Fix stale workspace guards after replan routing

[huangruiteng]

Goal And Delivered Outcome

• Outcome basis / optional anchor: Reproduced quota route inconsistency.
• Goal/source and gap: An autonomous replan route can have no selected delivery Todo while a due read-only monitor is projected. The workspace guard fell back to an unrelated executable write Todo; route recomputation then exposed the monitor while retaining the write Todo's guard.
• Observable before → after, with the validation row that proves it: Before, the packet combined a due monitor selection with an unrelated repository workspace guard. After, autonomous replan remains authoritative and no workspace guard is created until a delivery Todo is actually selected.
• Issue/task and intended base: No public issue; main.

Author Declaration

• Written by: OpenAI Codex (GPT-6 model family).

Implemented against

• Specification and revision: No written specification; the reproduced quota packet contradiction in this PR is the basis.
• Criteria:

Criterion (spec clause)	Disposition	Symbol / path	Test or command
A replan route without a selected delivery Todo must not inherit another Todo's workspace guard	implemented	_apply_selected_todo_guards	test_replan_route_does_not_leak_an_unselected_workspace_guard_to_monitor
Selected write Todos retain workspace and boundary isolation	implemented	existing selected-Todo guard path	test_workspace_guard_keeps_alternative_todo_selection_available and related focused suite

• Self-check before submission: Reviewed the final diff, ran focused quota/replan/workspace tests, replayed the corrected route through the real packet builder with authorized read-only state, ran the semantic inventory advisory, Ruff, and the public-boundary contract scan. No production mutation or benchmark launch was performed.

Scope And Continuation

• Completed scope and remaining work: Complete within this scope. The change corrects guard ownership; it does not change replan, monitor cadence, or repository write authority.
• Slice boundary / successor: N/A; runtime adoption still requires review and merge.

Validation

• Tested revision: c584af5548b0b8496ff86b0288398c71c76b09bd
• Run state: finished
• Input classes: synthetic, authorized_private_read_only

Check kind	Result	Public-safe evidence / limitation
static	passed	Ruff passed on both changed files; semantic inventory reported no new vocabulary carrier.
unit	passed	93 focused control-plane tests passed, covering selected-Todo guards, workspace identity, quota decisions, monitor/replan scope, and effective turn routing.
real_entrypoint	passed	The real packet builder replayed the previously contradictory route as autonomous replan with no workspace guard; private source state was read-only and is not attached.
static	passed	loopx check reported a clean public-boundary scan for the two changed files; unrelated registry warnings were unchanged.

• Coverage and gaps: The regression exercises the exact priority combination: P0 due monitor, P1 write Todo, multi-agent workspace policy, and a periodic replan obligation. It also keeps existing positive guard coverage. Remote CI remains authoritative for the repository-wide suite.

Frontend / Visual Evidence

• UI impact: none
• Before: N/A
• After: N/A
• States and viewports shown: N/A
• Source data: none
• Attention review: N/A
• Craft review: N/A

Type of Change

• Bug fix
• New feature
• Breaking change
• Refactoring (no functional changes)
• Documentation update
• Test update

LoopX Area

• Control plane (goals, todos, quota, scheduler, registry, runtime)
• Benchmark boundary (adapters, runners, verifiers, scoring, evidence)
• Capability or extension (providers, adapters, skills)
• Public docs or presentation surface (README, protocols, dashboard)
• Build, packaging, installer, or CI
• Host or runtime integration

Technical Direction

• Direction / acceptance reference, when applicable: Core control-plane hardening.

Shared-authority RFC fixture impact

• Production-scale fixture schema: N/A
• Semantic dimensions changed, or reviewed no-impact rationale: No shared-authority fixture schema changes; the fix binds an existing guard to an actually selected Todo.
• Provider conformance arms run: N/A
• Read-only legacy/file/PostgreSQL three-arm rehearsal (required for promotion, runtime-routing, or compatibility-projection changes): N/A

Boundary Checklist

• Neither the diff nor this PR body/comments/attachments disclose private state, credentials, raw traces or verifier output, internal links, or local machine paths (including .loopx/, .codex/goals/, and live ACTIVE_GOAL_STATE.md).
• I did not duplicate maintainer-owned benchmark work unless a maintainer split out a public issue for it.
• I kept the change scoped to the linked issue/task.
• I completed the visual evidence section for UI changes, or marked UI impact none.
• Every commit includes a DCO Signed-off-by trailer (git commit -s).

