尝试的恢复定位，再用真实派发结果未知的分支作对照。补齐两项后用同一批 File/SQLite、原 capture 与原 debit 条款复审下一提交。
English verdict: REQUEST_CHANGES — A definite pre-dispatch capability denial leaves the original Turn unrecoverable. The Codex CLI profile switch also breaks the existing File/SQLite binding regression cases.
| except FirstPartyHostRuntimeRejected as exc: | ||
| # This check is issued only by the original-work comparison before | ||
| # model dispatch. Other refusals can still need reconciliation. | ||
| if exc.code != "current_turn_work_changed": |
There was a problem hiding this comment.
[P2] 记录缺能力引起的派发前拒绝，避免原轮卡在结果未知
首次重试在派发前返回 goal_launch_not_allowed。原 journal 已记第 2 次尝试，状态仍是 in_progress，且无 host_failure。补齐能力后原 Turn 被 Original Host attempt outcome is unknown 拒绝，无法进行原工作比较。两次拒绝均未启动新 Host、写回业务或扣额，原捕获仍可按原摘要读取。File/SQLite × 两种原捕获的四个复现实例，在 737e34f 与当前提交分别得到相同归一结果。
从可信的 native 启动检查传递明确的未派发结果，并将该失败持久化到原尝试。继续检查当前权限和原捕获；确有派发但效果未明时保留原尝试对账。
| heartbeat_turn_id is not None | ||
| and profile in {SchedulerRuntimeProfile.TRAE_APP, SchedulerRuntimeProfile.ANTIGRAVITY_APP} | ||
| ) | ||
| codex_cli_source = profile is SchedulerRuntimeProfile.CODEX_CLI_VISIBLE and args.format == "json" |
There was a problem hiding this comment.
[P2] Codex CLI 来源切换后更新两个后端的绑定回归
该 profile 现以完整 envelope 交付。现头仍在两个 ordinary 用例断言初次及已绑定结果没有 schema_version 和 contract_binding。File 与 SQLite 均在测试第 751 行失败，前一正式复审提交 dd3a239 中同测的四个组合均通过。
让两个 profile 用例验证当前设计的完整来源与原身份，并用编写时实际仍走紧凑输出的通用调用保留 compact 对照。同时保留两个后端、显式 off 的原交付以及逐字绑定命令的验证。
Signed-off-by: LoopX Agent <[email protected]>
…-signed-integration-20261115 Signed-off-by: LoopX Agent <[email protected]>
Signed-off-by: LoopX Agent <[email protected]>
Signed-off-by: LoopX Agent <[email protected]>
…-signed-integration-20261115 Signed-off-by: LoopX Agent <[email protected]>
loopx-agent
left a comment
loopx-agent
left a comment
There was a problem hiding this comment.
Reviewer: model_agent / gpt-6.1-sol / OpenAI / runtime_reported / reasoning effort max
Approval conclusion (author-owned PR; GitHub blocks formal self-approval)
动机
C1 将已纳入的调用方接到同一工作来源。影响在原生 Host 重试原 Turn 或通过 Codex CLI 绑定 Todo 的操作者。缺少必需能力时，旧版本留下结果未知。现头记录已知拒绝，恢复原要求后继续原会话。File 和 SQLite 均已验证原会话恢复、一次扣额和实际 CLI 绑定。本次验收覆盖隔离 Core 和脚本化模型传输。Windows 原生执行、完整 App 安装态与 Benchmark 人工验收待完成。
改动思路
可信启动守卫判断能否派发，原 journal 持久化该尝试并驱动会话恢复。当前 C1 交付统一来源、原轮恢复和一次结算。启动守卫拒绝时由已有失败类型承载，app-server 已准备的 session 随原操作继续。派发后的未知结果沿原尝试对账。Codex CLI 绑定命令验证所选 profile 和原 Turn。启动守卫 · 原尝试落盘
具体改动
- File 和 SQLite 独立重现缺能力和工作改变。现头先以
contract_rejected持久化goal_launch_not_allowed，补齐能力后继续比较原工作并在仍有变化时返回current_turn_work_changed。两个拒绝期间 Host 输入字节保持一致，扣额为零。将要求还原后，当前和历史捕获均可恢复原会话并只扣一次。原捕获回归 - 原生 app-server 在线程已准备时撞到启动限制。再试使用同一
