refactor(lark): move shared CLI transport out of Kanban

[songoow]

Goal And Delivered Outcome

Ordinary Lark transport and identity callers imported their subprocess runner and result decoder from the Kanban presentation module. Move that existing IO contract into extensions/lark/cli_transport.py and migrate all repository consumers, keeping Kanban's domain APIs with the presentation owner.

A cold goal_channel_transport import no longer loads the seven Lark presentation and four Todo modules observed at the baseline. A disposable source tree containing only six package/provider files can execute a real local subprocess and decode its result with both presentation and control-plane source directories absent. This is dependency-isolation evidence, not a latency claim.

Author Declaration

• Written by: OpenAI Codex agent, directed by the branch owner.
• Specification and revision: bounded provider-ownership maintenance request; shipped Kanban command behavior at 3300dfdd29fe6e53e1aa4a0282ca3952db6e9e8f and the repository's existing extension-placement contract.

Criterion	Disposition	Evidence
Preserve process/result behavior	implemented	Five extracted functions and their constants retain baseline ASTs after internal function renames; characterization ran before extraction
Remove transport-to-presentation dependency	implemented	All internal consumers migrated; source-absence subprocess test and cold import check
Preserve provider authority and app environment	implemented	Preview/credential refusal, timeout/error tests; cli_resolution retains executable discovery and its PATH-aware runner

Python remains the provider IO adapter; no kernel decision owner or caller-facing capability is added. The future-facing pass also removes the duplicate callable annotation by reusing CommandRunner. Unrelated runner shapes, retries, external readback and permissions retain their existing owners.

Scope And Continuation

Complete within this IO extraction. No wrapper was added for unadvertised internal presentation helpers: production, tests and examples use the new owner; extension doctor contracts retain the actual Kanban APIs. No configuration, activation or visible frontend changes. Private JSON writer consolidation is independently proposed in #6402; the two exact branch heads merge without text conflicts.

Validation

• Tested revision: 770d269a6f2aff38b3389c94c4628d8315ceb922.
• Run state: finished. Input classes: synthetic, public_fixture.

Check kind	Result	Evidence
regression_parity	passed	19 characterization cases passed on the old owner; exact moved-function AST parity plus independent caller/default/import review; no remaining internal old-helper imports
real_entrypoint	passed	Real subprocess UTF-8/CWD, exit-vs-provider-error, timeout, missing executable, preview, credential refusal, source-absence tests and examples/lark-kanban-control-plane-smoke.py
integration	passed	Final transport/resolver/Explore selection: 70 passed; final import-placement selection: 62 passed. Commission/return scenarios on qualified Node 22.22.3 with a fresh isolated runtime: 100 parameterized cases and 3 representative cases passed
static	passed	Focused Ruff, public-boundary scan, semantic advisory including the new source, git diff --check, extension doctor import/export check
unit	failed	Initial broad selection: 1,052 passed, 4 failed, 100 setup errors. A stale test monkeypatch was corrected; shared-daemon environment errors were requalified in isolation. One unchanged UTF-8 source-audit failure remains at goal_amendment_runtime.py:92, independently reproduced on the immutable baseline and covered by existing #6397. The broad command was not rerun to a single all-green result.

Changing PATH alone did not replace the already-running shared Effect daemon; the successful qualification used a new temporary runtime without restarting an existing daemon. No live Lark requests/messages, installed Desktop or deployed-runtime acceptance is claimed. The changed backend boundary is the real local subprocess/filesystem; higher-level provider fixtures remain synthetic.

Frontend / Visual Evidence

UI impact: none. Existing Chat/Lark/CLI callers use the same provider operations, output fields and recovery semantics. No first-screen changes.

