[cocolord]

Goal And Delivered Outcome

• Outcome basis: maintainer-authorized R1 caller-overhead slice in the small-kernel RFC.
• Gap and result: a staged complete-v1 Turn performed host_context immediately before the mandatory host_dispatch_context. The staged path now uses that final check once while still running the complete original request assembly. The public builder keeps its existing validation and signature.
• Observable before → after: the staged operation trace changes host_context from one call to zero and retains one host_dispatch_context. The same source, carrier, numeric/text values, metadata, rejection precedence and pre-admission effect boundaries pass the paired checks below.
• Intended base: main@37a79decfe9964212c5a0795cd22e869e4191775. Related to the R1/M3 checkpoint and C1 C1: unify work sources and validate recovery #8266 compatibility; this does not complete those programs.

Author Declaration

• Written by: model_agent — OpenAI GPT-6 through TRAE.
• Specification and revision: small-kernel RFC, maintainer-agreed bounded request-check frame, and existing Host source/capture contracts at the same base.

Criterion	Disposition	Symbol / path	Test or command
Remove the redundant staged source projection without moving admission/publication	implemented	executor._build_staged_dispatch_request, run_loopx_turn_once	Paired staged operation trace; File/SQLite interval-wait and rejection oracles
Preserve complete assembly, shallow-alias guards and inspection → key → route precedence	implemented	executor._assemble_loopx_turn_host_request, public builder	test_turn_host_decision_capture.py: strict route flags, staged mutations, complete values and native-child bool/int cases
Keep legacy/unusual carriers, typed source authority, conversion and fresh effect boundaries	implemented	Original completion path, captured_turn_host_input, final dispatch	Transitional adapter control; source/header/bridge refusal; true Core execution/replay/recovery
Establish full R1/M3, C1 cutover or model/complete-cost improvements	out_of_scope	Existing RFC checkpoints	Original requirements and prior failures remain open

• Self-check: characterized the untouched base before extraction; compared main and a clean main+C1 composition; checked real persisted File/SQLite behavior and independent installed Core ownership; ran the final-head quick premerge, public-boundary scan, semantic inventory and bilingual RFC gates. The private assembly/finish seam is the bounded refactoring pass; Python remains a transport adapter to the existing TypeScript owner.

Scope And Continuation

The author slice is complete within its scope: only executor.py, the existing capture test module and the English/Chinese RFC checkpoint change. The optimized branch requires a staged plan-v1 and an assembled Host-v1 request containing work_contract with no turn_envelope. Every other shape retains the original finish. No public disable-validation flag, cached checked source, new state vocabulary or decision owner is introduced.

The final dispatch check remains before admission and capture publication. Incoming, public-builder, preview, legacy, recorded recovery, native-startup and post-Host/intent boundaries retain their owning checks. Full original-goal regression, complete costs, actual-model adoption and the existing R1/M3/C1 successor work remain separate. The slice is independently reversible by restoring the staged call to the public builder.

Validation

• Tested revision: 726ac214f9535f7c26201af83dae33068cbec796. Behavior and installed-only checks used isolated candidate snapshots before commit; their production bytes were read back against this commit. Final-head quick premerge ran directly on this commit.
• Run state: finished.
• Input classes: synthetic, public_fixture.

Check kind	Result	Public-safe evidence / limitation
regression_parity	passed	42 focused File/SQLite cases on each main baseline/head arm. Inspection/key/strict-route precedence, nested source/header mutation, adapter control, exact numbers/text, subagent/native metadata and zero-effect refusals remain intact.
regression_parity	passed	42 cases on each clean main+C1 baseline/head arm with one identical adapted harness. C1 uses its accepted direct-source planner API. The initial removed-keyword setup failed before the executor and is retained separately; only disposable input preparation was adapted.
regression_parity	passed	Startup, transport permission and actual encoder → offloaded-snapshot oversize failures retain exact exception/diagnostic/message, original plan/observation and zero admission, publication, Host, journal or ledger effects. A deliberately dropped goal reference fails the independent oracle; restored source passes. These are bounded fault models, not a claim of all I/O equivalence.
real_entrypoint / real_backend	passed	Separate true Core wheels for main candidate and main+C1 candidate: 15 installed-only checks each, including namespace/RECORD ownership, File/SQLite execution/checkpoint, one Host/debit, exact replay and journal readback, process loss, renewed/released lease refusal and invalid-artifact rejection. Synthetic Host and independent artifact validator; no model service.
unit	passed	uv run --extra test python -m pytest tests/test_loopx_turn_executor.py tests/test_loopx_turn_driver.py -q: 332 passed. The 42 focused cases also pass on the candidate.
static	passed	Final-head quick premerge: six direct and four selected checks; bilingual RFC, maintainability, semantic vocabulary, source boundary and public boundary all pass. Initial missing TypeScript dev dependency was resolved with locked npm ci --ignore-scripts --offline; the failed run is retained.
manual	not_run	Independent exact-head PR review, managed-Goal change-quality receipt, merge readiness and merge authorization remain maintainer gates.