thread/resume；保存的 App 创建操作在最终配额拒绝后仍登记在原操作下，配额恢复本身不会产生turn/start。会话绑定与恢复 · App 创建拒绝 - Codex CLI 默认与显式完整模式的生成绑定命令在两个后端通过。显式关闭逐步交付时仍保持原绑定，通用 quota 对照继续产生 compact。CLI 绑定测试
关键代码讲解
FirstPartyHostGoalAdmission.launch_lifetime 只在进入守卫时产生 FirstPartyHostLaunchRejected。_host_result_stage 用这份证据记录 host_invoked=false，在明确拒绝后保存原会话恢复条件。run_codex_operation_host 在建立 app-server 绑定后标记 session 已准备，下一次沿同一线程继续。启动边界 · App-server 绑定
语义与 CI 对齐
核对了当前 288 文件的完整差异及前一次复审的证据范围。278 文件的 base 到 head 变更相同，6 文件更新，4 文件新增。当前独立验证 591 项源代码检查通过、1 项跳过，隔离 Core 39 项与 TypeScript 650 项通过，另有 typecheck、Ruff 和双语 RFC 检查。原生调用通过可观测的脚本化模型传输。GitHub CI 由合并流程读回。
适用契约为 docs/reference/protocols/turn-envelope-v0.md，基线 08cc6ef5b9a15a5a74d3e56ba4114cb09b2033ee。本轮验证对应 original-source-and-effect、staged-capture-fidelity、known-pre-dispatch-rejection、recovery-of-prepared-session、profile-source-regression-validation。基线契约
对主干的风险
派发时获取当前资格，失败后的可恢复性由原 journal 决定。原生 Windows 的 ACL 与实际安装的 Codex App 仍需要各自的执行和读回见证。隔离 Core 覆盖包内 CLI，Benchmark 还需维护者验收，以及与原 quota 匹配的单会话成果和完整成本对照。已合并的 #8825 等待分支随基线进入，本次两条恢复路径通过现头复验。C1 范围和验收
我的整体评价
当前提交 15e1fd2eb3b518c2c5ad8956e18c05b07bf96514 通过代码评审。上一轮两项问题已复验修复。迁移阶段已经交付可独立验证的原轮恢复和统一来源；各宿主的实际采用和 Benchmark 比较仍需其维护者完成。
English verdict: APPROVE | Exact head 15e1fd2eb3b518c2c5ad8956e18c05b07bf96514. File and SQLite verified known pre-dispatch refusal, recovery of the original session, and Codex CLI binding. Native Windows, installed App adoption and Benchmark qualification remain open.
|
This pull request has merge conflicts with Choose the remote for the base repository, not an out-of-date fork. git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEADFor a same-repository clone whose Keep the DCO |
…-signed-integration-20261115 Signed-off-by: LoopX Agent <[email protected]> # Conflicts: # docs/reference/protocols/turn-envelope-v0.md # loopx/agent_onboarding.py # loopx/agy_goal_mode/__init__.py # loopx/cli_commands/turn_run_once.py # loopx/control_plane/quota/turn_envelope.ts # loopx/control_plane/turn_driver/driver.py # loopx/control_plane/turn_driver/executor.py # tests/control_plane/test_host_current_admission.py # tests/test_agy_host_surface.py
Signed-off-by: LoopX Agent <[email protected]>
动机 / Motivation
C1 给显式启用的调用方、Codex CLI /goal、已绑定的 SSH Goal 和 benchmark 原生 worker 提供可校验的统一工作来源。选 Todo、重读上下文及结算沿同一 Turn 和原捕获执行。Codex App 原生心跳的新捕获现在默认走完整来源，其他普通 quota 调用暂沿用原路径。 / C1 gives opt-in callers, Codex CLI /goal, bound SSH Goals and native benchmark workers a verifiable work source through selection, context recovery and settlement. New native Codex App captures also use this source by default. Other ordinary quota callers retain their existing delivery.
