diff --git a/docs/architecture/rfcs/STATUS.md b/docs/architecture/rfcs/STATUS.md index ab35913d88..1d17fb99c5 100644 --- a/docs/architecture/rfcs/STATUS.md +++ b/docs/architecture/rfcs/STATUS.md @@ -65,7 +65,7 @@ appendix may keep dated history, but no dated log heading may precede it. | [RFC: Shared Goal Alignment and Governed Amendment Protocol (v0)](shared-goal-alignment-and-governed-amendment-v0.md) | Accepted | none | [2 entries](ledger/shared-goal-alignment-and-governed-amendment-v0/) | | [RFC: LoopX Shared Control-Plane Authority and Pluggable State Providers (v0)](shared-goal-authority-state-provider-v0.md) | Accepted | none | [24 entries](ledger/shared-goal-authority-state-provider-v0/) | | [RFC: Single-Owner Local Daemon (v0)](single-owner-local-daemon-v0.md) | Accepted | none | — | -| [RFC: TypeScript Control-Plane Migration Direction v0](typescript-control-plane-migration-v0.md) | Accepted | none | [14 entries](ledger/typescript-control-plane-migration-v0/) | +| [RFC: TypeScript Control-Plane Migration Direction v0](typescript-control-plane-migration-v0.md) | Accepted | none | [15 entries](ledger/typescript-control-plane-migration-v0/) | ## Superseded (1) diff --git a/docs/architecture/rfcs/STATUS.zh-CN.md b/docs/architecture/rfcs/STATUS.zh-CN.md index 223877626c..73458f5fa7 100644 --- a/docs/architecture/rfcs/STATUS.zh-CN.md +++ b/docs/architecture/rfcs/STATUS.zh-CN.md @@ -62,7 +62,7 @@ | [RFC：共享 Goal 对齐与受治理 Amendment 协议（v0）](shared-goal-alignment-and-governed-amendment-v0.zh-CN.md) | 已接受 | 无 | [2 条](ledger/shared-goal-alignment-and-governed-amendment-v0/) | | [RFC：LoopX 共享控制面权威与可插拔状态 Provider（v0）](shared-goal-authority-state-provider-v0.zh-CN.md) | 已接受 | 无 | [24 条](ledger/shared-goal-authority-state-provider-v0/) | | [RFC: Single-Owner Local Daemon (v0)](single-owner-local-daemon-v0.md) | 已接受 | none | — | -| [RFC：LoopX 控制面 TypeScript 渐进迁移方向 v0](typescript-control-plane-migration-v0.zh-CN.md) | 已接受 | 无 | [14 条](ledger/typescript-control-plane-migration-v0/) | +| [RFC：LoopX 控制面 TypeScript 渐进迁移方向 v0](typescript-control-plane-migration-v0.zh-CN.md) | 已接受 | 无 | [15 条](ledger/typescript-control-plane-migration-v0/) | ## 已被替代 (1) diff --git a/docs/architecture/rfcs/agent-loop-effect-interpreter-v0.md b/docs/architecture/rfcs/agent-loop-effect-interpreter-v0.md index ed04ee4d5e..5659378837 100644 --- a/docs/architecture/rfcs/agent-loop-effect-interpreter-v0.md +++ b/docs/architecture/rfcs/agent-loop-effect-interpreter-v0.md @@ -479,7 +479,7 @@ Current source-path audit for the first convergence slice: | Full requirements | Authoritative Agent-channel work context plus remaining reads; effective Todo, acceptance and scoped User obligations, with the full Goal on its progressive read | Registered source readers fulfill current task reads inline in both transports; the mixed Goal remains mandatory on its full read path; source failure holds dependent delivery. Live model adoption and packaged host journeys remain unqualified | | Capability refusal | Existing quota `capability_gate_v0`; compact boundary now retains exact `required`/`missing` arrays and historical source names | This repairs omitted facts, not readiness policy or capability activation | | Selection / claim / lease | Selected Todo, action portfolio and current owning transactions | Compact selected ownership is not a fresh lease; retain the captured source and revalidate at the owning mutation | -| Replan / Goal closure | Replan action packet and the existing TS capsule preserve full audit steps/guidance, current judge and evidence/non-proof conditions | Same captured File/SQLite decisions qualify clause retention and signature mutation; full evidence stays on authorized detail paths. Host/model adoption remains open; Todo completion is not Goal completion | +| Replan / Goal closure | Replan action packet and the existing TS capsule preserve full audit steps/guidance, current closure assessment (judge) and evidence/non-proof conditions | Same captured File/SQLite decisions qualify clause retention and signature mutation; full evidence stays on authorized detail paths. Host/model adoption remains open; Todo completion is not Goal completion | | Settlement / scheduler | Intact typed settlement plan and explicit host-owned scheduler projection; omitted scheduler