runtime-connector-catalog.md

title	Codex, Claude Code and agent runtime connectors
description	Compare LoopX connectors for Codex, Claude Code, OpenCode, DeepSeek Harness and custom runtimes: wake triggers, state writeback, budgets and authority boundaries.

Runtime Connector Catalog

Status: public-safe v0 catalog for LoopX host/runtime connectors.

LoopX can run beside many execution surfaces without becoming the execution runtime. The connector catalog names those surfaces in user-facing terms and maps each one back to the same kernel contracts: registry, active state, todo, quota, scheduler hints, gates, evidence, and public/private boundary.

The catalog is not a second source of truth. It is a frontstage index over the host loops that can wake an agent, ask LoopX whether work is allowed, write back validated state, and expose enough liveness for users and maintainers to reason about the work.

Connector Fields

Field	Meaning
id	Stable connector id used by docs, status projections, and smokes.
surface	User-visible host surface or runtime family.
execution_mode	How the host loop runs: visible TUI, app heartbeat, local scheduler, webhook, or bridge.
wake_triggers	What starts one LoopX-controlled turn.
state_writeback	The LoopX write path after validated work.
liveness_signal	Minimal signal that the host loop is alive without copying raw logs.
stop_reset_policy	How scheduler hints, final checks, or host stop rules apply.
budget_meter	How the connector maps work to quota or no-spend monitor policy.
human_visibility	What the user can see without reading private state.
boundary	What the connector must not copy, infer, or mutate.
smoke_expectation	Focused public check that protects the connector contract.