[loopx-agent]

Reviewer: model_agent · gpt-6.1-sol · OpenAI · runtime_reported · xhigh

动机

普通飞书传输和身份调用为了启动一个命令，过去必须先导入看板展示模块，连带加载七个展示模块和四个 Todo 模块。开发者维护传输时因此需要理解看板依赖，冷启动的依赖面也更大。此次把已有执行与结果解码搬到 provider IO owner，所有仓库内调用者一起迁移；实际冷导入已不再加载上述模块。它交付依赖隔离，不宣称延迟提升或远端飞书已验收。

改动思路

共享的进程执行、凭据参数拒绝与输出解释归 cli_transport；cli_resolution 继续发现 executable 并准备 Node PATH，看板、Explore、会话模块保留业务判断、重试、权限及远端回读。进程成功仍不等于外部效果已验证。Python 是已有 provider IO 适配器，没有新增 kernel 决策 owner。

搬迁已有 IO 函数并迁移活跃消费者，保留业务、权限与重试 owner，避免普通传输依赖看板展示。
本 PR 边界是共享 Lark CLI IO 提取及同仓调用迁移，不新增 capability、设置、执行许可或可见 UI。

下表依据当前 head 源码说明依赖变化，属于讲解，不能替代运行证据。

触发	旧路径	新路径	保留的边界
会话传输导入/命令调用	看板→展示/Todo 依赖→runner	cli_transport→runner	caller 自行决定权限、重试、远端回读
显式预览/内联凭据	旧 helper 拒绝执行	同一搬迁函数	无子进程/拒绝敏感参数

具体改动

完整审查 770d269a6f2aff38b3389c94c4628d8315ceb922 对 common base 3300dfdd29fe6e53e1aa4a0282ca3952db6e9e8f 的 27 文件 +438/-277；Git 与 GitHub 文件清单一致。五个搬迁函数 AST 仅归一私有函数改名后相同；四个常量/类型仅将 Optional[T] 归一成 T|None。其余 23 个生产文件完整 AST 除导入引用和等价返回类型外相同，保留看板真正的 domain API。

规范依据：docs/reference/extensions.md @ 3300dfdd29fe6e53e1aa4a0282ca3952db6e9e8f 的 Runtime Responsibilities：provider 负责外部调用和 observation/effect/readback，kernel 拥有 durable state，implemented；Extensions And Capabilities 的能力/扩展独立维度与最近 owner 规则，implemented，无新能力或安装面。生成语义清单同步义务当前 not_met，见下方 P2。

关键代码讲解

• cli_transport.default_subprocess_runner：argv、cwd、timeout、UTF-8 replacement 及原结果字段原样保留。
• run_command：先拒绝内联凭据，再处理 preview；execute 区分进程非零、provider ok/code、TimeoutExpired 与 OSError，不授予远端操作权限。
• command_error：保留 provider error/msg 优先级，随后 stderr/stdout 紧凑 fallback 和 1800 限制。
• cli_resolution.build_lark_command_runner：仅复用 CommandRunner 类型，发现/目标 executable 的 PATH owner 不迁移。

对主干的风险

[P2] 同步搬迁引起的注册表 I/O 清单漂移

chat_lark_api.py 的新导入 与 goal_channel_lifecycle 的导入收缩使下方 registry 读取行号各移动三行，已有 project_registry_io_manifest_v1.json 未同步。独立完整语义检查在 immutable base 通过、此 head 失败；内存生成比较定位了 11 个已有 codec_read site 元数据变化，分类及业务调用未改变。故这不是旧失败，必须修复当前提交的生成清单一致性。

最小修复：运行 uv run python scripts/generate_project_registry_io_manifest.py，审查并提交仅相关清单更新，再运行 uv run python scripts/generate_project_registry_io_manifest.py --check 和 uv run --extra test python examples/semantic-vocabulary-drift-smoke.py。无需重写 IO 规则或扩大到其它 runtime 修复。

语义与 CI 对齐

changed-source advisory 没发现支持的新 vocabulary carrier，不能替代完整检查；该 PR 复用已有 vocabulary，但清单的新 metadata 义务未满足。native canary 为 5 个 direct 通过、19 个 selected 中 2 失败。上述语义失败由 PR 引入；另一个 CLI emitted-output budget 失败已在相同 immutable base 重现，须保留为独立主干问题，不能靠扩大预算消除。CI 未查询、未等待。

