loopx-agent · Oct 14, 2026 · Oct 14, 2026 · Oct 14, 2026 · Oct 14, 2026 · Oct 14, 2026
@@ -95,7 +95,10 @@ jobs:
         run: sudo apt-get update && sudo apt-get install -y zsh
 
       - name: Install smoke runtime dependencies
-        run: python -m pip install --disable-pip-version-check "jsonschema>=4.23,<5"
+        # Budget probes import pytest. LaunchAgent qualification resolves the
+        # selected distribution outside the checkout, so install this source
+        # explicitly rather than relying on an unrelated runner installation.
+        run: python -m pip install --disable-pip-version-check "jsonschema>=4.23,<5" "pytest>=9.0.3,<10" --editable .
 
       - name: Install locked TypeScript parser for semantic production checks
         run: npm ci --ignore-scripts

@@ -150,7 +150,7 @@ const capabilityCopy: Record<WorkspaceLocale, Record<string, LocalizedCopy>> = {
 const fieldCopy: Record<WorkspaceLocale, FieldCopy> = {
   en: {
     new_goal_provider: { label: "New Goal storage provider", description: "File or SQLite; frozen at creation, independently of execution policy." },
-    canonical_creation: { label: "Create canonical authority", description: "Future Goals only. Disabled retains the post-promotion target; failures require the original creation retry." },
+    canonical_creation: { label: "Create canonical authority", description: "Required for new Goals in 2.0. An older disabled setting remains visible until you enable it; existing Goals require import." },
     new_goal_handoff_mode: { label: "New Goal execution policy", description: "soft_claim or hard_lease, used with canonical creation. Agents inherit the Goal policy; tool authority is unchanged." },
     runtime_profile: { label: "Runtime profile", description: "Restricted keeps scoped LoopX reads only. Trusted owner enables normal host tools while protected operations retain separate checks." },
     selection_policy: { label: "Selection policy", description: "Preferred allows an explicit user choice; pinned rejects another executor; flexible permits fallback only inside the eligible pool." },
@@ -185,7 +185,7 @@ const fieldCopy: Record<WorkspaceLocale, FieldCopy> = {
   },
   "zh-CN": {
     new_goal_provider: { label: "新 Goal 的存储 provider", description: "选择 File 或 SQLite；创建时固定，与执行策略分别选择。" },
-    canonical_creation: { label: "建立 canonical 权威存储", description: "仅影响此后新建的 Goal。关闭时仅固定晋升后的目标；失败须重试原创建操作。" },
+    canonical_creation: { label: "建立 canonical 权威存储", description: "2.0 新建 Goal 必须启用。旧的关闭设置会保留显示，需自行启用；已有 Goal 需导入。" },
     new_goal_handoff_mode: { label: "新 Goal 的执行策略", description: "canonical 创建使用 soft_claim 或 hard_lease。Agent 继承 Goal 策略；不授予工具权限。" },
     runtime_profile: { label: "运行模式", description: "restricted 仅使用受限 LoopX 读取；trusted_owner 开放常规宿主工具，但受保护操作仍单独校验。" },
     selection_policy: { label: "选择策略", description: "preferred 允许用户显式改选；pinned 拒绝其他执行器；flexible 只在已授权资源池内回退。" },

@@ -382,8 +382,8 @@ export function MachineConfigurationSettings({ section, onChanged }: { section:
             <section className="personal-capability-behavior-note">
               <ShieldCheck aria-hidden size={18} />
               <div><strong>{locale === "zh-CN" ? "仅影响此后创建的 Goal" : "Future Goals only"}</strong><p>{locale === "zh-CN"
-                ? "启用 canonical 创建后，新 Goal 直接建立权威存储，并采用所选执行策略；失败时须重试原创建操作。关闭时仅固定晋升后的目标存储。已有 Goal 的升级仍需备份、停止写入和结算租约；这里不授予工具权限。"
-                : "With canonical creation enabled, new Goals establish authority with the selected execution policy; retry the original operation after failure. Disabled only freezes the post-promotion target. Existing Goals still require backup, stopped writers and settled leases for upgrade; this setting grants no tool permissions."}</p></div>
+                ? "2.0 新建 Goal 必须启用 canonical 创建，并采用所选执行策略。旧的关闭设置不会自动改变；启用后再重试创建。已有 Goal 需备份、停止写入并导入；这里不迁移已有数据，也不授予工具权限。"
+                : "2.0 requires canonical creation with the selected execution policy. An older disabled setting is not changed automatically; enable it before retrying creation. Back up, stop writers and import existing Goals separately. This setting neither migrates existing data nor grants tool permissions."}</p></div>
             </section>
           ) : null}
 