Initial Catalog

id	surface	execution_mode	wake_triggers	state_writeback	liveness_signal	stop_reset_policy	budget_meter	human_visibility	boundary	smoke_expectation
codex_app_heartbeat	Codex App automation	Scheduled headless app thread	Codex App heartbeat RRULE; scheduler_hint.reset_policy.reset_token	todo lifecycle, refresh-state, then quota spend-slot after validation	Heartbeat run plus quota event	Apply scheduler_hint.app_automation reset/backoff; cadence-only changes do not spend	Per-goal/per-agent quota slot after validated writeback	Visible thread, heartbeat XML, concrete user todo when required	Generated heartbeat prompt; scoped --agent-id; no project-specific prompt branches	Prompt smoke covers scheduler hint, reset token, identity, and no-spend cadence change.
trae_app	Trae App automation	Scheduled app thread	Trae App heartbeat schedule; scheduler_hint.reset_policy.reset_token	todo lifecycle, refresh-state, then quota spend-slot after validation	Heartbeat run plus quota event	Apply the provider-neutral scheduler_hint.app_automation cadence packet with host_surface=trae_app through Trae automation_update; keep non-terminal settled turns active; no Codex packet or local-store fallback	Per-goal/per-agent quota slot after validated writeback	Visible Trae thread and concrete user todo when required	Generated heartbeat prompt; scoped --agent-id; ambient TRAECLI_THREAD_ID; no Codex local automation-store mutation	Host activation smoke covers distinct runtime identity, automation setup, three-minute initial cadence contract, and non-terminal continuation.
codex_app_ssh_goal	Codex App connected to a remote workspace over SSH	Visible interactive Goal loop	Host /goal continuation; no automation-tool dependency	Same CLI todo/refresh/spend path, with --source visible-goal after validation	Visible Goal state plus compact LoopX status	Complete only on terminal no-follow-up; after three unchanged blocked turns, native update_goal(status=blocked) stops host continuation while LoopX remains active; user /goal resume reactivates it	Quota slot after validated writeback; no spend for gates, waits, final checks, or host blocking	User sees the active Codex task and its concrete gate or next action	Generated body stays within the /goal 4000-character limit and never invents LOOPX_TURN or calls automation_update	Agent-onboard smoke proves exact host selection, typed scheduler context, body budget, bounded quiet stop, and absence of heartbeat-only instructions.
codex_cli_tui	Codex CLI TUI	Visible interactive terminal loop	User bootstrap, /goal, or visible continuation	Same CLI todo/refresh/spend path	TUI transcript plus compact LoopX status	Uses the same native update_goal(status=blocked) and /goal resume contract after the typed unchanged limit	Quota slot after validated writeback; no spend for blocked/final-check transitions	User sees the active TUI turn	Do not silently switch to hidden headless execution or copy raw transcripts	TUI prompt/bootstrap smoke covers scoped identity and native blocked/resume semantics.
claude_code_loop	Claude Code loop	Visible local agent loop	Slash command, local loop tick, or host loop continuation	Same CLI todo/refresh/spend path	Loop status plus compact transcript pointer	Final quota/replan check before stop when unchanged limit is configured	Quota slot after validated writeback; no spend for stop/final check	User sees local loop status and response	No private material, credentials, production action, or hidden approval bypass	Loop smoke covers scoped identity, unchanged final check, and stop-without-spend.
opencode_goal_loop	OpenCode goal mode	Visible OpenCode goal plugin loop gated by LoopX	/loopx <task> with the opt-in OpenCode goal bridge installed	Same CLI todo/refresh/spend path through the bridge	Bridge status plus compact LoopX status	Final quota/replan check before loop stop when unchanged limit is configured	Quota slot after validated writeback; no spend for stop/final check	User sees the OpenCode goal turn and bridge status	Bridge install stays opt-in; do not copy raw transcripts, credentials, or local session paths	OpenCode bridge tests and host-mode selector smoke cover scoped identity and catalog parity.
opencode2_goal_worker	OpenCode 2 goal mode	Persistent out-of-process worker driving a visible OpenCode 2 session over its HTTP API	loopx opencode2-goal-worker --goal-id <id> --directory <dir>	Same CLI todo/refresh/spend path through the worker	Worker state file, host poll receipt, and compact LoopX status	Unchanged-poll limit stops the loop with a visible synthetic notice; probe failures retry with bounded backoff	Quota slot after validated writeback; no spend for waits, notices, or final checks	User sees the OpenCode 2 session turns, continuation prompts, and stop/pause notices	Worker state stays under $XDG_STATE_HOME/loopx/opencode2; do not copy raw transcripts, credentials, or local session paths	Worker contract tests cover the turn loop, visible stops, lease fencing, and user-message continuation.
