fix(operations): return transport-specific preflight recovery

[loopx-agent]

Operation preflight used correct_execution_profile for every transport refusal. A DSH runtime with working model credentials could therefore be told to repair its model profile even though native operation tools support only Codex. The execution refusal also suggested model-key environment variables for sandbox and profile errors.

The existing typed transport owner now returns the matching host, sandbox, or model-profile recovery choice and its supported host/sandbox values. Python forwards that readback and omits credential hints for operation transport refusals. Requested hosts, opt-in behavior, native identity, confirmation, first consumption and execution fences remain unchanged. Both RFC language mirrors describe the readback.

Validation: 167 focused tests passed / 2 skipped initially; after strict host-type correction, 56 targeted tests passed, including 6 File/SQLite CLI cases and 5 malformed-host counterexamples; 16 typed-owner tests passed. The configured local DSH SDK/API readback passed against candidate source, with exact feature-off parity against the retained installed release and all three recovery cases. Ruff, semantic advisory/full smoke, diff check and scoped public-boundary scan passed. Initial CLI test expectations and a candidate array-to-string coercion counterexample were corrected before publication; DSH with the Codex-only CLI flag is still rejected by the original argv owner.

This is the completed transport-preflight slice of the DSH integration frontier documented in #6453. It does not implement the DSH native operation connection, genuine confirmation, venue execution, original-card/source return, or a new execution grant. No global runtime upgrade or Core merge is performed by the author.

Follow-up qualification: an independent sandbox-array counterexample showed that the previous sandbox string coercion still accepted ["read-only"]. The same typed owner now requires a sandbox string, with six malformed sandbox cases. Final related Python tests: 62 passed; existing typed-owner tests: 16 passed. This does not weaken the Codex-only CLI flag boundary or add DSH execution authority.

[loopx-agent]

Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; reasoning_effort=xhigh

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

Reviewed head: f5ff899860480c543291cd9af78ef45f4ae16973。共用作者账号发布独立 COMMENTED 评审结论。

动机

通过现有 delegation 或 Turn 预检配置操作宿主的维护者，需要知道究竟是宿主、sandbox 还是模型配置不受支持。 旧预检对所有操作传输拒绝都建议修模型，还把配置模型凭据当作恢复步骤；即使普通 DSH 模型已可启动，也无法获得仅支持 Codex 的操作连接。当前补丁由原 typed owner 返回对应恢复选项，保留用户选定宿主和真实拒绝。 固定 base/current 实际 API 对照中，宿主、sandbox、模型三种恢复提示分别正确；四个未开启操作工具的完整输出相同，现有 File/SQLite CLI 预检拒绝无写入，合法配置仍只标 runtime-unverified。 这里只完成原预检恢复提示及严格输入类型修复，不实现 DSH 原生操作连接，不自动改宿主、sandbox 或账户，不授予 human confirmation、消费或执行权限。

改动思路

恢复分类留在既有 TypeScript transport owner，Python只转发；支持范围和恢复选项同源返回，不复制宿主规则、不自动替换用户选择。 本 PR 验收完整现有预检与拒绝后恢复提示；实际 DSH 操作连接、批准消费和原渠道回传保持独立未验边界。

最强反对理由是恢复提示悄悄改选更有权限的宿主或sandbox，或把SDK启动当作原生操作资格。当前只修readback，原executor、profile、runtime probe、native身份与确认/首次消费fence保留；Python不再按原因自行分类。正值输入不被自动改写，操作传输修复不影响普通DSH缺凭据时真正需要的凭据提示。

具体改动

完整6路径 +174/-6，两个production owner及两个测试文件、RFC双语。TS projectManagedOperationTransport:69 先验证host/sandbox必须是string并属于原支持范围，再沿既有model/effort规则，返回对应恢复选择及supported lists。Python _with_operation_transport:176 只在原opt-in下消费typed结果；managed_executor_unavailable_payload:389仍在journal/host/quota之前拒绝，仅对operation transport不附无关model-key变量。新参数没有替代原host flag或settings owner。