改动 / Changes
0.167.0-alpha.4.1paginated rollout. A selected page must match the native call observed by its Bash hook. A verified reread can restore missing byte coverage, and complete independent selections remain reusable.最新候选 / Latest candidate
6415e3607502同步main@f7e3f427197b，包含 #8828 的外部 Host 原工作校验、Antigravity 启动补充和原轮结算恢复。原生和外部 stdio 继续从原捕获比较完整契约，并绑定原硬租约的执行标识。即使负责人和 Todo 正文相同，释放后重新取得租约也必须启动新的合格 Turn。原生首次派发和显式重试会在启动模型、写回和扣额前拒绝，外部 stdio 重试在创建进程前拒绝。原租约续期后可以继续派发。6415e3607502integratesmain@f7e3f427197b, including the external Host work check in #8828, the Antigravity bootstrap fixes and original-Turn settlement recovery. Native and stdio dispatch compare the original complete contract and bind its hard-lease execution key. Release and reacquisition require a fresh eligible Turn even when the task and owner match. Native initial launch and retry refuse before model dispatch, writeback or debit. The stdio retry refuses before spawning the adapter. Renewal retains the execution key and permits launch.On
15e1fd2eb3b5, all four native lease-replacement cases reached model dispatch. Plain Codex CLI also wrote state and debited quota on both backends. The new File/SQLite cases exercise plain Codex CLI, operation-equipped app-server and the external stdio adapter, including refresh of the same lease and reading back the original failed Turn. The CLI, authority stores and launch transports run directly. The model responses are scripted.The managed Task Stop regression now injects the activation change at the dedicated native Task call. It verifies one dispatch, a stopped Goal readback, and no writeback or debit after Stop.
本地验证覆盖 475 个 Python 用例，修正 Stop 夹具后重跑全部 97 个 Steward 用例。通过 165 项 TypeScript 检查用例及类型检查、25 项隔离 Core 用例和预检的 7 项直接检查与 19 项自动用例。
Local validation covered 475 Python cases, including a repeat of the full 97-case Steward suite after fixing the Stop fixture. Type checking and 165 TypeScript cases, 25 isolated Core cases, and the seven direct and 19 automated premerge checks all passed. The Benchmark manual review, an independent review of this head, packaged and installed adoption, and the matched single-session outcome and total-cost comparison remain open.
上一候选 / Previous candidate
15e1fd2eb3b5同步main@08cc6ef5b9a1，修复上一版的两项评审意见。启动检查在派发前因缺少能力拒绝时，原 Turn 记录明确的契约拒绝，保留原捕获和会话恢复记录。只补齐能力而任务仍有变化时，旧 Turn 拒绝执行。恢复原要求后，File/SQLite 均能续跑原 CLI 会话并只扣额一次。若操作 Host 已在 app-server 创建会话，下一次显式重试恢复同一线程。真正的派发结果未知仍需对账。15e1fd2eb3b5incorporatesmain@08cc6ef5b9a1and addresses the two requests on the previous head. A launch guard denial for missing capabilities is recorded before model dispatch and retains the original capture and session recovery. Adding the capability still refuses changed work. Restoring the original requirements resumes the CLI session and debits once on File and SQLite. An operation Host that prepared an app-server session resumes that thread on explicit retry. An uncertain dispatch continues to require reconciliation.Codex CLI 的真实绑定命令现在按完整来源校验，覆盖默认与显式完整输出、显式关闭交付选项、原 Turn 回执。通用 quota 的精简输出用既有对照单独验证。 / Real Codex CLI binding tests now validate the complete source for both implicit and explicit output, the explicit delivery settings, and the original Turn receipt. The separate generic quota control exercises compact output.
原生 App 的已保存创建请求在最终配额检查拒绝后继续停留在原操作，恢复配额本身不会派发模型。 / A saved native App creation request stays on the original operation after a final quota denial. Restoring quota alone starts no model Turn.
Launch refusal review
Codex CLI profile review
Exact-head validation passed 49 focused Python cases and 51 TypeScript cases, plus the control-plane typecheck. The isolated Core wheel passed 13 cases on the same runtime tree at
ba53d6bb4427. Native Host tests use scripted model transports.Local premerge passed all 7 direct and 19 automated checks, including the bilingual RFC and both isolated installation smokes. The Benchmark maintainer hold, independent review of this head, native Windows and full installed App adoption, and the matched single-session outcomes and complete costs remain open.