pi_goal_loop	Pi goal mode	Visible Pi goal extension loop gated by LoopX	/loopx <task> with the opt-in Pi goal extension installed	Same CLI todo/refresh/spend path through the extension	Extension status plus compact LoopX status	Final quota/replan check before loop stop when unchanged limit is configured	Quota slot after validated writeback; no spend for stop/final check	User sees the Pi goal turn and extension status	Extension install stays opt-in; bindings stay under the project .loopx/ tree; do not copy raw transcripts, credentials, or local session paths	Pi extension source-contract tests and host-mode selector smoke cover scoped identity and catalog parity.
shell_worker	Shell, cron, launchd, or service timer	Headless local command	Cron/service/manual shell wakeup	CLI writeback commands from the project checkout	Exit code, run id, and compact status	Obey local scheduler_hint backoff/reset; fail closed on missing goal or agent id	Quota slot for delivery; monitor-only polls stay no-spend	Logs or status command, not raw state files	Do not bake local paths, secrets, or project policy into reusable scripts	Command examples use global registry, --agent-id, and no-spend monitor behavior.
http_webhook	HTTP webhook or local daemon	Request-driven bridge	Loopback callback, webhook, or host event	Adapter validates, then emits LoopX todo/gate/evidence events	Request log plus compact status export	Webhooks do not self-poll; scheduler hints are advisory unless a scheduler owns the retry	Quota spend only after accepted writeback	Dashboard/status feed	Loopback by default; write endpoints require explicit dry-run/preview and CLI-equivalent fallback	Loopback smoke rejects remote status/write authority and proves preview-gated writes.
worker_bridge	Worker bridge	External executor, task container, or remote worker bridge	Worker event, bridge message, or runner sidecar	Bridge emits compact public-safe state, todo, or evidence	Worker heartbeat/status and compact counter trace	Host-specific stop/reset maps back to scheduler hints and outcome policy	Quota event for accepted work; bridge evidence grants no task-score authority	Dashboard/frontstage projection and compact evidence timeline	Strip raw logs, local paths, private traces, task text, and credentials	Worker bridge install/status smoke proves source mount, counter trace, and private-boundary stripping.
computer_use_runtime	Browser, desktop, or app automation runtime (a provider/runtime execution surface, not a LoopX product capability or a value-connectors connector)	Visible or replayable UI execution surface	Bounded action request from an owning capability, host replay event, or user takeover handoff	Compact typed receipt (facts only) handed back to the owning capability's domain-local reducer, which proposes the LoopX gate/evidence writeback for Kernel validation	Host-owned replay/screenshot pointer plus compact receipt fields	Stop at unknown modal, privacy ambiguity, or final external-write action; scheduler hints still come from LoopX quota	Quota spend only after the owning capability's reducer proposal is accepted by the Kernel; readiness/profile checks stay no-spend	Review card with intended action, forbidden effect classes, evidence handle, and takeover path	Do not copy credentials, cookies, raw screenshots, private UI bodies, or perform sends/purchases/production mutations without exact gate; a provider must never author the Kernel writeback itself	Synthetic runtime-profile/action-request/receipt smokes prove gate-before-write, raw-evidence stripping, and rejection of provider-authored writeback fields.
deepseek_harness_loop	DeepSeek Harness	Isolated headless bounded execution through LoopX Turn	loopx turn run-once with loopx.dsh_goal_mode (compat: scripts/dsh_turn_host_adapter.py)	Same CLI todo/refresh/spend path after validated dsh result	Compact Turn receipt plus local dsh session pointer	Outer controller obeys scheduler hints; preview/failed validation stays no-spend	Quota slot only after validated writeback	Operator sees typed result, validator receipt, and next preview command	Do not copy dsh JSONL sessions, raw transcripts, credentials, local paths, or model tool logs	Adapter smoke, fake-dsh e2e, and real-dsh e2e prove typed result shaping, real dsh runtime startup, writeback, and replay idempotence.
loopx_turn	LoopX Turn host adapter	Isolated headless bounded execution	loopx host-mode-plan selects the mode, then loopx turn plan previews one typed decision	loopx turn run-once --execute writes back only after independent validation	Compact Turn receipt and scheduler execution context	Outer controller obeys scheduler hints; cadence-only/preview work stays no-spend	Quota slot only after validated writeback	Operator sees selected host, execution mode, validator requirement, and next preview command	Do not publish opaque session handles, raw transcripts, local paths, credentials, or host-local logs	Host-mode-plan smoke proves host-mode selection, scoped identity, Turn mapping, and visible/headless/hybrid handoff readiness.