独立当前 422 个相关 Python 测试及看板 smoke 通过，19 个真实进程 characterization 在基线通过；当前附加物理删掉展示/control-plane 源码的六文件 transport 测试也通过。预览无进程、凭据拒绝、UTF-8/cwd、provider/进程错误、超时已启动事实和缺 executable 均有实际子进程证据；高层飞书客户端为公共夹具，没有真实发消息、安装 Desktop、远端 provider 或 native Windows 资格。

我的整体评价

REQUEST_CHANGES：共享 IO owner 的设计和完整迁移是合适的，当前搬迁行为有实证；唯一当前阻塞是 11 个 site 的生成清单漂移。长期维护路径改善了依赖隔离，原重试/回读义务保持；用户原操作和失败语义保持，没有新的授权和设置步骤。未来重构检查已应用在 CommandRunner 共用及完整调用迁移；无需新增框架。重审应看更新后的完整 exact head 和两项语义重验，不能继承本轮判断。作者早期 broad selection 的失败只保留其披露，未宣称那一整组已恢复；当前局部资格不等于部署或长期收益。

English verdict: REQUEST_CHANGES. The transport extraction is behavior preserving, but it shifts eleven registry IO sites without updating the generated manifest. The full semantic check passes on the immutable base and fails at this exact head. Regenerate the manifest and rerun its check plus the full semantic smoke. The separately reproduced baseline output-budget failure remains a distinct hold.

[songoow]

Rebased on f713e0f → 024ade1. The patch content is unchanged; git range-diff differs only in one context import that main added nearby.

• The P2 generated-manifest drift no longer applies. refactor(semantics): compute the registry I/O census on demand #6375 stopped committing project_registry_io_manifest_v1.json: the census is now computed on demand, and generate_project_registry_io_manifest.py --check requires --output.
• On the new head:
  • examples/semantic-vocabulary-drift-smoke.py ok;
  • tests/architecture/test_project_registry_io_census.py 15/15;
  • this PR's tests plus the Lark extension/presentation tests: 872 passed.
• The separately reproduced CLI emitted-output budget failure on the base is untouched by this PR.

中文：已变基到最新 main；#6375 已不再提交 registry IO 清单（按需计算），评审指出的清单漂移在新基线上不再存在，完整语义 smoke 通过。

[loopx-agent]

Reviewer: model_agent · gpt-6.1-sol · OpenAI · runtime_reported · xhigh

Exact head: 024ade1. APPROVE.

动机

普通飞书传输与身份调用为了启动一个命令，过去要先加载看板展示模块，连带七个展示模块与四个 Todo 模块。维护者因此把 provider IO 与看板业务一起维护。本次把既有执行和解码搬到独立的 Lark IO owner，并迁移仓库内消费者；实际冷导入不再加载这些展示/Todo 模块。这个切片交付依赖隔离，保持原来的命令和失败行为。Native Windows、真实飞书发送、已安装 Desktop、完整历史 broad suite 与长期性能收益未验证；不授予合并或升级权限。

改动思路

现有 cli_transport 承接进程执行、凭据拒绝、JSON 解码与错误展示；cli_resolution 保留 executable 发现和 Node PATH，Kanban、Explore、会话调用继续拥有权限、重试和远端回读。进程成功仍不证明远端效果。Python 继续承担 provider IO，没有创建第二个 TypeScript kernel 决策 owner。

迁移五个已有函数并同时更新实际消费者，能去掉反向展示依赖；仅加一个转发模块会保留原依赖问题。当前 PR 边界是 Lark IO 提取及完整同仓调用迁移，不新增 capability、配置、状态机或可见 UI。没有保留无活跃外部契约的私有 helper wrapper；看板真正的 domain API 仍保留。以下表格是源码讲解，实际行为证据另列。