@@ -34,6 +34,9 @@
     normalize_todo_id,
 )
 from loopx.control_plane.todos.handoff_mode import HANDOFF_MODE_HARD_LEASE
+from loopx.control_plane.coordination.local_authority import (
+    LocalCoordinationAuthorityUnavailable, read_canonical_todos_if_promoted,
+)
 from loopx.control_plane.work_items.task_lease import (
     TaskLeaseError,
     acquire_task_lease,
@@ -388,28 +391,38 @@ def _maybe_add_role_successor_todos(
         action=action,
     )
     failure_continuation = decision_summary.get("failure_continuation")
-    if isinstance(failure_continuation, dict):
-        next_outcome = str(failure_continuation.get("next_outcome") or "")
-        successor_specs = [
-            spec
-            for spec in successor_specs
-            if spec.get("action_kind") == next_outcome
-        ]
     text_source_todo_id = None
     if isinstance(failure_continuation, dict):
-        text_source_todo_id = str(failure_continuation.get("source_todo_id") or "") or None
-    return apply_role_successor_todos(
-        registry_path=registry_path,
-        goal_id=goal_id,
-        source_todo_id=source_todo_id,
-        current_agent_id=agent_id,
-        role_id=role_id,
-        action=action,
-        successor_specs=successor_specs,
-        decision_summary=decision_summary,
-        execute=execute,
-        text_source_todo_id=text_source_todo_id,
-    )
+        next_outcome = str(failure_continuation.get("next_outcome") or "")
+        successor_specs = [spec for spec in successor_specs if spec.get("action_kind") == next_outcome]
+        source_todo_id = str(failure_continuation.get("source_todo_id") or "") or source_todo_id
+        text_source_todo_id = source_todo_id
+    def apply_binding(parent_id: str, *, revision: str | None = None) -> dict[str, object]:
+        return apply_role_successor_todos(registry_path=registry_path, goal_id=goal_id,
+            source_todo_id=parent_id, current_agent_id=agent_id, role_id=role_id,
+            action=action, successor_specs=successor_specs, decision_summary=decision_summary,
+            execute=execute, text_source_todo_id=text_source_todo_id,
+            expected_provider_revision=revision)
+
+    try:
+        return apply_binding(source_todo_id)
+    except LocalCoordinationAuthorityUnavailable as error:
+        if error.code != 'todo_semantic_duplicate_conflict' or text_source_todo_id is None:
+            raise
+        # Native create owns normalized title/intent matching. Qualify only its
+        # exact conflicting record, without rewriting a historical parent.
+        snapshot = read_canonical_todos_if_promoted(
+            runtime_root=runtime_root_from_registry(registry_path, None), goal_id=goal_id,
+        )
+        todos = {row['todo_id']: row for row in (snapshot or {}).get('todos', [])}
+        existing = todos.get(error.payload.get('todo_id'))
+        parent_id = existing.get('unblocks_todo_id') if existing else None
+        parent = todos.get(parent_id)
+        if not (parent and parent['role'] == 'agent' and parent.get('action_kind') in SUMMARY_ACTIONS
+                and parent.get('unblocks_todo_id') == text_source_todo_id):
+            raise
+        return apply_binding(parent_id, revision=snapshot['provider_revision'])
+
 
 
 def _executed_successor_todo_ids(successor_todos: dict[str, object]) -> list[str]:

@@ -173,13 +173,13 @@ def apply_role_successor_todos(
     decision_summary: Mapping[str, object],
     execute: bool,
     text_source_todo_id: str | None = None,
+    expected_provider_revision: str | None = None,
 ) -> dict[str, object]:
-    """Preview or create role-declared successor todos through LoopX state.
+    """Create successors, retaining qualified historical source bindings.
 