Reusable shell_worker reference

scripts/external_scheduler_worker.py is a scheduler-hint-aware shell_worker for generic visible CLI loops (for example TraeX CLI). Each tick runs quota should-run --include-detail scheduler, projects a one-line public-safe status (waiting/should_run/terminal, cadence class, next check minutes, unchanged count), and sleeps per the local_scheduler progression ladder. It selects the same default global registry as the LoopX CLI: .loopx for a new installation, or the registered .codex/loopx route until migration. If both default registries exist, pass an explicit --registry after resolving the route conflict. It tracks the consecutive-unchanged index in a small state file and resets it when scheduler_hint.reset_policy.reset_token changes. It is observe-only by default; pass --wake-cmd only to trigger a bounded headless turn (for example loopx turn run-once ... --execute). It cannot type into a visible TUI, so it does not replace the interactive host loop. A launchd template ships at examples/external-scheduler-worker.launchd.plist and the contract is guarded by examples/external-scheduler-worker-smoke.py. Producer-generated bounded-wait scheduler hints have a thin consumer-parity contract with Pi, including the final quota/replan recheck triggered by the third unchanged poll; it is guarded by tests/test_host_loop_runtime_parity.py and the Pi runtime tests in tests/pi_goal_loop_runtime.test.mjs.

After a successful synchronous --wake-cmd, the worker now immediately checks quota again, without an active-work sleep or a minimum delay. This changes the external worker's post-success timing. A successful exit is not continuation authority: every next wake still requires a fresh quota decision. No task, external waits and quota waits retain the producer's waiting progression; observe-only polls retain their interval, and failed wakes retain error backoff. Commands that finish without more useful work may opt into --wake-stop-exit-code <1..255>: that explicit child exit ends the worker normally, without Todo completion or quota spend. Omit the option to preserve ordinary nonzero-exit failure/backoff behavior outside automatic replan. Timeout and output-limit failures cannot be converted into a normal stop by this option. The caller owns the meaning of its chosen code; the generic worker does not parse provider receipts or infer work completion from stdout. Stop signals and subprocess cleanup keep their existing behavior. This adapter does not override admission or reinterpret task eligibility.

First-party Codex CLI and benchmark Hosts also recheck their captured Goal authority at the actual process-launch boundary, including checkpoint resumes. The operation-equipped Codex app-server path uses the same admission at process creation and again before sending turn/start. The existing authority writer lock covers each launch/send boundary and is released before waiting for a provider response. A Goal stopped after session selection therefore cannot start a new Host or replace its saved session with an empty, unlaunched result.

For operation-host turn/start, native stdin delivery and response share the original response/idle/hard deadline. Waiting for another native writer consumes that allowance before acquiring the Goal fence; there is no separate one-second ceiling on a healthy send. Backpressure or an interrupted partial send cancels and reaps the same native peer and drains the writer before releasing the fence; it cannot leave a sender to deliver that Turn after Stop. This is a dispatch timeout, not proof of non-acceptance or permission to replay. Successful large and Unicode inputs retain the full original text stream; no new input-size truncation is applied. If current admission consumes the remaining request deadline before a writer starts, the Session owner still retires that same peer inside the launch fence.

The guarded ordinary-Host bridge also bounds readiness, request delivery and spawn observation within the original explicit command deadline. Without a command deadline, only this handoff has a 30-second safety budget; a successfully spawned Host still runs to natural completion. Cancellation retains the Goal fence until the same bridge reports no launch or completes its Host cleanup and is reaped. Missing cleanup evidence is an explicit supervision failure, not a certificate that an unobserved Host stopped or permission to replay.

Source-session admission retains its exact Goal lifetime checks. Executable legacy registries instead compare their original registry byte witness under the existing registry writer lock and reuse the registry owner's legal active states, including active-read-only. This does not relax source-session status or identity checks. A changed registry requires a fresh plan, including when an unrelated registry configuration change invalidated the old witness. When a legacy global projection declares its source registry, launch checks both the original source and the projection in the existing source-then-projection writer-lock order. A committed source stop still rejects launch if projection synchronization failed and left an active mirror. Missing or cyclic source routes cannot grant launch permission. This conservative check does not create an exact Goal instance identity: byte-identical legacy replacement remains indistinguishable. Generic shell commands still require their own Host to provide an equivalent launch boundary.

Codex operation tools 路径在创建 app-server 和发送 turn/start 前复用同一 准入检查；只在这两个边界持有原 owner 的锁，等待模型响应前释放。这样 Stop 既不会被另一条 Host 路径绕过，也不会被长时间持锁拖延。legacy 的合法 active-* 状态复用原注册表规则，source-session 的生命周期校验保持严格。 turn/start 的原生 stdin 发送与响应共享原 response、idle、hard 期限；等待其他 原生写入也计入该界限，不再对正常发送额外施加一秒上限。背压或部分发送中断时，先取消并回收同一个 原生进程、等待写入线程退出，再释放 Goal 锁，避免 Stop 后迟到派发。这类超时不 证明请求从未受理，也不授权重放；正常的大输入和 Unicode 文本完整保留，不截断。 当前资格检查在写入开始前耗尽原请求期限时，会话 owner 仍在启动锁内回收同一个进程。

普通 Host 的受控 bridge 也在原显式命令期限内完成 ready、请求发送和 spawn 观察。 没有命令期限时，仅交接阶段有 30 秒安全预算；成功启动后仍等待 Host 自然结束。 取消时继续持有 Goal 锁，直到同一个 bridge 报告未启动，或完成 Host 清理并被回收。 缺少清理证据会明确报监督失败，不能据此证明未观察到的 Host 已停止，也不授权重放。

The executable turn run-once path also reruns its existing current quota and health decision under those same locks, against the actual source registry and the original Turn/Todo/replan selection. It creates no replacement receipt. Both plain exec and operation-tools launch obey that owner's refusal when mirror quota is stale or source state becomes unavailable. Benchmark heartbeat execution and heartbeat/turn initial planning reuse this quota owner before native process creation. Initial planning does not need a prior heartbeat receipt or Todo. An interrupted checkpoint source continuation carries its actual held guard's Turn and nonempty event ID into the same current decision, preserving the complete original settlement identity when present. It does not derive these inputs from prompt text or reuse the enclosing wake's Turn. The native session continues with the original selection and settlement rules.