SSH Goal 默认采用完整契约 / Default complete contract for SSH Goals
在
c46917e7b6c3，同一个已绑定的 SSH Goal 少传--complete-turn就会产生旧格式的决策。候选996a29b353c9由运行配置选择统一契约。生成的守卫、选 Todo、原生认领和恢复都沿同一 Turn，使用按内容摘要校验的来源和共享结算规则。--context-delivery off提供内联交付。较早捕获以原格式和原指纹读取，恢复后继续同一个 Turn。At
c46917e7b6c3, a bound SSH Goal emitted a legacy decision when the launcher omitted--complete-turn. At996a29b353c9, the runtime profile selects the complete contract through the generated guard, Todo selection, native claim and recovery. These use the digest-bound source and shared settlement rules for the same Turn. Explicit context-delivery off produces inline delivery. Older captures are read with their original format and digest before the same Turn resumes.8daa5c523098, then resumed it on this head with the original digest and exactly one claim.main@35c5efbd4b90passed 7 direct and 19 automated checks. Its benchmark-sensitive checks require maintainer review. The PR still needs independent review, native Host qualification and the matched single-session outcome and cost comparison.638b7e3c23f0修正了仍要求生成命令携带--complete-turn的两处断言。完整执行 heartbeat transport 文件的 74 项测试均通过，验证覆盖实际 guard、原回执读回和幂等结算。 / Follow-up638b7e3c23f0aligns two assertions with profile-driven SSH delivery. All 74 tests in the heartbeat transport suite passed, including the rendered guard, original receipt readback, and idempotent settlement.Codex CLI
/goal默认来源 / Default source for Codex CLI/goal在
5ccfaf7fde91，已保存的 Codex CLI 启动命令生产普通 quota 包。即使显式关闭上下文交付，选 Todo 的命令也可能丢失设置并重新启用渐进交付。1a3740cf9e6e让该运行配置在首读、绑定和原 Turn 恢复时走已有 TypeScript 组合。选题及无 Todo 重规划保留交付设置。Agent 仍按原visible-goal身份验证写回再扣额。At
5ccfaf7fde91, the saved Codex CLI bootstrap produced ordinary quota packets. Its Todo selection command could drop explicit off and activate progressive delivery again. At1a3740cf9e6e, the runtime profile selects the existing TypeScript composer for preview, binding and original-Turn recovery. Selection and Todo-less replan preserve delivery settings. The Agent validates writeback before spending on the originalvisible-goalidentity.254271e0e8b0. The native heartbeat and preparation suites passed 147 cases after their ready-capture test began reading both required sections. The final head passed 14 targeted source cases and 7 direct plus 19 automated local premerge checks. Benchmark-sensitive review still requires a maintainer.前一候选的集成验证 / Prior candidate integration checks
1c578cfe85c2同步main@8ade78cddeb6。新版 Turn 在派发前通过 TypeScript 校验，进程内和外部 stdin 共用这份已校验请求，旧适配器只在读取过渡版本时转换。所选 Todo 的正文、写入范围或所需能力变更时，原生重试记录明确的契约拒绝，原捕获仍可读，新模型调用与新扣额均为零。任务未变时，重试沿原 Turn 恢复。At
1c578cfe85c2onmain@8ade78cddeb6, the external process consumes the same checked request as the in-process Host. Recorded transitional plans keep their compatibility conversion. Native retry records a known rejection when the original Todo body, required write scopes or capabilities changed. The capture remains readable and the refused attempt dispatches no model and spends no quota. An unchanged Todo can retry the original Turn.默认采用扩大仍需补齐原 quota 单会话的匹配成果与完整成本，以及相应宿主的实际采用。 / Broader default adoption still needs matched single-session outcomes and complete costs against original quota, plus adoption in the affected Hosts.
