Duang777 · Oct 12, 2026 · Oct 12, 2026 · Oct 12, 2026 · Oct 12, 2026 · Oct 12, 2026
@@ -95,7 +95,9 @@ jobs:
         run: sudo apt-get update && sudo apt-get install -y zsh
 
       - name: Install smoke runtime dependencies
-        run: python -m pip install --disable-pip-version-check "jsonschema>=4.23,<5"
+        # Smokes use the declared test extra (including YAML workflow readers).
+        # Install this source for qualification outside the checkout as well.
+        run: python -m pip install --disable-pip-version-check --editable '.[test]'
 
       - name: Install locked TypeScript parser for semantic production checks
         run: npm ci --ignore-scripts

@@ -785,7 +785,7 @@ jobs:
           tests/test_file_lock.py
           tests/test_file_lock_cross_process.py
           tests/control_plane/test_effect_runtime_integration.py
-          tests/control_plane/test_local_authority_shadow_outbox.py
+          tests/control_plane/test_shadow_observation_retirement.py
           tests/test_self_update_runtime_activation.py
           tests/test_windows_atomic_writes.py
           tests/test_windows_install.py

@@ -1,4 +1,4 @@
-import { HANDOFF_MODES, EXECUTION_HANDOFF_MODES } from "../../../../../loopx/control_plane/coordination/handoff_mode_vocabulary.js";
+import { HANDOFF_MODES, EXECUTION_HANDOFF_MODES, type ExecutionHandoffMode } from "../../../../../loopx/control_plane/coordination/handoff_mode_vocabulary.js";
 import { normalizeGoalDraft } from "../../../../../loopx/control_plane/collaboration/goal_draft.js";
 import { parseTurnStep, type TurnStep } from "./turn-steps.js";
 import { z } from "zod";
@@ -2466,7 +2466,7 @@ export const ownershipPreviewSchema = z.object({
 });
 export type GoalOwnership = z.infer<typeof goalOwnershipSchema>;
 export type OwnershipPreview = z.infer<typeof ownershipPreviewSchema>;
-export type ExecutionOwnershipMode = typeof EXECUTION_HANDOFF_MODES[number];
+export type ExecutionOwnershipMode = ExecutionHandoffMode;
 
 export async function fetchGoalOwnership(goalId: string) {
   return goalOwnershipSchema.parse(await requestJson<unknown>(`/api/chat/goal-ownership?${new URLSearchParams({goal_id: goalId})}`));

@@ -150,7 +150,7 @@ const capabilityCopy: Record<WorkspaceLocale, Record<string, LocalizedCopy>> = {
 const fieldCopy: Record<WorkspaceLocale, FieldCopy> = {
   en: {
     new_goal_provider: { label: "New Goal storage provider", description: "File or SQLite; frozen at creation, independently of execution policy." },
-    canonical_creation: { label: "Create canonical authority", description: "Future Goals only. Disabled retains the post-promotion target; failures require the original creation retry." },
+    canonical_creation: { label: "Create canonical authority", description: "Required for new Goals in 2.0. An older disabled setting remains visible until you enable it; existing Goals require import." },
     new_goal_handoff_mode: { label: "New Goal execution policy", description: "soft_claim or hard_lease, used with canonical creation. Agents inherit the Goal policy; tool authority is unchanged." },
     runtime_profile: { label: "Runtime profile", description: "Restricted keeps scoped LoopX reads only. Trusted owner enables normal host tools while protected operations retain separate checks." },
     selection_policy: { label: "Selection policy", description: "Preferred allows an explicit user choice; pinned rejects another executor; flexible permits fallback only inside the eligible pool." },
@@ -185,7 +185,7 @@ const fieldCopy: Record<WorkspaceLocale, FieldCopy> = {
   },
   "zh-CN": {
     new_goal_provider: { label: "新 Goal 的存储 provider", description: "选择 File 或 SQLite；创建时固定，与执行策略分别选择。" },
-    canonical_creation: { label: "建立 canonical 权威存储", description: "仅影响此后新建的 Goal。关闭时仅固定晋升后的目标；失败须重试原创建操作。" },
+    canonical_creation: { label: "建立 canonical 权威存储", description: "2.0 新建 Goal 必须启用。旧的关闭设置会保留显示，需自行启用；已有 Goal 需导入。" },
     new_goal_handoff_mode: { label: "新 Goal 的执行策略", description: "canonical 创建使用 soft_claim 或 hard_lease。Agent 继承 Goal 策略；不授予工具权限。" },
     runtime_profile: { label: "运行模式", description: "restricted 仅使用受限 LoopX 读取；trusted_owner 开放常规宿主工具，但受保护操作仍单独校验。" },
     selection_policy: { label: "选择策略", description: "preferred 允许用户显式改选；pinned 拒绝其他执行器；flexible 只在已授权资源池内回退。" },