The existing health owner checks the current registry's declared state_file even when no global registry is available. A missing declared state therefore reaches the quota decision on local source routes; undeclared initial setup does not create a missing-state finding, and a global copy of the same finding is deduplicated. Launch follows that owner's decision, including any lawful health-repair action, rather than treating every health finding as an unconditional refusal.

The launch reread retains the required inbox reads already dispatched for that same Turn. They cover only the material observed by that dispatch; later material still passes through the current quota owner's decision. If launch is refused, completed preflight synchronization remains reported, while the refusal itself creates no model Turn or quota debit.

This full decision callback is qualified for executable legacy local, source and source-to-global routes. Source-session admission retains its separate lifecycle-only boundary; this qualification does not enable its CLI execution. Benchmark plain, native-goal and loopx-goal modes keep their existing owners and are outside this quota callback. Restoring an archived checkpoint uses the destination Goal's current guard, without importing the source Goal's claims, Turn or spend authority. A Todo-bound guard that owes closeout returns to its original process without capture or restart; completing that work is not a new checkpoint opportunity.

可执行的 turn run-once 在同一锁范围内，使用真实 source 注册表重新运行既有 quota/health 决策，并保持原 Turn、Todo、重规划选择；不会创建替代回执。 原 quota/health owner 拒绝当前工作时，普通 exec 与 operation tools 都不能借 旧镜像额度或新出现的源状态缺失启动。 benchmark 的 heartbeat 执行，以及 heartbeat/turn 初始规划，也在创建原生进程 前复用同一 quota owner；初始规划不要求已有 heartbeat 回执或 Todo。同一次 wake 中被中断的 checkpoint 源会话，直接携带被截留 guard 的原 Turn、非空 event ID 和已有的完整结算身份重新读取当前资格，不从提示文字提取身份，也不改用外层 wake 的 Turn；原生会话按原选择和结算规则继续。 当前注册表已声明的 state_file 由原健康检查 owner 核验，即使没有 global 注册表， 状态缺失也会进入 quota 决策。尚未声明状态的初始设置不会因此产生缺失报告，global 中的同一报告按原规则去重。启动遵守原 owner 的决定，也保留其允许的健康修复动作， 不把所有健康异常都改成无条件拒绝。

启动前重读保留同一 Turn 已派发的 inbox 必读结果，覆盖范围仅限该次派发实际 观察到的材料；之后新增的材料仍由当前 quota owner 判断。启动被拒绝时，已完成 的前置同步仍须如实报告；拒绝本身不会创建模型 Turn 或配额扣减。

完整决策验证覆盖当前可执行的 legacy 本地、source 和 source/global 路径。 source-session 保留独立的生命周期边界，这项验证不会启用其 CLI 执行；benchmark 的 plain、native-goal、loopx-goal 模式继续使用各自原 owner，不属于这个 quota 回调。从归档 checkpoint 恢复时，使用目的 Goal 的当前 guard，不导入源 Goal 的 claim、Turn 或扣额权限。已有待结算义务的 Todo-bound guard 直接返回原进程继续 收尾，不捕获或重启；完成这项工作不构成新的 checkpoint 机会。

Persistent replan attempts and truthful readback

The same configured worker state route now has one live consumer and retains automatic replan dispatch attempts across restarts. A successful child exit does not resolve the original replan obligation: if fresh Core admission still names that obligation, the worker reports replan_paused, leaves the Goal incomplete, and does not dispatch another semantic review. Cadence resets, new observation contexts and intervening independent work do not erase the attempt. Original Todo lifecycle and receipt-bound settlement remain under their existing owners; they are not another semantic replan opportunity.