当前候选：原扣额身份 / Current candidate: original debit identity
在
48973a3b8163，两个 Turn 即使同属一个 Goal、槽数与来源相同，索引错指到另一轮的扣额文件也会把本轮报告为已结算。在8daa5c523098，结算读回和撤销扣额核对原扣额身份。当前回执、旧回执缺省字段、无回执三种情况都拒绝错指；恢复原文件后补回原回执，不新增扣额。At
48973a3b8163, pointing a Turn's debit index at another Turn's file returned settled when both debits shared a Goal and billing terms. Candidate8daa5c523098verifies the original debit identity in both settlement readback and void. Current, legacy-incomplete, and missing receipts all reject the wrong file. Restoring the original file recovers the same Turn without another debit.The same installed Core regression fails on the baseline and passes on the candidate with File and SQLite. Eight focused source CLI cases, six isolated Core cases, 206 TypeScript cases, typecheck and Ruff pass. Standard premerge against
main@1965965992ffhas zero failures across seven direct and 19 automated checks, including installation. Independent review, native Windows/Host qualification, the Benchmark manual gate, and the matched single-session outcome and cost comparison are still pending.原轮扣额回执恢复 / Original Turn debit receipt recovery
在
48973a3b8163，原扣额明细缺失而原扣额仍有索引与回执时，两个结算入口使用同一份原准入记录验证明写的槽数和来源。两槽冲突、来源冲突和缺少核验依据都会返回错误。早期回执中实际缺省的字段仍可读回。隔离 File 和 SQLite 的前后对照在f878b52171c3重现误报，修复后 14 项真实 CLI 用例、158 项 TypeScript 测试及类型检查通过。同一轮只保留原扣额。新提交的复审及 Windows 检查待完成。At
48973a3b8163, both settlement entrypoints check explicit receipt terms against the original admission when the debit artifact is missing but its index and receipt survive. A conflicting slot count, conflicting source, or explicit source without evidence is rejected. Receipts with genuinely omitted historical fields remain readable. File and SQLite reproduce the false success atf878b52171c3. The fix passes 14 real CLI cases, 158 TypeScript cases, and typecheck, with one retained charge. Review and Windows validation are pending for this revision.已扣额、但结算回执丢失时，
quota spend-slot和refresh-state --settle-turn都用已核对的原槽数与来源补回一张回执，保留原 Turn 和那一笔扣额。读取历史时，缺省、空串和null均视为未提供；账本与回执明确写出不同槽数或来源时仍拒绝确认。Both settlement entrypoints now rebuild a missing receipt using the terms checked against the original debit. Recovery keeps the original effect and does not charge again. Historical omissions, including
null, remain readable; conflicting explicit terms still fail closed.The exact review of
dd3a239c8618reproduced the failure on File and SQLite. All six focused cases fail on that revision and pass with the repair. Both isolated Core and full wheels atf878b52171c3pass the six cases, covering either entrypoint as the first retry, both subsequent replays, unchanged debit files/index, and legacy omissions and conflicts. TypeScript typecheck, Ruff and 232 TypeScript cases pass. Standard premerge againstmain@b46a76d2d64bran 7 direct and 19 automated checks with no failures, including the local installer. The Benchmark manual gate and independent review of the new head remain open. The native PowerShell workflow selects these cases; native Windows results are pending.当前切片 / Native Codex App source cutover (a979660)
Codex App thin heartbeats now save the checked complete work contract for new native captures without adding a bootstrap flag. The ordinary guard, same-Turn selection and post-claim guard use the existing TypeScript composer. This retires the unsigned writer for that App path. Ordinary non-native CLI, explicit raw delivery and the benchmark treatment keep their existing routes.
The isolated Core wheel resumed an actual unsigned capture from the preceding candidate on both File and SQLite. The native hook retained the original claim and Turn, validated the new ready capture, and recovered a lost hook reply. Each recovered Turn settled once; replay left one debit. The tests also reject a replaced ready capture or one stripped of its version and binding. The thin bootstrap and bound selection tests exercise the emitted commands.
In six matched native delivery pairs (File/SQLite, cold, warm replay and compaction reset), guard plus four initial pages changed by -25 B per pair. Two full recovery pages used 375–378 B less; the on-disk decision used 2,237–2,241 B less. These are CLI transport measurements. They do not establish lower model cost or original-quota single-session outcome parity. The broader default, required independent review, benchmark manual acceptance and installed-host qualification remain open.
验证 / Validation
Candidate
aa27669ec9synchronizesmain@5890cecd43, including the Turn path for recording a fresh checkpoint while preserving an unchanged plan. The synchronized head passed 309 targeted tests across Turn execution, quota composition failure, native resume, and partial settlement, plus five real Codex loopbacks. Premerge ran six direct checks and 19 automated checks with zero failures. Exact-head review and GitHub CI remain open.Against
main@e94c549e8d, candidate5be44386bepassed five standard-install Codex loopbacks, including ordinary Code Mode replay, benchmark preflight, and three selected-page coverage cases. The same isolated installed test one06a2941f8incorrectly reused a multi-page selection when a later emission copied its missing page without a new Bash hook. The candidate rereads the affected selection, preserves an independent single-page selection, and accepts an independently verified replacement. Full candidate premerge ran six direct checks and 19 automated checks with zero failures.The preceding
e06a2941f8also passed 30 isolated Core wheel tests, eight standard-install native Codex loopbacks, and 20 File/SQLite settlement cases. Native loopbacks use deterministic local inference. Exact-head independent review and GitHub CI remain pending.Default rollout requires the matched single-session outcomes and full-cost evidence in RFC §9. Earlier measurements are in the source convergence ledger.