• Coverage and gaps: local checks use Python 3.13.5, serving Node 26.0.0 and SQLite 3.54.1 with independent source/wheel/RECORD/runtime origin readback. No PostgreSQL authority, default provider routing or product UI changes. No timed/model/benchmark campaign ran; no total latency or complete-cost gain is claimed. Baseline test-assertion correction and C1 setup failures remain distinguished from product failures. An independent public CLI/capture readback and CI remain review evidence to attach separately.

Frontend / Visual Evidence

• UI impact: none. First viewport, states/viewports, attention and craft review: N/A; the existing caller journey and presentation are unchanged.
• Source data: none for visual evidence.

Type of Change

• Refactoring (no functional changes)
• Documentation update
• Test update

LoopX Area

• Control plane (goals, todos, quota, scheduler, registry, runtime)
• Host or runtime integration

Technical Direction

• R1 caller overhead under the existing small-kernel RFC; full R1/M3 and C1 default cutover remain unqualified.

Shared-authority RFC fixture impact

N/A: this changes a Python request adapter and removes one redundant projection, without promoting a provider, changing authority/routing, or claiming shared-authority migration progress. File/SQLite and C1 composition rows above qualify the touched behavior.

Boundary Checklist

• Neither the diff nor this body exposes private state, credentials, raw traces/verifier output, internal links or local machine paths.
• No duplicate maintainer-owned benchmark work.
• Change stays within the accepted request-check slice.
• Both existing RFC mirrors change; staged and exact-head bilingual gates pass.
• UI impact is marked none.
• Every commit has a DCO Signed-off-by trailer.

Final independent qualification at the unchanged head

• Reviewed head: 726ac214f9535f7c26201af83dae33068cbec796; base: main@37a79decfe9964212c5a0795cd22e869e4191775. The accepted RFC link and original scope above remain authoritative.
• Refreshed related C1: #8266 at 1a3740cf9e6ebad337f17967452693a9050edc81. Separately pinned current compositions pass six identical case/status groups per arm: 42 staged guards/carriers, 15 CLI default/selection, 19 original reader/recovery, 29 provider/inspection, 2 import contracts and 15 installed Core checks. Source, wheel, RECORD and actual Node/SQLite origins were independently read back. Controlled guard/import rows retain their narrower scope; whole C1/default cutover is not approved here. Earlier C1 evidence remains tied to its old pin.
• Independent Main real-path comparison preserves all original cases and full input/output/publication/Host values. Original numeric differences remain explicit: 222 original clock differences plus 32 legacy compaction metadata differences. An additive correction verifies the original binding input/result and actual consumer lineage for 20 previously incorrect raw-stage pointers; original comparison reports and failures are retained. No timing or complete-cost claim follows from this proof.
• Root standard premerge passes 6 direct and 14 selected checks. Author quick qualification remains separately recorded above. Latest available CI is 28 success, 11 failure, 8 skipped, 1 cancelled and 6 pending; failure causes remain partly unresolved and merge-readiness is separate from the code judgment.
• This is the bounded caller slice described by the existing R1/RFC checkpoint. Actual-model adoption, complete closure/cost, platform qualification and original-goal regression remain open.

[cocolord]

Reviewer: actor_kind=model_agent; model=GPT-6; provider=OpenAI; declaration_source=self_reported; runtime execution identity unavailable.