[loopx-agent]

Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; reasoning_effort=xhigh

动机

运行自动任务的贡献者与维护者。 重规划与到期监控同时出现时，旧包要求为未选中的写入任务切换仓库，挡住当前重规划；当前包保留重规划动作，不再挂上那份 workspace 守卫。

已用真实 packet builder 重现基线矛盾，并验证当前版本恢复重规划；普通写入守卫与普通监控的完整选定投影保持一致。 不改变写入权限、监控周期或合并授权，也不声明安装态与长期执行已验收。 没有发现本次 workspace 修复的阻塞问题；下面另列一个不影响重规划执行的相邻说明缺口。

改动思路

已有路由允许自主重规划、但尚未选择交付 Todo 时，停止调用会回退到第一项写入工作的 workspace 守卫。选择到实际写 Todo 后仍走原守卫。现有 typed quota owner 决定重规划；Python 继续处理本地 Git/路径观察，不新增重规划状态、协议或权限 owner。当前两文件边界可独立验证和回退。

无这项具体矛盾的书面验收，采用独立复现的错误包与原 owner 的“绑定精确投影 Todo”约束；并先读了 docs/quota-allocation.md 及 S7 roadmap，固定参考版本 3dd3c550afecfa0c525a34e8744a3cf06774ac94。这些一般文档不被当成本次新增验收编号。

具体改动

完整 head：c584af55436cc6852850617ce2dc1d9b105c053d；真实 main 分叉点：3dd3c550afecfa0c525a34e8744a3cf06774ac94；全 PR 两文件 +96/-1。

• _apply_selected_todo_guards 新增 selected_todo is None && replan_decision_allowed 的调用隔离；inbox 优先级与其余 guard 顺序保持。
• build_agent_workspace_guard 保持原真实 Git、仓库身份与独立 worktree 检查；本次没有弱化它。
• test_replan_route_does_not_leak_an_unselected_workspace_guard_to_monitor 补双 Agent、到期 P0 监控、外部 P1 写入和重规划同时存在的回归。

对主干的风险

最强反例是误放行仍被选中的写入任务。当前 48 项选题/契约/配额测试，以及 46 项完整 workspace/cadence/replan 测试通过，零跳过。相同实际 packet builder 输入在不可变 base 产生指向 product 写 Todo 的 workspace 守卫，却选择 benchmark monitor，回归断言失败；head 恢复 autonomous_replan_required。五输入 base/head 配对中，普通写入、普通监控和单 Agent 重规划的完整选定投影逐项相同；写入仍会拒绝非独立工作区。

原生 canary 5 direct/16 selected 全通过，无人工 hold；Ruff、diff check、两路径公私边界扫描、语义 advisory 后的完整 semantic smoke 通过。实际源码与 native Effect/Git 路径得到验证，合成输入没有访问活动 Goal；实际安装的 App/Lark、模型理解、长期公平性与 fleet 成本仍未测。当前 no-CI 策略遵守，未读取或等待 CI。

[P2，非阻塞] 相邻 boundary 说明仍可能指向未选 Todo。 同样的重规划输入，把 Goal scope 改为 docs/**、未选写 Todo 保持 src/** 时，head 已可执行重规划，但 reason、blocked_action_scope 和 boundary_projection_gap 仍来自那项未选工作。相邻 build_boundary_projection_repair_hint 与 base 字节相同，本次没有消除这份说明债务；实际 agent_channel 仍允许重规划，CLI 动作也是重规划，因此不把它当作本修复继续阻塞。建议下一次同 owner 的有界整理把 hint 同样绑定选定路由，并保留真实选中写任务的缺 scope 拒绝反例。

我的整体评价

APPROVE 当前有界 workspace 修复。持续工作和当前用户操作路径得到保留：重规划不再要求为另一任务搬仓库，实际写入仍有原隔离门。相关重构已采用最小的 caller 隔离；相邻 boundary hint 整理可安全后续处理，没有必要扩大为新框架或语言迁移。PR body 的 Tested revision 与实际 head 字符串不一致，建议更正；本评审全部证据独立绑定上述真实 head。源资格不等于安装采用、整个 Goal 完成或合并授权。

English verdict: APPROVE - c584af5; fixes stale unselected workspace guards. 94 related tests and immutable base/head counterexamples pass; ordinary write refusal preserved. Nonblocking adjacent boundary-hint explanation remains; installed/long-horizon adoption unverified.