Shared fixes and current candidate
29096950ce, the rebuilt, source-verified C1 bundle passed Goal hierarchy, delegation search and cancellation on File and SQLite, and conversation activity in Chromium. The checks cover cross-Goal bookmark clearing, Back restoration, read cancellation and recovery, and zero Session resumes on view switches.当前候选 / Current candidate (
0aa2cf5f250d)visible-goalTodo can complete, persist its writeback and debit its original slot. A fully receipted historical debit keeps its recorded source on replay. A missing receipt still requires the original admission terms, and a different slot count or conflicting charge is rejected. MCP fix and upgrade evidencevisible-goal; KunlunCode debitedheartbeat. Each retained one original debit. The final revision updates three test fixtures; its runtime sources match the tested wheel. 104 focused Python cases, 186 TypeScript cases, control-plane typecheck and Ruff passed.0aa2cf5f250d, standard premerge passed seven direct and 19 automated checks. The Benchmark manual review hold remains. Independent review of this revision, hosted Windows evidence and signed-in Host adoption are pending. The matched single-session comparison of accepted outcomes and end-to-end costs remains a gate for broader default rollout.Previous candidate (
41dbb178e18f)main@6dfd1c90c4c1: 30 focused host source checks passed and one native PowerShell case was skipped. Installed macOS Core passed original settlement and Trae auto/off on File and SQLite. The isolated Core and full wheels also passed the generated activation and the wrong-registry refusal on both providers (bootstrap-command-packin Core;agent-onboardin full). The unchanged TypeScript sources ate3391c47b2passed the control-plane type check and 320 tests.Previous candidate (
e7b3402dc6b2)6fe2ec767ee6. Its file tree equals the prior unsigned squash71ccd34c39ca. The branch update used a lease on the exact prior head. Source baseline ismain@48dbebbd14c5. Trae cutoverPrevious candidate (
b8ac1ec5443b)bootstrap-command-packandagent-onboardnow resolve a caller-supplied relative runtime root in the requested project's scope when the registry is only inherited throughLOOPX_REGISTRY. This closes the cross-project routing defect in the previous exact-head review. An explicitly supplied--registry, an absolute runtime root and the default-route conflict still follow their existing rules.main@74ca883d5bd3and the TypeScript part of #8758. The inherited duplicate-digest audit failed locally before the change; the shared matcher and its source audit pass now. The unrelated Chat changes remain in Reuse shared digest checks for Chat images and native child results #8758.2c099be41e68. Both hosted jobs and independent review need evidence at the new head. The matched single-session outcome and full-cost qualification is still open.Previous candidate (
2c099be41e68)Saved
quota context-project --initial-readuses the live reader’s selection priority. The original execution decision and claim requirement precede the long work body. The first page and continuation pin the same capture and selection. The two already-issued cursor formats retain their earlier byte order and digest.main@a547d404991b; the HTTP revalidation tests verify that the original Turn survives a concurrent status read. An explicit stdout assertion also restores the type check for the source lease probe added by fix(coordination): tolerate Windows ctime skew in source lease reads #8761.Prior candidate (
6a31d83497a6)6a31d83497a6removes the paired v1 decision and v0 executor adapter from the private Turn planner. New plans take the signed complete decision directly. Saved transitional plans still validate both carriers against the original capture before resuming. An equally signed old adapter is now rejected at the new planning boundary; an altered adapter is still refused during historical recovery. The regular quota default, explicit off and history support are unchanged.This head also fixes the differential probe's handling of relative PowerShell launchers with quote characters in a capture path. PowerShell 7.5.4 on macOS exercised both the relative launcher and the explicit invocation form; native Windows and private ACL qualification are still separate.