argv references resolve the same captured full decision | Unbound detail commands are retired in this projection. Actual host readback, stale mutation refusal and exactly-once recovery still need host adoption qualification | | Optional memory | Verified boundary participation plus fresh host binding | Off/recall/ingest/stale/provider-failure isolation remains mandatory; transport parity is not model value | @@ -494,7 +494,7 @@ open until their own acceptance is met; this inventory is not blanket permission to delete the remaining Python IO adapters. The continuation-audit projection also retains every ordered closeout step and -the complete current judge. Earlier capsules dropped those fields while signing +the complete current closure assessment (judge). Earlier capsules dropped those fields while signing their already reduced projection, and clipped the continuation guidance to 48 characters. Captured File/SQLite work and replan paths now retain those clauses and reject signature equivalence after a step/order/judge mutation. The existing diff --git a/docs/architecture/rfcs/agent-loop-effect-interpreter-v0.zh-CN.md b/docs/architecture/rfcs/agent-loop-effect-interpreter-v0.zh-CN.md index f2adf31376..4c1581b833 100644 --- a/docs/architecture/rfcs/agent-loop-effect-interpreter-v0.zh-CN.md +++ b/docs/architecture/rfcs/agent-loop-effect-interpreter-v0.zh-CN.md @@ -335,9 +335,9 @@ envelope 投影，Codex CLI 保持关闭隔离；这不代表安装态 heartbeat |---|---|---| | Goal/Agent/Todo 身份 | quota 选择及回执；envelope actor、selected Todo 和签名结算身份 | 捕获身份与写入时校验仍必要；展示身份不授予执行权 | | 完整要求 | Agent channel 权威 work context 与剩余必读；有效 Todo、验收及 scoped User 义务，完整 Goal 保留渐进式全文读取 | 注册 reader 在两种传输中满足当前任务读取；来源失败会阻止依赖它的交付，真实模型采用和打包宿主旅程仍待验收 | -| 能力拒绝 | 既有 capability_gate_v0；短包保留原样 required/missing 与源中历史字段 | 修复事实遗漏，不改变就绪策略或能力开启 | +| 能力拒绝 | 既有 quota `capability_gate_v0`；短包保留精确 `required`/`missing` 数组与源中历史字段 | 修复事实遗漏，不改变就绪策略或能力开启 | | 选择／claim／lease | selected Todo、action portfolio 及当前所属事务 | 短包归属不是新鲜 lease；保留捕获源并在所属写入入口复核 | -| replan／Goal 收尾 | replan action packet、contract capsule 和 vision audit | 完整证据仍走有权限的详情；Todo 完成不证明 Goal 完成 | +| replan／Goal 收尾 | replan action packet 与既有 TS capsule 保留完整、有序 audit 步骤/指导、当前 judge（收尾评估） 及证据与非证明条件 | 同一捕获的 File/SQLite 决策验证条款保留与签名突变；完整证据仍走有权限的详情。宿主/模型采用仍开放；Todo 完成不证明 Goal 完成 | | 结算／scheduler | 完整 typed 结算计划及显式宿主调度投影；省略的调度 argv 引用同一捕获的完整决策 | 此投影退役未绑定的详情命令。实际宿主读回、过期写入拒绝与一次恢复仍待宿主采用验收 | | 可选 memory | 核验后的 boundary 参与事实及新鲜宿主绑定 | 关闭／recall／ingest／失效／provider 失败隔离持续保留；传输等价不是模型收益 | @@ -347,6 +347,12 @@ envelope 投影，Codex CLI 保持关闭隔离；这不代表安装态 heartbeat 结算另有覆盖，仍不证明安装态 App 收敛或模型成本。以下三项继续按各自验收保持 未完成；这份核对不授权批量删除剩余 Python IO adapter。 +接续 audit 投影还保留每个有序 closeout 步骤和完整当前 judge（收尾评估）。旧 capsule 在签名前就 +遗漏这些字段，并把接续指导截成 48 字符。捕获的 File/SQLite 工作和 replan 路径现在 +保留这些条款，修改步骤、顺序或 judge 后拒绝签名等价。既有 8 KiB 诊断阈值不变， +必需文本可以超出并警告。这只关闭传输遗漏，不代表三项收敛验收通过，也不授权退役仍 +活跃的 Python/host adapter。 + 统一工作上下文现在由既有 TS interaction owner 选择并满足必读，注册的 Python adapter 核验来源，在普通 heartbeat/quota 与签名 envelope 中返回完整当前任务来源， 无需启用 TurnEnvelope。混合 Goal 文件仍必须经渐进式路径全文读取，不能按历史标题 @@ -373,6 +379,14 @@ live 模型结果、App 采用或以下三项收敛验收完成。 | 在真实宿主 renderer 采用同一 typed 投影 | heartbeat full/thin 与 Turn host 消费同一执行事实及同 Turn 捕获/详情入口；显式保留通知和 scheduler 的宿主传输。真实 File/SQLite CLI 与打包 Codex App 覆盖重入、来源丢失、必读前拒绝、迟到结果、backoff 和一次结算；补读不触发第二次准入。最后调用方迁移后才退役旧投影。 | | 核验上下文形态及迁移默认 | 将相同的正常、replan、等待/恢复与可选能力负载同时对照当前完整和短包路径，测量载荷/model token、详情 IO、延迟、资源增长、遗漏、决策与结果质量。数据丢失、重复效果、身份和结算错误保持硬约束；保留受支持的已保存 prompt/回执与可逆 rollout，根据证据再改预算或默认。 | +原生 Turn detail 采用现持久化真实 `run-once` producer 的完整 observation，由既有 TS +envelope owner 将 Host 请求绑定到它。真实 File/SQLite CLI 检查实际 subprocess 输入， +改变 canonical Todo 来源，验证原详情、重试和无效果 replay；模型 provider 是协议 +fixture。只读规划与可选 quota capture 默认值不变，原生执行 Turn 现保留私有 capture +证据。证据缺失或不匹配拒绝再次调用 Host；legacy 缓存结果恢复与终态读回保留原 receipt。 +这只关闭 producer 到 detail 的传输缺口。真实模型、打包 App/Lark、后续 authority 检查 +及其余收敛矩阵仍独立验收，本切片不退役任何 Python 投影。 + 此前成本切片已复现回归预算缺口，不能归因于 fixture alias，也不授权删掉 必需上下文。