-    When text_source_todo_id is provided, it is used for rendering the
-    successor text (so the title is stable across different summary todos
-    that review the same failure lineage).  source_todo_id is still used
-    for the unblocks_todo_id binding.
+    Normally one source supplies both title and lineage. A caller recovering
+    an existing successor may preserve its original parent while rendering
+    the same title from the independently verified evidence lineage.
     """
 
     specs = [dict(spec) for spec in successor_specs if isinstance(spec, Mapping)]
@@ -257,6 +257,7 @@ def apply_role_successor_todos(
             action_kind=action_kind,
             claimed_by=claimed_by,
             unblocks_todo_id=source_todo_id,
+            expected_provider_revision=expected_provider_revision,
             dry_run=False,
         )
         successors.append(

@@ -4,7 +4,7 @@
 - Supersedes / closes: none
 - Proposed by: LoopX maintainers
 - Date: 2026-08-15
-- Last revised: 2026-10-07
+- Last revised: 2026-10-15
 - Scope: an incremental, replacement-first migration of the LoopX control-plane
   core from Python to TypeScript without maintaining two semantic
   implementations
@@ -127,6 +127,27 @@ The existing delivery Todos should carry these concrete exits:
 This updates the existing R5/T4 frontier and release proposal; it creates no
 parallel migration owner, runtime gate or release activation.
 
+The retirement proposal is now reconciled through contributor-led #6396 and
+its fork supplement #2. The [absorption map](../../reference/local-authority-provider-selection.md#retirement-proposal-reconciliation)
+retains canonical ownership/terminal invariants, fixed 1.x receipt recovery,
+reviewed App creation and the actual-contention mutation oracle from #6366.
+The competing implementation stack is not an integration prerequisite; adopted
+combined-head validation, core trial, real Host and D2/release exits stay open.
+
+
+The same C1/T4 boundary now retires the live `legacy` ownership policy rather
+than preserving a third execution strategy. The existing TS policy owner rejects
+fresh claim/update/terminal/Monitor admission and execution fences; acquire and
+lease maintenance share that rule. Current-proof readback and inspection cannot
+turn a retained lease or original receipt into execution. Delegation consumes the
+same typed support before launch/resume, including old no-lease-required records;
+source inspection no longer carries a second Todo-admission projection. Historical mode decoding,
+original-operation recovery, exact release and reviewed backup/plan/migrate remain.
+Normal fixtures use soft/hard independently of their legacy/native wire shape;
+explicit legacy-policy negatives and retained 1.x artifacts preserve that boundary.
+No live Goal is changed by this proposal. Adopted combined-head qualification,
+installed policy migration, real Host adoption and D2/release remain open.
+
 Team-plan recovery prerequisite: an unpromoted plan that published its original
 receipt can now recover through the Chat confirmation owner while shadow
 bootstrap is interrupted. Registry/Todo/source locks still protect the read,

@@ -4,7 +4,7 @@
 - 替代 / 关闭：无
 - Proposed by：LoopX maintainers
 - Date：2026-08-15
-- Last revised：2026-10-07
+- Last revised：2026-10-15
 - Scope：LoopX 控制面核心从 Python 到 TypeScript 的增量、replacement-first
   迁移；不长期维护两份语义实现
 - Tracking issue：[#3225](https://github.com/loopx-project/loopx/issues/3225)
@@ -71,6 +71,17 @@ actor／可运行状态／输入拒绝、精确 lineage 读回，以及当前输
 隔离路径验证。新能力进入时持续守卫，不把历史库存当永久出口。最后受支持的
 旧源 writer、历史恢复、安装 cohort 与发布验收各自保持开放。
 
+当前 C1/T4 退役提案由贡献者主导的 #6396 及 fork 补缺 #2 承接，#6366 已被替代；
+[吸收清单](../../reference/local-authority-provider-selection.md#retirement-proposal-reconciliation)
+保留 canonical ownership／终态不变量、固定 1.x 回执恢复、审核后的 App 创建及真实锁竞争 oracle。
+同一 TS 策略 owner 清理第三种 live legacy 执行策略：fresh claim／update／terminal、
+Monitor、执行 fence、acquire 及租约维护拒绝 legacy；当前 proof 读回和 inspect 也不能把
+保留租约或原回执变为执行资格。delegation 首次启动和恢复都消费同一 typed support，
+包括旧“无需租约”记录；source inspect 不再二次解析 Todo 准入。历史 mode 解码、原操作恢复、精确 release 与有备份的
+plan／migrate 保留。正常 fixture 使用 soft／hard；legacy/native wire shape 与策略分开，
+显式 legacy 拒绝和固定 1.x artifact 继续验证恢复边界。提案不自动修改活跃 Goal。
+采用后的 combined head 验证、安装态策略迁移、真实 Host 采用与 D2／发布保持开放。
+
 保留的 import-compatible field writer 在既有 typed field plan 中统一等待条件
 归一化及矛盾 clear 拒绝；保持 Python 空白输入省略和锁内 IO，只退役重复的
 normalization crossing，不删除仍受支持的 writer 或迁移 reader。