@@ -194,7 +194,7 @@ function useCapabilityMutation({ goalId, loading, onApplied, selected, t }: Read
 
 function CapabilityMutationFeedback({ mutationError, onApplied, partialWrite, preview }: Readonly<{
   mutationError: string | null;
-  onApplied: () => void;
+  onApplied: () => Promise<void>;
   partialWrite: GoalConfigurationPartialWrite | null;
   preview: GoalConfigurationPreview | null;
 }>) {
@@ -214,7 +214,7 @@ function CapabilityMutationFeedback({ mutationError, onApplied, partialWrite, pr
               : "capabilities.partialWriteDescription")}</p>
             <small>{partialWrite.recommended_action}</small>
           </div>
-          <button onClick={onApplied} type="button"><RefreshCw aria-hidden size={15} />{t("capabilities.refreshSource")}</button>
+          <button onClick={() => void onApplied()} type="button"><RefreshCw aria-hidden size={15} />{t("capabilities.refreshSource")}</button>
         </section>
       ) : null}
       {preview ? (
@@ -304,7 +304,7 @@ function CapabilityCatalog({ callbacks, catalog, goalId, loading, notification,
 
         {selected.capability_id === "progress_review" && selected.observation ? <section className="personal-capability-observation" aria-label={locale === "zh-CN" ? "审查证据读回" : "Review evidence readback"}>
           <h3>{locale === "zh-CN" ? "审查证据读回" : "Review evidence readback"}</h3>
-          <button type="button" onClick={onApplied}>{locale === "zh-CN" ? "重新读取审查证据" : "Recheck review evidence"}</button>
+          <button type="button" onClick={() => void onApplied()}>{locale === "zh-CN" ? "重新读取审查证据" : "Recheck review evidence"}</button>
           <p>{selected.observation.read_state === "unavailable" ? (locale === "zh-CN" ? "审查存储不可读，当前判断未知。" : "Review storage unavailable; current judgment unknown.")
             : selected.observation.read_state === "missing" ? (locale === "zh-CN" ? "尚无审查回执。" : "No review receipts yet.")
             : `${selected.observation.receipt_count} ${locale === "zh-CN" ? "条已读取回执" : "loaded receipts"}`}</p>
@@ -451,7 +451,7 @@ export function GoalCapabilitySettings({ callbacks, goalId, notification, onChan
       <section className="personal-capability-error" role="alert">
         <AlertTriangle aria-hidden size={18} />
         <span><strong>{t("capabilities.loadFailed")}</strong><small>{error}</small></span>
-        <button onClick={load} type="button"><RefreshCw aria-hidden size={15} />{t("capabilities.retry")}</button>
+        <button onClick={() => void load()} type="button"><RefreshCw aria-hidden size={15} />{t("capabilities.retry")}</button>
       </section>
     );
   }