`aa87cc019` 与 `fc411c878` 使用相同公共 CLI fixture、临时 alias 和命令参数，实际 JSON stdout 测量如下： diff --git a/docs/architecture/rfcs/app-conversation-and-async-inbox-v0.md b/docs/architecture/rfcs/app-conversation-and-async-inbox-v0.md index 3c80b67888..49dc23ed0a 100644 --- a/docs/architecture/rfcs/app-conversation-and-async-inbox-v0.md +++ b/docs/architecture/rfcs/app-conversation-and-async-inbox-v0.md @@ -270,6 +270,24 @@ resume. Earlier source evidence records a Codex canary editing and reading back synthetic note while preserving prior text and creating no Goal. This historical host/filesystem evidence is separate from current synthetic-protocol regression checks and does not qualify live Lark, material intake or a release. +Disconnecting a binding or replacing its identity, context or grant first +publishes typed revocation, then reuses Core's exact-Turn interruption. Cancel +that binding's queued work before stopping its active Turns, including topic +and resumed Sessions; unrelated authorized work continues. History remains +readable and unchanged-configuration retries do not interrupt execution. Never +hold the authorization-publication lock while waiting for the host to stop or +create another queue, scheduler or provider authority. An unconfirmed stop +retains revocation and reports failure. Retrying disconnect with the old binding +identity and current revision continues stop confirmation, including after a +failed replacement. Settings projects pending/running targets from Core's +persisted state, retains exact stop recovery across refresh and reload, and +removes recovery only after Core confirms termination. It does not restore the +grant or change the new binding and unrelated work. A claimed attached host +still lacks push-stop support: report that limit, cancel its unclaimed external +requests and preserve unrelated local Turns. Synthetic Codex/provider tests +qualify source semantics; installed/live-host stop, physical command cancellation +and community enablement remain separate acceptance. + Committed same-claim replay is separate from new admission: after a lost response and target revocation, the original host can recover its committed receipt; new claims and external result publication remain denied. Current validation uses real @@ -1135,3 +1153,27 @@ host media and file delivery remain separate gaps. Regression covers model-wire image input, unchanged Session, replay, durable restart and download-time revocation; live provider/model acceptance is reported separately. No new Session authority, queue, worker or feature toggle is introduced. + +### Lark progress-edit budget and final-result recovery + +Private conversations and steward commissions reuse persisted Turn events to +edit one progress message; the Core terminal answer still owns the full result. +Progress allows at most 12 edit attempts, persisted before the provider write. +Unknown receipts consume the budget and restart does not reset it. This is a +conservative transport limit, not Lark's maximum allowance. After exhaustion, +retain Turn events and the allowance for a final edit and necessary close notice. + +Older long tasks may already have exhausted the provider quota. Only an explicit +`230072` response plus fresh readback proving the target body absent allows +retaining the rejected-edit proof and sending the complete result separately +through the existing source-session, audience and idempotent-send path. Never +mark an exhausted draft successfully closed, rerun the model or recreate the +Session. Unknown errors, lost receipts and unavailable readback retain recovery +without a blind resend. If the result is verified but reaction cleanup remains, +recover only its original result proof without sending again. + +Regression covers budget persistence across restart, final-result retention, +explicit quota refusal, unknown failure, lost post-write receipt, unavailable +readback, recovery of older failed journals and two-App isolation. Live provider +delivery remains separate. Model completion, material intake and an intermediate +card cannot substitute for final-message readback. diff --git a/docs/architecture/rfcs/app-conversation-and-async-inbox-v0.zh-CN.md b/docs/architecture/rfcs/app-conversation-and-async-inbox-v0.zh-CN.md index 952115093c..759907f52d 100644 --- a/docs/architecture/rfcs/app-conversation-and-async-inbox-v0.zh-CN.md +++ b/docs/architecture/rfcs/app-conversation-and-async-inbox-v0.zh-CN.md @@ -122,6 +122,49 @@ Material Lifecycle，也不证明项目 adapter 的 intake/ranking 已接通。 降为只读后，入站受理及恢复重新核验授权。本机 Scope 只复用相同 typed 项目上下文； 宿主授权变化时创建新会话，保留旧历史，拒绝在旧会话上执行新工作。 +`loopx chat --project-filesystem-scope workspace_only` 进一步将普通 Codex 项目 Session +限制为工作区文件工具：拒绝根目录访问，只保留最小系统可执行文件读取，既有读写 grant +只作用于选中工作区。关闭临时目录、shell 环境继承、login shell、web search 和工具 +网络访问。typed context 持久化该选择，变化后旧上下文不能复用；默认仍是可写的 +`host_default` scope。 + +shell 只保留 `PATH`，禁用 shell profile snapshot，POSIX 使用固定最小系统搜索路径， +同时过滤账户配置覆盖及继承变量。macOS 可信宿主可通过固定系统 `xcode-select` 选择 +标准 Command Line Tools/Xcode toolchain，将其 Git 目录前置并授予只读。由二进制到 +`/` 的每个路径都必须 canonical、root-owned、类型正确，且 group/other 和调用方均 +不可写，包括 ACL。容器不安全（含可写 `/Applications`）、toolchain 缺失或选择不支持 +时保留原 profile/搜索路径，不放开 toolchain 写入、根目录读取、账户环境或工具网络。 +真实探针不证明 Windows 执行合格。 + +收窄 profile 关闭自动 skill catalog 注入和项目指令发现，Agent 可经有界文件工具读取 +工作区自己的 `AGENTS.md` 与 skills；普通项目 Session 保留原生发现。workspace-only +原生 Session 使用私有 `HOME`/`CODEX_HOME`、最小进程环境及文件式原生凭据存储； +新建与恢复均禁用有效 MCP server（包括 managed/项目配置）及原生 Apps connector。 +operator 的 `LOOPX_CHAT_PUBLIC_SOURCE_READ=on` 只准入匿名 `read_public_url`/ +`read_public_image`，并须原生工具显式批准；其他 MCP 不可用，关闭开关移除 reader， +Apps 仍关闭。Core 按获授权工作区和 App/owner binding 派生 store identity；不同 +话题保留独立线程，不要求每条消息重新登录。`host_default` 保留账户原配置和认证。 + +不把认证或对话历史复制到新 store，已有项目原生登录保留所选账户。否则，可信宿主有 +文件式原生 ChatGPT 登录时，adapter 仅经私有 app-server stdio 的 +[`chatgptAuthTokens`](https://learn.chatgpt.com/docs/app-server#3c-log-in-with-externally-managed-chatgpt-tokens-chatgptauthtokens) +传递 access token 与账户标识。该实验模式只在进程内存持有 token，不写项目 store、 +模型 prompt、工具环境或命令行。未授权 token callback 要求宿主账户 store 刷新，并发 +callback 复用已轮换 token；账户不可用、store 无效或账户变化失败关闭并脱敏报错，恢复 +账户后可重试而无需重绑。此 adapter 不桥接 keyring-only 或 API-key 认证；可将 +`CODEX_HOME` 指向 Session 已记录 home，走原生独立登录。旧共享 home 的 workspace-only +Session 不静默恢复/迁移，须显式选择隔离 home 的新 Session；普通 legacy Session 保留 +原 home 和精确原线程恢复。 + +adapter 在新建和精确线程恢复时只发送 Core 所属 named permissions profile，不同时 +发送 legacy sandbox override。核验返回 profile 与唯一工作区根，后续 Turn 固定该 +profile；宿主不支持时拒绝，不 fallback 到更宽权限。此 scope 拒绝其他 executor， +native helper 使用 canonical Codex executable，home symlink 无需另加读取 grant。 +这是文件系统工具边界，不是完整社区 Bot 隔离；不授权群受众、不清空历史、不隔离任意 +host dynamic tools，也不让含私有文件的 checkout 自动具备公开安全性。公开启用前仍须 +群准入、干净公开工作区、合格模型认证及真实隐私/交互验收；原生上下文隔离和文件探针 +通过只是前置证据。 + typed Core、HTTP 与原生宿主回归覆盖默认读写、明确只读、工作区身份、App 独立授权、 旧会话拒绝和原线程恢复。既有源码证据记录了 Codex canary 编辑并读回合成笔记、 保留原文且不创建 Goal；这项历史宿主/文件系统证据与本次合成协议回归分开， @@ -424,6 +467,14 @@ App 找到合格的已有负责人，保留请求，展示对方真实判断， - 一个获准驱动实际干活；纠偏和定向停止分别有接收方或运行时读回，传输 ACK 不够。 - 原对话可打开草稿，刷新或更换会话后仍在；源码、打包前端、真实原生执行分别记录通过、失败、阻塞或未运行。 +既有对话 reader 还有一个有界 GQ02 companion：`view=agent_route` 通过共享 TS +selector 与只读宿主 adapter 观察精确发现的 Goal/Agent，可跨归档历史定位唯一可读 +binding，无需用户复制 session 链接。未知或多个可读 binding 保持未解析，远端来源 +不可观测时明确不可用，不偷读本机宿主。管家与普通 Goal reader 共用该路径，不增加 +管家专属生命周期或执行驱动。验收使用真实隔离 host store，保持其不变；这只修复 +read-tool 缺口，不关闭原生派发、纠偏采用、定向停止或原路结果验收。安装态行为仍须 +维护者合并与 promotion 后验证。 + 随后验收已有 G1：**“组个小队，核对现金流，把分歧查清楚。”** 2–3 个真实 worker 消费版本化材料，独立指出期间或单位错误，采用修订后回传综合结论； 第二轮修改输入，必须改变实际消费依据。对应 GQ05/GQ11–13，不新增里程碑或任务队列。 @@ -500,6 +551,12 @@ Chat/Lark 发送须等待前一结果核验送达；Peer 消费只确认已读 在打包对话中验证重启、重复重试、前次发送不确定及精确 Goal 实例隔离。 这是 R3/T1–T2 的结果连续性，不新增工作请求、权限、任务完成声明或管家专用队列。 +provider 暂时核验失败须与终态拒绝分开：共享 owner 先复核持久化发送事实与当前路由， +保留原不确定结果并按退避恢复，不再次发送。显式撤权、路由丢失或 provider 必需 ACK +缺失仍是终态 blocker。`source_session_v1` Goal 被重建后也一样：崩溃前持久化的 +attempt 沿原 GoalRef 与对话恢复，暂时核验失败退避且不重发，typed 终态阻塞保持停止。 +这只验证持久恢复边界，不证明真实 provider 可用性或完整 GQ09 旅程。 + 已提交委派的恢复复用现有 typed collaboration lifecycle。原请求 Turn 失败、超时或 被打断，不会取消已经进入接收方 Inbox 的工作。该 Turn 结束后，即使调用方没能保存 handoff 回答，接收方已保存的结果仍可沿同一可信路由返回。重新核验当前来源授权、 diff --git a/docs/architecture/rfcs/automatic-execution-admission-v0.md b/docs/architecture/rfcs/automatic-execution-admission-v0.md index fb46f942c6..39ee20221c 100644 --- a/docs/architecture/rfcs/automatic-execution-admission-v0.md +++ b/docs/architecture/rfcs/automatic-execution-admission-v0.md @@ -125,7 +125,7 @@ protection against clock manipulation. For App, show desired versus observed schedule and apply failure. Unsupported intervals require holding the affected automation, not shortening the interval. -Codex App ACK commands must re-read the matched heartbeat after the host update. +Codex App schedule acknowledgement (ACK) commands must re-read the matched heartbeat after the host update. The requested RRULE and the hint's earlier observation cannot certify that update. The typed scheduler commit rejects missing or mismatched current observations before migration, identity reset or persistence. This applies to the console's diff --git a/docs/architecture/rfcs/automatic-execution-admission-v0.zh-CN.md b/docs/architecture/rfcs/automatic-execution-admission-v0.zh-CN.md index 75a145aa03..f216c20a13 100644 --- a/docs/architecture/rfcs/automatic-execution-admission-v0.zh-CN.md +++ b/docs/architecture/rfcs/automatic-execution-admission-v0.zh-CN.md @@ -49,6 +49,8 @@ long-task cadence 是建议，不是用户约束。 ## 5. 架构与状态 +### 一个决策 owner，职责分别归属 + | 边界 | 职责 | 不代表 | | --- | --- | --- | | Quota 配置 | 用户下限、修订版本、作用域继承 | 实际消费或权限 | @@ -89,6 +91,16 @@ App 间隔编辑器中，选定目标并明确保存已展示的前后值，就 | 附着式交互 / 手动会话 | 显式手动意图；其余门禁保留 | 记录原因；自动续跑不能冒充手动 | App 必须显示目标和实际 schedule、应用失败。不支持该间隔时，应挂起受影响自动化，不能缩短间隔。 +Codex App 的调度确认（ACK）命令必须在宿主更新后重新读取匹配的 heartbeat；请求的 RRULE 和 hint +中的旧观察不能认证本次更新。类型化 scheduler commit 在迁移、身份重置或持久化前，拒绝 +缺失或不匹配的当前观察。console 原生 follow-up 与 Python 兼容适配器遵守同一边界。 +Unix 和 PowerShell launcher 的 Codex host-match ACK 也经该入口取得新鲜读回；其他生成的 +follow-up 保留 Node 快路径。外层控制的写入在原生派发前仍受入口既有权限 guard 约束。 +原生 decoder 把 host-match 标记与捕获的 ACK 事实绑定，不能通过删掉标记绕过当前读回。 +其他 App adapter 提供自己的中立 current-RRULE 参数：显式不可用的观察清除旧事实， +省略观察则保留其已绑定的观察，不从 Codex 元数据补齐缺失值。失败命令保留原 target/observed +组合。真实 App API 更新和临时 File/SQLite Goal 上的读回，只验证该调度边界；经过的 timer +唤醒、已安装 runtime 采用及模型启动前准入仍须独立验收。 激活路径必须独立验收后才能宣传一键安全激活。模型内 guard 只能停止后续工作，不能撤销已消费的 唤醒 token；仅修改 prompt 不等于强制执行。原生 `UserPromptSubmit` 是候选方案；自动化覆盖未验收前， 调度建议模式不能宣称阻止所有过早模型启动。 diff --git a/docs/architecture/rfcs/capable-manager-semantic-handoff-v0.md b/docs/architecture/rfcs/capable-manager-semantic-handoff-v0.md index a3662f7335..7613dd9467 100644 --- a/docs/architecture/rfcs/capable-manager-semantic-handoff-v0.md +++ b/docs/architecture/rfcs/capable-manager-semantic-handoff-v0.md @@ -847,8 +847,8 @@ records bounded cross-conversation dispatch and remaining replacement qualificat private DM onboarding, ordinary non-Goal chat, streaming and media remain unqualified until the pinned installed journey passes. -Group reply source verification joins the fresh message envelope and App identity -reads before checking the canonical topic root. This removes their serial IO +Group reply source verification reads the fresh message envelope and App identity +in parallel before checking the canonical topic root. This removes their serial IO dependency without caching either observation or reading event-supplied ancestry early. Root mentions, current grants and original reply receipts still gate each outbound operation. Source-check timing alone does not qualify ingress feedback, diff --git a/docs/architecture/rfcs/capable-manager-semantic-handoff-v0.zh-CN.md b/docs/architecture/rfcs/capable-manager-semantic-handoff-v0.zh-CN.md index ec17a764d0..57ff699b15 100644 --- a/docs/architecture/rfcs/capable-manager-semantic-handoff-v0.zh-CN.md +++ b/docs/architecture/rfcs/capable-manager-semantic-handoff-v0.zh-CN.md @@ -680,6 +680,11 @@ bundled provider 的[就绪指南](../../../loopx/extensions/lark/docs/realtime- 记录有界跨会话处理和仍待完成的替代验收；私聊开通、普通非 Goal 对话、流式回显与媒体输入， 须等固定版本的已安装旅程通过后才能宣称就绪。 +群回复的来源验证先并发读取新鲜消息 envelope 和 App 身份，再检查 canonical topic root。 +这消除了两次读取的串行 IO 依赖，但不缓存任何观察，也不提前读取事件提供的祖先关系。 +每次向外操作仍受 root mention、当前 grant 与原回复 receipt 约束。仅来源检查的耗时 +不能证明入口反馈、完整回答延迟或已安装实时旅程已通过。 + **模型容量失败（S5/S10）：** Codex adapter 把 typed `serverOverloaded` 终结错误保留为 `server_overloaded`，上游任意 prose 不能建立该分类。启用后的 Codex app-server Chat Turn 现在默认对这个精确 typed 过载做有界同请求续接：同一 worker 内，Session、Turn、请求、 diff --git a/docs/architecture/rfcs/complete-state-recovery-v0.md b/docs/architecture/rfcs/complete-state-recovery-v0.md index 9bd22fbbf6..dfb58a5273 100644 --- a/docs/architecture/rfcs/complete-state-recovery-v0.md +++ b/docs/architecture/rfcs/complete-state-recovery-v0.md @@ -620,8 +620,7 @@ active Goal dependency optional. | Scheduler and optional Host automation: [scheduler state owner](../../../loopx/control_plane/scheduler/state_store.ts), [backup discovery](../../../loopx/state_backup.py) | Runtime scheduler files and explicitly included Codex automation/skill directories can be copied. A saved timer is not an observed active Host schedule. | Bind cadence/reset identity, reconcile actual Host state and exclude duplicate admission. Other Host/provider state needs its own explicit capture contract. | | Knowledge/artifacts, extension state and credentials: the selected Goal's material and provider owners, including [decision-context recovery](../../../loopx/capabilities/decision_context/capture_recovery.py) where applicable | Only discovered roots are included; a physical SQLite snapshot proves no semantic provider completeness. Credentials may be present in private raw bytes. | Enumerate actual required sources and provider versions; obtain their own export/verify evidence. Credential custody, rotation/revocation and external access remain with their owners; copied bytes grant no access. | -The [source-session lifecycle path -owner](../../../loopx/control_plane/goals/source_session_registry_state.py) now +The [source-session lifecycle path owner](../../../loopx/control_plane/goals/source_session_registry_state.py) now supplies the same registration, recreation and Turn-settlement directories to the writers and full-backup discovery. This closes the omission beside an external source registry, without sweeping other Goal directories or treating diff --git a/docs/architecture/rfcs/complete-state-recovery-v0.zh-CN.md b/docs/architecture/rfcs/complete-state-recovery-v0.zh-CN.md index eeca48b820..fc54c7614c 100644 --- a/docs/architecture/rfcs/complete-state-recovery-v0.zh-CN.md +++ b/docs/architecture/rfcs/complete-state-recovery-v0.zh-CN.md @@ -518,8 +518,7 @@ dependency closure，区分 owner 确认不存在、来源不可读和来源无 | Scheduler 与可选 Host automation：[scheduler state owner](../../../loopx/control_plane/scheduler/state_store.ts)、[备份发现](../../../loopx/state_backup.py) | 可复制 runtime scheduler 文件及显式纳入的 Codex automation/skill 目录；保存的 timer 不是观察到的活跃 Host schedule。 | 绑定 cadence/reset identity，reconcile 真实 Host 状态并排除重复 admission；其他 Host/provider 状态需要独立、显式的捕获契约。 | | Knowledge/artifact、extension 状态与 credential：所选 Goal 的 material/provider owner，适用时包括 [decision-context recovery](../../../loopx/capabilities/decision_context/capture_recovery.py) | 只纳入发现的 root；physical SQLite snapshot 不证明 provider 语义完整性。私有原始字节可能含 credential。 | 枚举实际必要来源与 provider version，取得各自 export/verify 证据。Credential custody、轮换／撤销及外部访问仍归各自 owner；复制字节不授予访问权。 | -[Source-session lifecycle 路径 -owner](../../../loopx/control_plane/goals/source_session_registry_state.py) 现在为 +[Source-session lifecycle 路径 owner](../../../loopx/control_plane/goals/source_session_registry_state.py) 现在为 实际 writer 与完整备份发现提供同一注册、重建和 Turn-settlement 目录，关闭外部 source registry 相邻日志的遗漏；不扫描其他 Goal 目录，也不把日志字节当作已处置 的 effect。File/SQLite 真实 producer/verifier 的失源验证保留这些字节和本地声明的 diff --git a/docs/architecture/rfcs/desktop-execution-frontends-v0.md b/docs/architecture/rfcs/desktop-execution-frontends-v0.md index 4f5745fde6..93964e68c9 100644 --- a/docs/architecture/rfcs/desktop-execution-frontends-v0.md +++ b/docs/architecture/rfcs/desktop-execution-frontends-v0.md @@ -1041,7 +1041,7 @@ ordinary Goal composer/executor is absent in this view. This first provider does not establish other-provider coverage or complete native activity/stream parity. See the [provider boundary and operation](../../integrations/session-runtime-control-plane-adapter.md#experimental-owner-local-codex-app-conversations). A bounded live-observation companion now follows the original Desktop owner's -versioned snapshot/patch stream while the host is not observed idle. Supported +versioned snapshot/patch stream (view snapshots and incremental updates) while the host is not observed idle. Supported unfinished visible messages/tools update in the same Agent reader, with paused history insertion and saved-record fallback. Exact owner/binding, revisions, private-content exclusion and bounded data remain enforced; no executor or diff --git a/docs/architecture/rfcs/desktop-execution-frontends-v0.zh-CN.md b/docs/architecture/rfcs/desktop-execution-frontends-v0.zh-CN.md index ee5a6a415c..56c36fcef4 100644 --- a/docs/architecture/rfcs/desktop-execution-frontends-v0.zh-CN.md +++ b/docs/architecture/rfcs/desktop-execution-frontends-v0.zh-CN.md @@ -66,6 +66,48 @@ manager Agent，也不把连接器硬编码到 Codex。 配置。可选 Lark 投影同一选择及自己的受众约束。用例通过前，这是分配设计而非 运行保证。见[近期发布路线](loopx-overall-roadmap-v0.zh-CN.md#近期本地-agent-产品与发布路线)。 +## 设置归属与作用域 + +导航按用户任务组织，作用域按配置归属决定。管家保留一级 **Steward** 入口，配置其执行器、 +模型/推理偏好与宿主 runtime grant。这不是 Goal 成员的模型设置，也不能仅因配置归设备 +所有就埋进能力中心。不同入口复用相同配置组件与事务 owner。 + +能力中心只有一个目标选择器：**设备默认值**或**某个 Goal**。当前“全局”只指本设备的 +配置权威，不是账户级或跨宿主同步设置；远端宿主保留自己的凭证与默认值。按以下行为 +决定作用域，不能按现有编辑器或存储路径猜测。 + +| 配置 owner | 作用域决定 | 原因 | +| --- | --- | --- | +| `manager_runtime` | 仅设备；Steward 页 | 宿主向管家授予工具，Goal 不能扩大 grant。 | +| `steward_executor` | 仅设备；Steward 页 | 一个管家 channel 拥有执行器/模型/effort 偏好；Goal worker 分配仍属于其自身 binding。 | +| `periodic_report` | 设备默认值 + Goal 覆盖 | 复用报告样式、时区、schedule，允许项目节奏；默认 route alias 不授权向其他 Goal 的受众投递。 | +| `change_quality_qualification` | 设备默认值 + Goal 覆盖 | 复用验证偏好并容纳显式项目合同；配置不能豁免仓库或合并要求。 | +| `pull_request_review` | 设备默认值 + Goal 覆盖 | 复用 CI 等待和队列优先级偏好；两个作用域都不授予批准或合并权限。 | +| `todo_replan_cadence` | 设备默认值 + Goal 覆盖 | 复用复盘频率并允许 Goal 工作节奏；这是已完成工作复盘频率，不是 automation timer。 | +| `multi_subagent` | 仅 Goal | 子模型、容量、职责域和委托 binding 属于一个 Goal 的团队与资源边界。 | +| `peer_task_coordination` | 仅 Goal | coordinator 必须是本 Goal 成员，不能继承无关 Agent 身份。 | +| `explore_harness`、`explore_graph` | 仅 Goal | 探索策略与 opt-in 只影响本 Goal 的规划和证据图。 | +| `progress_review` | 仅 Goal | drift 模式与阈值绑定本 Goal 固定的验收合同版本。 | +| `reward_memory` | 仅 Goal | 私有 provider binding 和启用 Agent 是 Goal 局部配置，设备偏好不能扩散数据 binding。 | +| `lark_kanban_heartbeat_sync` | 仅 Goal | 目标看板与同步遵循本 Goal 的 binding 和受众。 | +| `lark_event_inbox` | 仅 Goal；在 Lark 设置/CLI 编辑 binding | 捕获消息、session binding 和 cursor 属于本 Goal；能力卡只读，传输凭证仍归宿主。 | +| `coordination_runtime_shadow` | 仅 Goal | 实验观察显式限定在本 Goal 执行中。 | +| `local_authority_shadow` | 仅 Goal；已退役/只读 | 历史检查不构成新的激活或设备默认值。 | + +这些决定保留已交付的作用域合同。仅 Goal 不排斥未来可复用 preset；应用 preset 须有意创建 +Goal 局部配置，不能实时继承身份、权限、binding 或实验激活。未来若拆分可复用偏好与局部 +binding，须先同时修改所属 schema 与真实消费者，再宣传新的作用域。 + +双作用域能力保留 **Goal 显式值 → 当前设备默认值 → 能力默认值** 的优先级。Goal 覆盖是 +完整值，不按字段合并。恢复继承经既有 preview/apply/readback 路径删除覆盖。只读状态与 +作用域独立：即使当前不能编辑，Goal 绑定能力仍须显示仅 Goal。catalog、runtime 解析和 +UI 必须一致；不支持的作用域写入由既有 owner 拒绝。 + +模型 provider 凭证、usage telemetry 与外观保留在各自设备级设置入口，Agent 分配属于 +Goal。自动执行间隔沿用其 Goal/Agent/automation 层级与 scheduler 读回，能力中心不另建 +timer。验收须覆盖上述矩阵、非法写入拒绝、打包 UI 的三类作用域及只读 Goal binding， +保留独立 Steward 页，并验证切换目标、preview/apply/readback 和恢复继承不发生跨目标写入。 + ## 问题 LoopX 已经拥有两个不同产品的零件： @@ -708,6 +750,17 @@ executor 精确版本、完成情况、延迟、动作数、人工介入、禁 挂接描述符或托管会话引用不能授予新的 Goal 权威。陈旧或不匹配的 Goal、Agent、 工作区、运行时、provider 或信任绑定失败关闭。 +Desktop 壳自身的 CLI/HTTP 产物选择，与 Agent 工作会话或 provider binding 分开。 +启动比较已资格化的 package 版本和官方源码祖先；启动时的开发覆盖保持显式。记住的 App +自有 release 路径只是发现缓存。同基线 snapshot 无法排序时，当前 App 可用 bundled +产物维护自己的安装，但须保留可证明较新的 runtime 或独立管理的 CLI。修复在重连前 +保留已资格化 promotion，两项 HTTP 服务都须读回所选身份。启动被阻断时，已可用的签名 +App 更新仍能操作；在用户应用更新或有意选择其他恢复前，未变的服务重试不能覆盖它。 +手动更新或恢复失败同样保留错误、诊断和重试控件，直到下一次显式动作。自动更新源不可用 +仍须允许已安装 App 启动。已完成且验证的恢复清除安装未完成标记并显示 Restart；在重启前 +仍不得启动服务。验收同时覆盖普通打包重启、同窗口恢复和失败 fallback；安装成功或临时 +覆盖不能关闭该 bootstrap 验收、Agent 执行验收或签名发布资格。 + ## 安全与隐私 - 把不透明会话句柄、凭据、环境值、进程元数据、原始转录、provider 负载、 @@ -775,25 +828,33 @@ executor 精确版本、完成情况、延迟、动作数、人工介入、禁 这是围绕已在运行的工作采用 Desktop 的短路径。 -第一阶段的可执行 broker 契约沉淀在 Chat session/store 与通用 -`worker-bridge attached-session-*` 命令中，而不是 Lark provider 内部： - -- `agent_id` 始终表示 Goal 内已登记的 LoopX Agent； -- `executor_endpoint_id` 单独表示 `codex`、`claude-code` 或其他执行端； -- attach 只有在 `(host_surface, host_session_id)` 已精确绑定该 Agent 时才成立； -- attached session 的 Web 与 Lark 消息进入同一有界 FIFO，并保留 - `origin=web|lark`； -- 已有宿主可以保持一个最长 30 分钟的 claim 等待，并在队列出现消息时立即 - 获得旧项优先、幂等 claim；超时只返回空结果，不启动或恢复任何运行时； -- 原宿主通过稳定 claim/completion id 领取消息并回写，重复调用不会重复生成 - Agent 回复；以及 -- 任何 attached session 路径都不得调用 managed runtime 的启动/恢复函数。 - -该阶段已经能支撑 `session_queue` 与回复 readback。`live_steering` 仍要求宿主提供 -对正在运行 Turn 的 push transport；在此之前 capability 明确为 false，入口失败 -关闭，不能用新启动的 app-server 或静默改投另一个模式冒充完成。Desktop 下一步 -需要把 bind/list/claim 状态投影成首屏 attach 管理交互，并由 Codex App 等宿主 -自动完成 claim/complete，而不是要求人手工运行 CLI。 +有界 provider checkpoint：本机 Goal Chat 可检查已登记 Codex App Agent 原先保存的 +对话，并经既有 Desktop owner 提供仅空闲时可用的纯文本回复。它读取有界来源窗口， +每秒观察已保存记录，不恢复另一个 app-server。provider 展示可见消息、function/custom-tool +输入与结果及显式 Turn 生命周期。长文本可原处续读，前后分页与 append cursor 保留 burst +中的历史。有界空窗口追赶避免反复点击元数据；折叠工具行解码原生文本块，保留来源字段并 +展示可读 shell 输出。读旧记录时暂停插入，并提供回到最新的路径。 + +排除隐藏 reasoning/configuration，隐去凭证形态字段。不支持、畸形、非文本和超限记录 +保留为可见覆盖缺口。目标是每个 Goal/Agent 都有稳定工作对话：Goal 目录现打开稳定 Agent +路由，保留刷新与前进/后退，明确未绑定或不支持的宿主；该视图不显示普通 Goal composer/ +executor。首个 provider 不证明其他 provider 覆盖或完整原生活动/stream 对等。详见 +[provider 边界与操作](../../integrations/session-runtime-control-plane-adapter.md#experimental-owner-local-codex-app-conversations)。 + +有界的实时观察伴随路径现沿原 Desktop owner 带版本的 snapshot/patch（视图快照与增量更新）流，在未观察到 +宿主空闲时，更新同一 Agent reader 中受支持、未完成的可见消息和工具。