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

动机 / Motivation

现有 native Turn 中需要 capture、需要 Host attempt，并产生 source-only Host-v1 carrier 的调用方遇到这个重复装配开销。

capture staging 后，旧路径先计算 host_context，随后立即执行强制 host_dispatch_context；新路径保留完整 assembly 和强制 dispatch，只省去紧邻 dispatch 的一次重复来源投影。

已验证的局部结果是 staged host_context 从1次降到0次，host_dispatch_context 保持1次，原来源、必要字段、诊断、拒绝顺序和 effect 边界保留。Main 与最新 C1 组合均有独立配对行为和真实 Core 来源证据。

本 PR 不认证完整 R1/M3、D2/D5 闭包、实际模型采用、总延迟或完整成本改善，也不代替 C1 的完整 cutover 和原目标回归。

本 PR 的当前 C1 相关调用方资格已闭合；完整 C1 迁移、完整 R1/M3、实际模型采用、完整成本及平台验收仍各自待验证。

评审固定在 8820@726ac214f9535f7c26201af83dae33068cbec796，目标分支为 main@37a79decfe9964212c5a0795cd22e869e4191775。依据是 最小内核 RFC §5、§9、§11 的同一严格治理 owner、按需组合和明确资格边界，以及当前 C1 PR #8266 的完整 source、identity、admission、capture、recovery、settlement 方向。

具体问题是 staged canonical request 在紧邻最终 dispatch 的构造中先计算一次 host_context，随后 mandatory dispatch 再验证同一完整 source。这个 PR 将局部重复交给既有 typed owner 收敛，同时保留最终 source delivery 检查。它有独立可审查的 runtime 增量；该增量不能认证完整 R1、实际模型采用、完整成本、Standard 产品旅程或 M3 包拆分。已有 C1 owner 和当前生产 caller 为改动提供必要上下文，无须增加 Python 决策 owner 或 TS checked-result cache。

改动思路 / Approach

assembly/finish seam 复用原有 transport、typed source 和 native effect owner，不增加 validator、公开跳过开关或持久缓存；局部可回滚的机制与当前任务边界相称。

本次只删除立即 canonical staged dispatch 之前的重复来源投影，公开、legacy 和后续 effect 的独立校验继续保留。

build_loopx_turn_host_request 的公开签名仍相同。原装配移入 _assemble_loopx_turn_host_request，原 finish 移入 _complete_loopx_turn_host_request，公开 builder 仍执行完整两步。新 private _build_staged_dispatch_request 只供执行器原 mandatory host_dispatch_context 参数使用：plan-v1、request-host-v1、存在 work_contract 且不存在 turn_envelope 的形状才省去嵌套 host_context；captured_turn_host_input 保留，其余形状执行完整旧 finish。

这不是跨阶段缓存。装配中的 inspection、Turn key、route、snapshot/header/value guard 和拒绝顺序必须继续执行；最终 dispatch 仍先于 admit_start 和 publication。公开调用方、incoming、legacy、recorded recovery、publication 文件重查、native startup 后、post-host 和 intent/settlement 边界均保留 fresh 检查。Frozen capture 含浅别名，不能据其名称推断 plan、route、observation 或 work contract 深度不可变。work_identity 是投影，不能将其表述为新权限来源或更严格的 selected-Todo 授权。

具体改动 / Changes

验收使用改动前已接受的 RFC main37a。本次 I2/I3/I4/I6/I7/I8/I9 的局部 owner、兼容、off/prerequisite、schema/privacy、完整上下文及 scoped 证据为 implemented；I5 的 Node 安装要求和 missing-Node 诊断未改变，为 out_of_scope。完整 R1、M3、V1、V2、V3、V4、V5、V10 为 deferred，各自原有资格和回归继续保留。新 checkpoint 记录证据，不重新定义这些验收。

关键代码讲解

• build_loopx_turn_host_request:161 接受原 plan，保留公开签名，先原 assembly 后原 finish。初始请求和 recorded recovery 的现有公开 caller 继续执行完整来源转换和原异常，返回同一 Host carrier。
• _build_staged_dispatch_request:219 从 staged plan 的现有浅别名重新装配，保留 inspection→Turn key→strict route 及 context/optional/native-child 投影。四项精确条件成立时才用已有 converter，其余形状执行原 finish；这个返回值只供立即 mandatory dispatch 使用。
• run_loopx_turn_once:1548 只替换 staged 参数表达式1735。Typed dispatch1734仍先于 admission1740和 publication，随后依原 Host/journal/session/settlement owner 执行；confirmed work 仍通过既有身份和结果回读，未存储跨 effect 的 checked result。