触发	原路径	当前路径	原有义务
传输导入/执行	Kanban → 展示与 Todo → subprocess	cli_transport → subprocess	caller 自行授权、重试、验证远端结果
preview / 内联凭据	禁止启动 / 拒绝凭据	相同次序和结果	预览不产生进程，凭据保留在原 auth owner

具体改动

完整审查 common base f713e0f 上 27 文件 +438/-277；没有把较新的 main 与分支之间的反向差异混入本 PR。规范依据 docs/reference/extensions.md @ f713e0f：Runtime Responsibilities 的 provider/kernel 责任分离 implemented；Extensions And Capabilities 的独立注册与最近 owner 边界 implemented，无新 capability 或安装面。

关键代码讲解

• default_subprocess_runner 保留 argv、cwd、timeout、UTF-8 replacement 与原结果字段，真实子进程已验证 cwd/非 ASCII 输出。
• run_command 先拒绝内联凭据，再处理 preview；执行后区分进程退出、provider ok/code、超时和缺 executable，caller 权限不迁移。
• command_error 保留 error/msg 优先级与 stderr/stdout 的 1800 限制；同一真实 base/head probe 的完整语义结果相等。
• build_lark_command_runner 仅用已验证等价的 CommandRunner 替代重复 Callable 返回注解，PATH 发现及执行环境保持原 owner。

独立 AST 比较：五个函数仅归一私有改名后相同，四个常量/类型等价；23 个既有生产文件仅导入、owner 符号引用与明确等价类型注解不同，没有归一决策、字符串或常量。新测试包括物理缺少 presentation/control_plane 源码的六文件树，真实 subprocess 经 goal_channel_transport 完成解码；普通旧路径的依赖事实由两侧冷进程独立观察。

对主干的风险

无当前阻塞发现。真实 base/head 同一 Python 3.11.17 probe 覆盖 preview 未启动、凭据先拒绝、UTF-8/cwd、provider 拒绝、进程非零、超时已启动事实、缺 executable 与错误优先级；结果字段和文本相等。当前相关 328 项测试、Kanban smoke 通过，无 skip。风险在广泛消费者导入迁移，完整生产 AST 和实际消费者测试共同覆盖；高层飞书状态为合成夹具，不代表外部账户或远端消息验收。回滚这一有界迁移即可恢复原 owner。

语义与 CI 对齐

旧 review 的“提交生成 census”要求已被当前主干的 on-demand census 契约取代，本 head 和 common base 的生成器/规则源码相同。直接沿用旧 --check 命令会报需要 --output，所以改按当前规则运行完整 semantic smoke；两侧都通过。baseline 首次因缺 TypeScript 依赖未完成，补齐相同依赖后重验通过，未当作语义失败或 PR 修复。当前 canary 5 direct / 19 selected 全通过，0 failure/hold，包含完整 semantic 与公共边界。没有查询或等待 GitHub CI。advisory 不能替代完整检查；本次复用已有 vocabulary，不新增共享语义。

我的整体评价

APPROVE，仅绑定上述当前 head；旧 verdict 不自动继承。长期维护结果是已证实的依赖收敛，用户原操作与失败语义保持；没有测量启动延迟或长期净收益。未来重构检查已应用于共同 IO owner、重复类型消除与完整调用迁移，再加框架没有实际价值。作者正文仍引用旧 tested revision/broad-suite 历史，不能用来证明当前完整 suite；本次局部验证与当前 canary 有独立证据。合并仍需单独的精确 head readiness 和 maintainer authority。

English verdict: APPROVE — 024ade1. Full current-scope review, five-function AST parity, 23 consumer-body comparisons, paired real subprocess behavior, source-absence isolation, 328 tests and current risk checks pass. The previous checked-in census obligation no longer exists at the common base; current semantic validation passes on both sides. No live Lark, installed Desktop, native Windows or latency claim.