@@ -382,8 +382,8 @@ export function MachineConfigurationSettings({ section, onChanged }: { section:
             <section className="personal-capability-behavior-note">
               <ShieldCheck aria-hidden size={18} />
               <div><strong>{locale === "zh-CN" ? "仅影响此后创建的 Goal" : "Future Goals only"}</strong><p>{locale === "zh-CN"
-                ? "启用 canonical 创建后，新 Goal 直接建立权威存储，并采用所选执行策略；失败时须重试原创建操作。关闭时仅固定晋升后的目标存储。已有 Goal 的升级仍需备份、停止写入和结算租约；这里不授予工具权限。"
-                : "With canonical creation enabled, new Goals establish authority with the selected execution policy; retry the original operation after failure. Disabled only freezes the post-promotion target. Existing Goals still require backup, stopped writers and settled leases for upgrade; this setting grants no tool permissions."}</p></div>
+                ? "2.0 新建 Goal 必须启用 canonical 创建，并采用所选执行策略。旧的关闭设置不会自动改变；启用后再重试创建。已有 Goal 需备份、停止写入并导入；这里不迁移已有数据，也不授予工具权限。"
+                : "2.0 requires canonical creation with the selected execution policy. An older disabled setting is not changed automatically; enable it before retrying creation. Back up, stop writers and import existing Goals separately. This setting neither migrates existing data nor grants tool permissions."}</p></div>
             </section>
           ) : null}
 

@@ -248,6 +248,10 @@ def test_scheduler_cancel_reaps_detached_worker_host_and_keeps_receipt(tmp_path)
         str(source / "scripts/external_scheduler_worker.py"),
         "--cli-bin",
         str(cli),
+        "--registry",
+        str(tmp_path / "registry.json"),
+        "--runtime-root",
+        str(tmp_path / "runtime"),
         "--goal-id",
         "fixture",
         "--agent-id",

@@ -41,17 +41,31 @@ def test_task_entry_defaults_to_planning_only_for_loopx_modes(mode):
 
 @pytest.fixture
 def planning_env(tmp_path):
+    from loopx.control_plane.coordination.runtime_shadow import (
+        build_todo_runtime_shadow_projection,
+    )
+    from tests.control_plane.canonical_authority_fixture import (
+        initialize_canonical_authority,
+    )
+
     project = tmp_path / "project"
     project.mkdir()
     task = tmp_path / "task.md"
     task.write_text("Repair the failure and preserve a regression test.\n")
     state = tmp_path / "state.md"
-    state.write_text("# Active Goal State\n\n## Agent Todos\n\n## User Todos\n")
+    state.write_text(
+        "# Active Goal State\n\n"
+        "## User Todo / Owner Review Reading Queue\n\n"
+        "## Agent Todo\n\n"
+        "## Completed Work Archive\n"
+    )
+    runtime = tmp_path / "runtime"
     registry = tmp_path / "registry.json"
     registry.write_text(
         json.dumps(
             {
                 "schema_version": "0.1",
+                "common_runtime_root": str(runtime),
                 "goals": [
                     {
                         "id": "planning-goal",
@@ -64,6 +78,15 @@ def planning_env(tmp_path):
             }
         )
     )
+    initialize_canonical_authority(
+        runtime,
+        "planning-goal",
+        build_todo_runtime_shadow_projection(
+            goal_id="planning-goal", todos=[], handoff_mode="soft_claim"
+        ),
+        state_path=state,
+        provider="file",
+    )
     cli = tmp_path / "loopx"
     cli.write_text(
         f"#!{sys.executable}\nfrom loopx.cli import main\nraise SystemExit(main())\n"
@@ -104,7 +127,7 @@ def planning_env(tmp_path):
         "LOOPX_GOAL_ID": "planning-goal",
         "LOOPX_AGENT_ID": "planner",
         "LOOPX_REGISTRY": str(registry),
-        "LOOPX_RUNTIME_ROOT": str(tmp_path / "runtime"),
+        "LOOPX_RUNTIME_ROOT": str(runtime),
         "LOOPX_CLI": str(cli),
         "CODEX_BIN": str(binary),
         "LOOPX_PROJECT": str(project),