生产修改限于 executor.py。公开 builder、完整 assembly/finish、private staged 路径以及执行器唯一 caller 是本次关键符号；没有新增 CLI 开关、共享 vocabulary、持久化 schema、永久正常执行管线或自动 privileged provider 激活。新增测试位于 test_turn_host_decision_capture.py，覆盖浅别名 guard、完整 source/header、值保持、bridge 失败和 transport。原测试正文保留。两个 RFC 文件共同记录这个有界 checkpoint。

正向路径由完整 source 装配、mandatory dispatch、capture publication 到实际 CLI Host 输入和一次结算闭合。反例包括重写 plan/route/source/header、malformed request、可选 bridge 启动诊断和 transport 失败；旧路径仍在原阶段拒绝，没有借减少检查放宽 admission、Stop、lease、预算或权限。

本地验证区分每个来源：

验证	结果及边界
Main BASE/HEAD 同一 harness	各 42 PASS；完整字段、guard、错误顺序和 producer/consumer 正反例
旧 C1 638b7e3c 同一适配 harness	BASE/HEAD 各 42 PASS；仅固定旧版本组合资格
新 standalone Core wheels	Main 与旧 C1 各 15 PASS；来源、安装、生产 File/SQLite task/recovery 正确性；synthetic Host，非实际模型
Driver/executor suites	332 PASS
Root standard premerge	6 direct、14 selected PASS；diff hygiene、编译、semantic/maintainability 和相关 canary
独立 source real-path 对照	BASE/CANDIDATE 各 24 PASS；完整首次输入/输出、publication、实际 CLI Host 和 once-only/replay/readers
最新 C1 1a3740cf	两组各 122 PASS：42 staged、15 CLI、19 reader/recovery、29 provider/inspection、2 import、15 installed Core；独立来源、JUnit 和 case/status 读回

独立原始对象检查覆盖 24 个首次输入、24 个首次输出、20 个 publication 返回和 10 个实际 Host 输入。数值差异保留为 222 个由原时钟字段独立推导的差异，以及 32 个 legacy compaction 差异。早期比较有 20 条 raw pointer 错误：它读的是 stage 返回的 /returned/plan，却引用 stage 输入的 /plan。新增校正证据逐条验证原 bind_capture 的完整 params、RPC 返回、Python helper、stage 返回和两个 publication consumer，旧错误和 seal 保留；没有任意 scalar 替换或修改旧失败。重算发生在既有 TS binding owner 内，publication 随后复制已绑定的返回值。4 条原操作链的码点、UTF-8、ratio、excess、section 总和全部独立重算一致，增长只来自 transport，原 payload 不变。这些诊断不是性能收益证明。

资格按各原 receipt 的实际边界解释：包含受控 missing-Todo guard 反例，两个 import tests 只保护 deferred owner 和 export identity；真实 File/SQLite 与 installed Core 的结果不能扩大成每个 mock/guard/import 行都经过真实后端或完整模型。最终 v2 seal 另封存精确执行命令，保留原 v1 和所有失败记录。

早期 message 断言失败、C1 case 准备阶段 TypeError、缺少 TS 开发依赖的 quick 失败、serving-origin 路径断言失败和比较 v3/v4/v5 的错误声明均保留。后续当前 source、同 arm harness、真实 Core 和 independent readback 覆盖了相应不变量；不把保留的历史失败改成 PASS，也不声称所有历史根因已解决。旧 matched-cost 结果属于前一切片，不能借给本 PR。

对主干的风险 / Risks

主要风险在省掉一次检查后改变错误顺序，或在 staged 浅别名、source 替换及 effect 边界错误复用旧事实。本次 Main 完整 guard/value 和真实 File/SQLite 反例为这些风险提供当前证据；公开 builder 和非 canonical 形状保持旧转换。该变化无 default-off 开关，属于明确披露的内部 canonical 分支行为变化，其余公开和 legacy 形状由完整旧 finish 保护。scope-fit 不需要新抽象；有界 assembly/finish 提取承担现有两种 caller 的装配职责，未扩展到其他 domain。