An interrupted, timed-out or otherwise failed replan is retained as replan_outcome_unknown. A new obligation ID cannot make that original work safe to repeat. When the original admission actually supplied a settlement identity and the configured Host preserved it, the worker reads that exact Turn through the existing settlement owner. Only verified complete settlement permits further current work. Pending recovery stays on its original identity. An opaque unbound shell command supplies no such proof; use its original Host recovery and preserve the worker state. The worker does not infer a Turn from stdout or the latest log row, and deleting the state is not a recovery method.

The existing host-poll receipt also publishes the worker's last paused or unknown observation in the Goal overview. It identifies the original Agent and obligation, retains a real Turn only when supplied by admission, and links to the Goal's tasks and dependencies. This observation is readback, not current admission or proof that a provider stopped charging. The page explicitly keeps complete costs unknown. A missing, corrupt or differently scoped association cannot display the old operation as current. Reading the observation and opening tasks do not dispatch work; the existing Stop control still uses the Goal lifecycle owner.

Ordinary --record-host-poll distinguishes an absent receipt from an unreadable one. It may create an absent receipt, but preserves unreadable JSON, UTF-8, schema or Goal association bytes and reports the observation write as unsuccessful while returning the current quota decision. Readback therefore continues to show uncertainty after the next liveness poll. An explicit worker observation can restore its known original attempt; clearing an unreadable receipt cannot stand in for that evidence. This does not resolve the attempt or authorize another dispatch.

New attempts also capture source_goal_observation_digest: a readback witness of the full source Goal and its registry route. The writer and reader share the existing source-to-global projection transformation, so synchronization metadata does not invalidate an observation. A changed source, Goal instance, configuration or runtime still makes it stale. The quota cache keeps its original full-row digest. Older observations retain their original, narrower raw-registry check; missing source proof is never reconstructed as current execution authority.

The shared projection owner also preserves preserve_attention_override semantics: with the complete source Goal unchanged, mirror synced_at updates and the merge owner's consumption of clear_attention_override do not invalidate the observation. An older attempt can gain this stronger observation witness only while its original raw registry proof still matches. Lost proof is not guessed or rebound, and the durable attempt is never rewritten by this upgrade.

普通存活轮询可以创建缺失的回执，但不能覆盖无法读取的回执。损坏的 JSON、 UTF-8、schema 或 Goal 关联仍保留在原位置，观察写入明确失败，当前 quota 判断 正常返回，页面继续显示未知。原 worker 可从持久 attempt 恢复观测， 但这不证明原操作已经结束， 也不允许再次派发。 新观测绑定完整 source Goal 和原注册表路径，正常同步到 global 后仍可显示原 Agent、义务和观测时间。同步时间变化不改变该来源；来源、实例、配置或运行环境 真正变化时仍显示过期/未知。旧记录沿用原关联检查，不把缺失的来源证明补造成权限。 投影继续复用 preserve_attention_override 等原合并规则；完整 source Goal 未变时， 镜像的 synced_at 更新及合并过程中消费的 clear_attention_override 不使观察过期。 只有旧 attempt 的原 raw registry 证明仍匹配，才可补强它的观察来源；不猜测重绑 丢失的证明，也不因此改写持久派发身份。

Scope includes the registry, runtime, Goal and Agent. Exact GoalRef is retained when supplied; executable legacy Goals keep their existing alias scope. Agent spelling follows Core's canonical identity in admission matching, the default state route, lock and observation. An accepted uppercase Agent alias and its canonical spelling therefore resume the same attempt. The original CLI input still goes to Core for its normal validation. Missing or newly supplied lifecycle metadata cannot reset an old attempt. Legacy alias reuse has no exact recreation guarantee. State corruption or write failure refuses a new wake. Separate state routes and distributed Hosts still require their existing shared execution/lease authority; the local lock is not a distributed exactly-once guarantee.

This is a dispatch brake on existing replan work, not a new review model or provider budget. The configured Host still owns provider retries and token limits; --wake-timeout-seconds bounds this worker's process only when supplied, and the process output byte limit is not a token allowance. Unknown in-flight provider usage remains unknown. Ordinary admitted long work can use successive wakes, and a real negative experiment remains evidence for the original owner.