loopx-corewheel rebuilt from this same head passed the 39-case installed execution, context, recovery and refusal suite. Run these checks serially against a shared disposable install: the missing-file and distribution-record negative cases temporarily modify that install. An independent test of this head also passed 64 Host cutover and acceptance cases, including rejection of stale review evidence after a later work update.4604f938b612after writeback. All four File/SQLite and 32/33-requirement combinations recovered the signed original capture and settled its pending debit once. Both versions refused tampered capture bytes. The next admission in each expanded store retained all 33 requirements. See #8775 for the rollback procedure.main@83809355f84a(three existing bounded heartbeat growth observations). Standard premerge had no automated failures and still requires manual review for the benchmark-sensitive changes. Exact-head external review, native Windows/ACL and the benchmark manual gate remain outstanding.Previous integrated host candidate (
826c6efa62ad)826c6efa62adpreserves the selected LoopX installation, project registry and runtime through Antigravity activation. Its generated wake and Stop routes keep an explicit--cli-bin, including when anagent-onboardfollow-up regenerates the pack. The project and runtime routing changes remain from #8768 and #8771. Omitting the runtime with two populated defaults still refuses the ambiguous route. Agent-bound timer probes only observe; unbound sidecars keep context delivery off.An explicit
--turn-envelope --context-delivery offnow returns v0 after a successful checkpoint handoff, the same view as without the socket. The Host holds and releases the exact signed v1 bytes first. A dropped or rejected release returns a typed transport failure with the original receipt and digest; interrupted-tool recovery reads the original complete capture. Default native heartbeat workers still use C1.main@4604f938b612with three existing growth observations for review. Standard premerge completed six direct and 19 automated checks with no failures and retained one benchmark-sensitive manual hold.loopxfirst on PATH and two populated default roots. Both stores preserved the chosen executable and settled once after a lost response. The original 12 checkpoint/history cases and 247 worker/transport/DSH cases (4 skipped) passed on the immediate short-view parent; the activation-only commit does not change those owners.79d7ebc81fbc. This remains separate from a signed-in desktop model run. The Windows PowerShell reader launcher was repaired and covered on macOS; native Windows differential and ACL still need exact-head evidence.59f7d1c872dc. On both File and SQLite,main@4604f938b612verified the original digest, settled exactly once after committed writeback, and admitted the next Turn with all 33 acceptance records intact. The earlier pin could recover the saved capture, but rejected current authority and continuation with extended records.4604f938b612is the named tested rollback candidate for this CLI/backend path; verify the actual host and drain the original pending effects before changing an installation.Broad ordinary-quota default adoption and historical reader retirement still depend on applicable caller migration and matched single-session outcomes and full-cost evidence in RFC §9.
Prior candidate c3cb8b2
Candidate
c3cb8b2fe7bfpreserved the exact source tree ofa4c9cc250a89(df1aede749632). The two GitHub squash commits for #8748 and #8757 lacked DCO trailers. Their original signed branch heads are now ancestors through signed integration commits. The source diff between the old and new heads is empty. The local check using the target branch's DCO rules verified 397 signed commits and one exempt, GitHub-verified two-parent merge.The source-identical candidate
a4c9cc250a89fixes literal saved-capture selection. An explicitcontext-project --select /replan_action_packetreturns the original value and its recovery preserves that packet. The immutable main baseline passed the same File and SQLite cases, the preceding candidate changed those values, and the corrected CLI passes both. Automatic initial read and navigation retain staged replan commands.The saved/replan/reader cases passed 146 tests. Exact-head premerge completed six direct and 19 automated checks with zero failures. The benchmark-sensitive maintainer hold remains.
The preceding candidate
aab22d9ed7bdincorporatesmain@45cfd0c86d8fand both scoped host changes. The Antigravity default cutover (#8748) and protected Windows stateless readback (#8757) landed in this PR branch.Independent review on c3cb8b2 approved the scoped recovery and saved-selection fixes. File and SQLite read back the original field and executable writeback, and repeated publication failures leave no new copy. GitHub records this conclusion as a comment from the PR author's account. The earlier formal change request, open review threads, benchmark maintainer review and required branch checks remain open.