@@ -34,6 +34,9 @@
     normalize_todo_id,
 )
 from loopx.control_plane.todos.handoff_mode import HANDOFF_MODE_HARD_LEASE
+from loopx.control_plane.coordination.local_authority import (
+    LocalCoordinationAuthorityUnavailable, read_canonical_todos_if_promoted,
+)
 from loopx.control_plane.work_items.task_lease import (
     TaskLeaseError,
     acquire_task_lease,
@@ -388,28 +391,38 @@ def _maybe_add_role_successor_todos(
         action=action,
     )
     failure_continuation = decision_summary.get("failure_continuation")
-    if isinstance(failure_continuation, dict):
-        next_outcome = str(failure_continuation.get("next_outcome") or "")
-        successor_specs = [
-            spec
-            for spec in successor_specs
-            if spec.get("action_kind") == next_outcome
-        ]
     text_source_todo_id = None
     if isinstance(failure_continuation, dict):
-        text_source_todo_id = str(failure_continuation.get("source_todo_id") or "") or None
-    return apply_role_successor_todos(
-        registry_path=registry_path,
-        goal_id=goal_id,
-        source_todo_id=source_todo_id,
-        current_agent_id=agent_id,
-        role_id=role_id,
-        action=action,
-        successor_specs=successor_specs,
-        decision_summary=decision_summary,
-        execute=execute,
-        text_source_todo_id=text_source_todo_id,
-    )
+        next_outcome = str(failure_continuation.get("next_outcome") or "")
+        successor_specs = [spec for spec in successor_specs if spec.get("action_kind") == next_outcome]
+        source_todo_id = str(failure_continuation.get("source_todo_id") or "") or source_todo_id
+        text_source_todo_id = source_todo_id
+    def apply_binding(parent_id: str, *, revision: str | None = None) -> dict[str, object]:
+        return apply_role_successor_todos(registry_path=registry_path, goal_id=goal_id,
+            source_todo_id=parent_id, current_agent_id=agent_id, role_id=role_id,
+            action=action, successor_specs=successor_specs, decision_summary=decision_summary,
+            execute=execute, text_source_todo_id=text_source_todo_id,
+            expected_provider_revision=revision)
+
+    try:
+        return apply_binding(source_todo_id)
+    except LocalCoordinationAuthorityUnavailable as error:
+        if error.code != 'todo_semantic_duplicate_conflict' or text_source_todo_id is None:
+            raise
+        # Native create owns normalized title/intent matching. Qualify only its
+        # exact conflicting record, without rewriting a historical parent.
+        snapshot = read_canonical_todos_if_promoted(
+            runtime_root=runtime_root_from_registry(registry_path, None), goal_id=goal_id,
+        )
+        todos = {row['todo_id']: row for row in (snapshot or {}).get('todos', [])}
+        existing = todos.get(error.payload.get('todo_id'))
+        parent_id = existing.get('unblocks_todo_id') if existing else None
+        parent = todos.get(parent_id)
+        if not (parent and parent['role'] == 'agent' and parent.get('action_kind') in SUMMARY_ACTIONS
+                and parent.get('unblocks_todo_id') == text_source_todo_id):
+            raise
+        return apply_binding(parent_id, revision=snapshot['provider_revision'])
+
 
 
 def _executed_successor_todo_ids(successor_todos: dict[str, object]) -> list[str]:

@@ -173,13 +173,13 @@ def apply_role_successor_todos(
     decision_summary: Mapping[str, object],
     execute: bool,
     text_source_todo_id: str | None = None,
+    expected_provider_revision: str | None = None,
 ) -> dict[str, object]:
-    """Preview or create role-declared successor todos through LoopX state.
+    """Create successors, retaining qualified historical source bindings.
 
-    When text_source_todo_id is provided, it is used for rendering the
-    successor text (so the title is stable across different summary todos
-    that review the same failure lineage).  source_todo_id is still used
-    for the unblocks_todo_id binding.
+    Normally one source supplies both title and lineage. A caller recovering
+    an existing successor may preserve its original parent while rendering
+    the same title from the independently verified evidence lineage.
     """
 
     specs = [dict(spec) for spec in successor_specs if isinstance(spec, Mapping)]
@@ -257,6 +257,7 @@ def apply_role_successor_todos(
             action_kind=action_kind,
             claimed_by=claimed_by,
             unblocks_todo_id=source_todo_id,
+            expected_provider_revision=expected_provider_revision,
             dry_run=False,
         )
         successors.append(