最新 C1 从旧638更新为1a3740cf 后，已重新验证其相关 caller。Main+C1 和本 PR+C1 的 immutable tree 均无冲突，同一 focused harness 与当前 CLI-default/selection、完整 source reader、missing/foreign/replaced capture、原 Turn recovery、agent-only once-spend/replay、lazy-provider/inspection、import 和真实 Core 两组均通过。每边122个场景的原 case/status、source/wheel/installed 字节和 actual Node26/SQLite3.54.1 来源已由独立 reviewer 与 Root 分别读回；Root 还校验了8101个原 artifacts 的141,080,450字节哈希和每个 Core 的1915个 RECORD 文件。初次 external plugin 缺 helper path 导致 exit3/0case 的记录原样保留，修复运行环境后同源同 harness 两组通过。这只闭合本 PR 与当前 C1 的相关组合资格，不能批准整个 C1 或其 default cutover。

保存的 CI 快照为 28 SUCCESS、11 FAILURE、8 SKIPPED、1 CANCELLED、6 PENDING。TS shard 的日志显示静态 digest-owner oracle 发现另一个 matcher；相关 TS 因果树与 immutable base 字节相同，但没有执行同一 base 失败检查，正式 disposition 仍 unresolved。Windows 日志显示 BASE measurement-only arm 启动 pinned reader 时 WinError2，HEAD arm 尚未达到，实际 Windows parity 仍 unverified。checks/build 是 skipped coverage 或 failed browser 的汇总门；其他浏览器失败原因仍 unknown。它们作为 required=false 的诊断行保留，不称为完整归因或全 CI 通过。必要改变不变量的本地覆盖与 CI/merge-readiness 是分开的判断；任何已确认 PR regression 仍阻塞。

我的整体评价 / Verdict

Main 的原装配、typed owner 复用、negative/fresh-boundary 行为、真实 Core/CLI 和消费者对照支持这个局部切片；v6 数值证据及最新 C1 的 related-caller 资格均已有独立闭合。19 个必需 evidence 项现为 verified，无已确认 blocking source finding。long_horizon 与 user_experience 在所验范围内 preserved；没有新设置、权限或模型任务收益声明。公开 builder/legacy/transitional 转换保留，原任务恢复和完整目标验收继续各自的门。

Visual review: not_applicable。已检查 executor 的公开 builder、private staged dispatch、run-once caller 及两份 RFC append；这次内部 CLI adapter 改动未触及 rendered presentation。 所触及范围无视觉呈现待验；实际模型理解、完整成本和平台资格属于前述独立未验证范围。

English verdict: APPROVE

head 726ac21 has independently verified Main/source, legacy numeric lineage and current C1 1a3740c caller/installed qualification. No blocking source finding remains. Diagnostic CI and full R1/model/cost/platform acceptance are separate; approval grants no merge authority.

[cocolord]

Maintainer merge decision for 8820@726ac214f9535f7c26201af83dae33068cbec796.

The published exact-head review concludes APPROVE. All 19 required review evidence items are verified, the complete published body passed the current policy checker after remote readback, approval closeout is clear, and all review threads are resolved (zero threads). Main/base and the separately qualified current C1 head remain unchanged.

Required local validation passed: Root standard premerge (6 direct and 14 selected checks), the 332 surrounding driver/executor cases, paired main source/carrier/negative checks, independent raw source/consumer/numeric readback, and current C1 source/CLI/recovery/provider/import/standalone-Core qualification (six matched groups, 122 cases per arm). Current C1 artifact/RECORD/runtime origins and original failures were preserved and independently checked. The exact-head bilingual gate and diff hygiene passed again against the actual main target. Goal change-quality qualification is disabled; no receipt is invented.

Managed merge-readiness is ready=false only for failed, pending and incomplete status checks. Its normalized summary is 12 failing statuses, 36 successful statuses and 6 pending; cancelled/skipped observations are included in that normalization. Raw CI failure causes remain partly unresolved, including the existing Windows/platform and browser gaps. This is not an all-CI-green statement or complete R1/M3/model/cost qualification.

Under existing explicit maintainer merge authorization, admin bypass is limited to those status-check/readiness holds. It does not replace exact-head review, required local validation, resolved findings/threads, unchanged source or mergeability. The independently qualified bounded caller slice is eligible to merge; broader acceptance and original-goal regression remain open.