External Tool Extension Candidates

An MCP server can play two different roles around LoopX:

• a LoopX host adapter exposes LoopX lifecycle reads and controlled writes to an MCP-capable host;
• an external tool extension exposes another product's tools to the host and remains a replaceable provider behind a LoopX outcome capability.

The entries below are discovery notes, not availability claims. Cataloging an extension does not add a LoopX feature, advertise an available capability, or grant credentials, network access, private reads, or external-write authority.

id	upstream surface	status	possible LoopX binding	boundary before integration	promotion evidence
official_xmcp	X Developer Platform XMCP and official MCP documentation	catalogued_not_integrated; no LoopX install check or live qualification	Optional MCP provider for the existing content-ops / social_browser_x outcome path; not a new capability and not a replacement control plane	Host owns OAuth material and X API cost/rate limits. Start with an explicit read-only tool allowlist. Posting, replies, likes, follows, DMs, account changes, paid queries, and private expansion require exact LoopX gates. Do not project raw posts, timelines, DMs, tokens, or MCP payloads into public state.	Provider-neutral operation map; credential-free install/readiness check; metadata-only public-read packet; exact write/private/cost gate plan; compact receipt; focused contract smoke. Live X E2E is a later owner-authorized qualification, not required for catalog status.

XMCP is an official local MCP server that derives more than 200 tools from the X API OpenAPI specification at startup. Its upstream allowlist is therefore a security and cost boundary, not only an output-budget optimization. A LoopX adapter should expose a small operation profile such as public account lookup and bounded recent search instead of forwarding the complete generated tool surface. Streaming and webhook endpoints are outside XMCP's request/response surface; durable monitoring still needs a separate host scheduler or event connector governed by normal LoopX monitor contracts.

X also hosts a documentation-only MCP at https://docs.x.com/mcp. That server may help an implementation agent inspect current X API documentation, but it does not provide social-source evidence and must not be reported as social_browser_x runtime readiness.

Promote an extension candidate to a capability path only when the user outcome, provider-neutral packet, CLI entrypoint, gate model, and focused smoke are all stable. Until then, the extension remains interchangeable infrastructure behind an existing capability.

Projection Rules

• LoopX kernel objects remain authoritative: registry, active goal state, todo, run history, quota ledger, gates, and evidence pointers.
• A connector may project host facts into status or dashboard cards, but it must not store raw transcripts, raw logs, credentials, local absolute paths, or private artifacts in public state.
• Every delivery turn starts with quota should-run scoped by goal_id and registered agent_id.
• Cadence updates, reset-token handling, final quota checks, loop exits, and monitor-only polls do not spend delivery quota.
• User gates must surface concrete user todos or questions. If the payload is missing, the connector reports a projection bug instead of silently waiting.
• Validated delivery ends with durable writeback before quota spend: todo/state/evidence update, refresh-state, and one quota spend event.

Smoke Expectations

Connector smokes should stay narrow. They protect reusable contracts, not one maintainer's local automation:

• prompt and bootstrap smokes cover scoped identity, scheduler_hint, reset policy, and no-spend cadence or final-check behavior;
• local status/server smokes cover loopback-only defaults, read-only browser projection, and explicit dry-run/preview before writes;
• bridge smokes cover compact writeback payloads, liveness counters, and private-boundary stripping;
• todo/writeback smokes cover the validated-work sequence and prove monitor-only or stop-only paths do not spend quota.

Experimental planner-worker mode

Planner-worker is an opt-in experimental slice, not a catalog connector and not a resident scheduler. One call plans, executes at most one worker step, runs caller-approved validation, and returns a typed receipt. Model routes stay explicit; cost remains incomplete until pricing is supplied; live providers (such as TraeX) stay optional.

Operator guide (provider-neutral fake runtime): Experimental planner-worker mode.

Public checks:

python3 examples/experiments/planner_worker/contract-smoke.py
python3 examples/experiments/planner_worker/runtime-smoke.py

Related Contracts

• Host mode plan v0
• LoopX Turn v0
• Heartbeat automation prompt
• Host integration surface v0
• Computer-use runtime v0
• Value connectors
• Session runtime to LoopX projection v0
• Worker bridge install contract
• Quota allocation
• Experimental planner-worker mode