关键代码讲解

host错误给 select_supported_operation_host，sandbox错误给 select_supported_operation_sandbox，profile缺失仍给 correct_execution_profile；支持集合是Codex及read-only/workspace-write。原String(sandbox)能把单元素数组当string接受，当前明确拒绝；model/effort词汇和身份/批准语义未变。configuration_valid只表示预检通过，runtime_qualified:false、human_confirmation_required及first_consumption_required一直保留。既有CLI先拒绝DSH加Codex-only flag，不能为了展示新提示绕过原argv owner。

依据变更前 docs/architecture/rfcs/human-confirmed-domain-operations-v0.md，固定 3c681f1132fe719e01f75e5a41bfd854dfa9e346：Existing delegation and Turn entry 的显式配置、不可用预检及runtime-unverified implemented；Confirmation, one-shot consumption and recovery 的独立强义务保持 implemented，16个既有typed identity/consumption/inbox反例验证。本补丁是现有预检提示修复，原frontend components和CLI选项owner未变，不新增配置存储或自动授权；完整DSH原生连接/frontend/Lark操作旅程仍未交付。

对主干的风险

同一真实已安装SDK解释器，用显式PYTHONPATH分别运行fixed base/current Core和TS backend；只给dummy credential并不发模型请求。八组API对照中普通DSH、缺key、Codex、generic四个完整binding/payload JSON相同；普通缺key仍给configure_operator_credential和DEEPSEEK_API_KEY提示。操作host/sandbox/profile三种原因保持拒绝，却返回正确对应恢复选项且不提示key，原executor/profile/runtime probe完整保留。合法配置只增support metadata，无运行资格或effect。十一种恶意host/sandbox输入全部拒绝；base两个sandbox数组实际被接受，current拒绝，证明strict修复的反方向。明确修好sandbox/profile后的原owner预检可读且configuration_valid真，runtime qualification仍false，拒绝恢复没有越权跳转。

另做四个实际File/SQLite拒绝→明确修正→重新inspect的恢复用例，12.96秒全通过，configuration_valid转true而runtime_qualified仍false，配置/registry不被inspect改写，无host启动或effects。当前四模块实际139Python测试全通过、0skip，耗260.35秒，覆盖File/SQLite真实delegation CLI inspect、读取前后config/registry字节不变及DSH flag拒绝；16项typed operation测试0skip通过，含原生身份伪造、callback wake、first consume、撤销及reconciliation。Ruff通过，开发advisory后完整native semantic/risk check，4direct+18selected/executed通过，0fail/timeout/manualhold，6公开路径扫描干净。新remediation词扩展既有TS owner词汇，未新增Python决策源；advisory不覆盖unnamed literals，人工核对了语义、调用者及默认行为。latest main仅合入6460测试转发；当前操作owner、相关DSH/Core及accepted RFC字节未变，不失效这里的base证据。未查询、轮询、等待或启动CI。

我的整体评价

APPROVE，无阻塞finding。long_horizon及user_experience因对应恢复选项而改善，普通入口默认关闭行为和真正缺凭据提示有完整对照，预检通过仍不能变成操作资格。future-facing pass已把可支持范围和恢复选择放回单一typed transport owner，删除Python平行模型分类；无需额外框架或宿主改选器。Native DSH连接、真人确认、域执行和原会话结果返回不能由这些fixtures证明；此COMMENTED结论不授merge权限，closeout/readiness分别回读。

English verdict: APPROVE - f5ff899; the existing typed transport owner supplies matching host/sandbox/profile recovery without changing the chosen executor or authority. Eight real base/head readbacks preserve four complete ordinary outputs, eleven malformed cases refuse, and139Python/16typed tests pass. DSH operation execution and original-channel return remain unqualified; this author-owned COMMENTED review grants no merge authority.