Earlier candidate evidence
Candidate
b5dc37fad58c9includesmain@859a23ee9534. At the time of its validation, GitHub reported it mergeable and still recorded the earlier change request.9c39566d50b2. Its tree matches the locally composed source that passed 69 TypeScript cases and six macOS CLI cases. The author's isolated PowerShell 7 comparison covers the installed Python rendering fix with Windows command selection simulated. Native Windows ACL, shell and original settlement evidence remains separate. The branch retains native Delta qualification by host and the existing POSIX boundary for bounded legacyquota spend-slot.6e169353095astacks cleanly and passed its Antigravity, Codex App and benchmark worker default/recovery cases. Combining that candidate with the Windows patch also passed eight macOS cases for staged replan reads and Antigravity wake and settlement.Independent review of this head and closure of outstanding review threads remain necessary. The scoped host changes can be evaluated independently. Broad defaults and legacy retirement still depend on the matched single-session outcomes, complete costs and actual caller adoption required by RFC §9.
26a7480a3b4bincorporatesmain@1cdd9bbefd1dafter #8695. The merge resolves a single Steward test conflict by retaining the typed activation fixture. Main's Steward and Lark triage implementation is intact. The merged candidate passed 228 relevant Steward, Lark and history tests, plus the bilingual RFC and diff checks. GitHub reports no conflict and still records changes requested. Standard premerge at this commit completed six direct and 19 automated checks with zero failures. The benchmark-sensitive maintainer check remains open. The following C1 execution results are from the preceding commit.2a863df8e7afincludesmain@bd2718a485c8. The open recovery now retains a caller-owned capture root and delivery mode through both the original and the following Turn. The saved decision digest remains pinned. An isolated wheel exercised eight File/SQLite interruption combinations with and without the explicit C1 source, with one original writeback, one debit and no repeat debit. The Antigravity default-source change has its own review and release qualification in #8748.2a863df8e7affinished with six direct checks, 19 automated checks and zero automated failures after an isolated retry of a timed-out installer check. The benchmark-sensitive manual review remains open.GitHub reports no merge conflict and still records changes requested on an older head. Both issues in that review, DSH compatibility and the independent thin-heartbeat observer, pass locally on the current candidate. Independent re-review of the current commit, resolution of actionable review threads, the benchmark maintainer check and applicable branch checks are the remaining merge gates. The ordinary CLI keeps its existing source. Wider defaults and old-path retirement still require host adoption and matched single-session outcome and complete-cost evidence.
Prior MCP reentry evidence
Candidate
7273ac790baddresses the MCP turn-start reentry finding. A quota request now retains its initial turn-start observations and GoalRef through inline selection and the independent MCP replan fallback. Each reentry refreshes the live decision through the existing owners.The real Claude MCP stdio tool and its quota CLI ran against File and SQLite with a local Lark provider executable. At
2bfc7e9d90, each selected request read history three times and replaced the initial success with a later rate-limit failure. The candidate reads once and retains the initial observation. A separate request reads again and reports its own provider failure. Independent replans commit zero bound Guard receipts and zero spend. All 101 adjacent tests pass at both revisions, with two additional reentry regressions passing on the candidate. Standard premerge ran six direct and 19 automated checks with zero failures. The new head requires independent review.Prior MCP admission and native replay evidence
Candidate
d2c480c9badmits ordinary MCP work throughshould_run(todo_id=...).The adapter uses the same typed Turn identity as
complete_task, includingwhen an Agent selects a non-recommended Todo. The original signed decision
continues to expose the Core facts. The host channel guides selection and
withholds the delivery Todo until the interaction contract admits it.
On the same File and SQLite fixture, the prior generated choice with a
caller-generated Turn admitted work but stopped at the completion guard
even with a verified artifact. A manually aligned identity confirmed the
cause. In the isolated standard wheel, the chosen alternative admitted
under the MCP identity. An ineligible choice and a missing artifact were
rejected. The verified artifact settled that identity once, retry returned
the original result, and the other Todo was still available. A higher-priority
replan uses the existing CLI route before reserving the Todo Turn. The SQLite
probe completed that replan and the later Todo as distinct Turns, one debit
each. The outer controller retains admission and settlement on its own route.
The candidate retains #8693's native replay fix. A same-Todo verified section
reuses its digest while a changed stop condition is still delivered. The peer
measured 11,978 B to 631 B for the selected opening body. A different Todo,
source, text or actual compaction required a fresh read. The preceding
combined head passed 11 native cases in source and in a standard wheel.
Standard premerge completed six direct checks and 19 automated checks with
zero failures. Independent review and required GitHub checks remain open.
RFC §9 still needs matched single-session outcomes and full costs before a
broader default switch and old-path retirement.