历史插入暂停及 +已保存记录回退仍保留。精确 owner/binding、revision、私有内容排除和数据有界约束继续 +生效，不新增 executor 或审批权限。限制仍见同一 provider 操作指南。 + +这是实验 provider 提案，不代表完整切片 B 验收：完整原生事件/token 对等、忙碌 Turn steering/queueing、 +审批 callback、原生 live-send、Windows 传输与已安装采用仍分别待验。其有界用户任务是在 +查看 Goal 工作时跟进特定 Agent。已确认输入后 composer 立即可用，无冗余 ACK；被中断的 +回复从已有 receipt 恢复，不重复提交，真实不确定输入仍须先恢复再发送。 + +Overview owner 入口一次导航打开精确 Agent，无需再次选择；binding 缺失就保持不可用。 +稳定页面复用既有原生 provider 和权限。这缩短了本机 Overview 路径；其余工作会话整合 +仍须与在 Codex App 选择原对话比较，覆盖目标发现、纠正和结果读回。传输成功不证明 +任务路径更短、独立验收或 G1 完成。 ### 切片 C：托管参考垂直 @@ -820,6 +881,18 @@ executor 精确版本、完成情况、延迟、动作数、人工介入、禁 ## 验证标准 +### 原生服务所有权 + +打包原生窗口使用自己的 loopback status/Chat 端点，只拥有自己启动的子进程。同源码 +版本且已就绪的服务不能证明使用相同 registry 或归 App 所有。窗口导航与原生维护权限 +必须跟随精确 Chat origin。runtime repair 保留同窗口端点，两项替换子进程由同一个已 +资格化选择启动，不能独立重新发现全局 CLI。CLI 服务与 Vite 开发保留既有共享端口； +打包 App 启动不再借用、重启这些服务或其 LaunchAgent。 + +验收时让独立共享服务同时运行：两项 HTTP runtime 身份与渲染工作区都属于所选 runtime， +退出、修复、重开只影响自己的子进程。私有端点被占用时拒绝，不接管或终止 listener。 +源码 checkout 或 helper 测试通过不能认证该原生进程边界。 + ### 公共 - 一个绑定至多有一个活跃执行器，用户入口串行化； diff --git a/docs/architecture/rfcs/harness-selection-dsh-pi-v0.md b/docs/architecture/rfcs/harness-selection-dsh-pi-v0.md index 53cd326759..20a7809a75 100644 --- a/docs/architecture/rfcs/harness-selection-dsh-pi-v0.md +++ b/docs/architecture/rfcs/harness-selection-dsh-pi-v0.md @@ -615,7 +615,7 @@ edits the same document through the existing revision-locked transaction; the channel readback adds `executor_endpoint_source: machine_configuration` plus the document's `status` and `configuration_revision`, so a machine decision can be told from a service-environment value without reading the store. The resolved -endpoint, model, effort, policy, allocation reason, eligible pool and source +endpoint, model, effort, policy, allocation reason, eligible endpoint pool and source revision are also persisted on the manager Session. A running Turn keeps its allocation. An owner edit to the same endpoint's model/effort takes effect at the next idle or accepted-queued Turn boundary: open the upstream adapter with diff --git a/docs/architecture/rfcs/harness-selection-dsh-pi-v0.zh-CN.md b/docs/architecture/rfcs/harness-selection-dsh-pi-v0.zh-CN.md index e9b3a1d9e0..cc799851d2 100644 --- a/docs/architecture/rfcs/harness-selection-dsh-pi-v0.zh-CN.md +++ b/docs/architecture/rfcs/harness-selection-dsh-pi-v0.zh-CN.md @@ -444,20 +444,25 @@ journal 与配额语义；B 作为上游接口出现时的低成本替代；只 `steward_executor`（`loopx/capabilities/steward_executor/machine_defaults.py`）， 本机的管家选择因此成为一等公民。 -该命名空间只有三个字段，且不保存任何凭据： +当前命名空间保存主要端点、模型/effort 和封闭的选择策略，不保存凭据： ```json { - "schema_version": "steward_executor_machine_defaults_v0", + "schema_version": "steward_executor_machine_defaults_v1", + "selection_policy": "preferred", "executor_endpoint": "codex", + "eligible_endpoints": [], "executor_model": null, "executor_reasoning_effort": null } ``` `executor_endpoint` 必填，且仅限 LoopX 作为通道执行器出货的端点；模型或推理档位留空 -表示本机对该字段不做决定，通道继续从更低层解析。未知字段、未知 schema 版本、未列出 -的端点、不支持的档位都会在任何生效前 fail closed。需要命名空间未列出适配器的运维方 +表示本机对该字段不做决定，通道继续从更低层解析。`preferred` 以该端点为默认，但尊重 +用户显式选择；`pinned` 拒绝不同的显式选择；`flexible` 要求非空 `eligible_endpoints` +包含主要端点，只能在该池内按可用性 fallback。未知字段、未知 schema 版本、未列出 +端点、非法 pool 或不支持的档位都在任何效果前失败关闭。已存 v0 文档保留原 `preferred` +行为。需要命名空间未列出适配器的运维方 仍然可以使用 `LOOPX_MANAGER_ENDPOINT`。 优先级只在通道所有者（`loopx/chat_manager.py`）声明一次：machine configuration、 @@ -466,6 +471,22 @@ journal 与配额语义；B 作为上游接口出现时的低成本替代；只 文档；通道回读新增 `executor_endpoint_source: machine_configuration` 以及该文档的 `status` 与 `configuration_revision`，无需读取存储即可区分"机器决定"与"服务环境值"。 +解析后的 endpoint、model、effort、policy、分配原因、候选端点池与来源 revision +也持久化在 manager Session。运行中的 Turn 保留原分配。同 endpoint 的 model/effort +修改在下一空闲或已接受的 queued Turn 边界采用：用新模型打开上游 adapter，按时间顺序 +保留完整可见历史和相同权限，启动成功后才持久化、投影新分配。模型或 context/tool +迁移创建新线程，不能任意截取最近消息而丢掉早期用户约束；空原生线程尚无 rollout 时 +同样适用。每次分配捕获已接受的机器 model/effort 输入，单改 policy 不触碰 provider， +改一个字段保留另一个字段的持久值。显式值清空后只从既有低层解析该字段，即使它原先 +等于有效值。旧分配没有捕获机器输入时，未知 unset 字段继续未知，只有有证据的显式编辑 +才能原地更新。环境变化或其他 endpoint 默认值不在重启后重解释既有 binding。 + +App model/effort badge 打开既有 Steward 设置，在设置事务或对话 Turn 后刷新权威 +channel 读回，不把已保存默认值当作当前 Turn 已换模型的证明。 +`loopx chat-endpoint inspect-steward` 通过同一公开投影读取有效配置与当前 Session +binding。本阶段交付分配边界及可用性 fallback，不从对话 prose 推断语义任务适配。 +后续 Agent 可明确选择 executor，但仍由相同 pinned/flexible 边界准入或拒绝。 + 本次不做改变的边界：出货默认值在每台机器上仍是 `codex`；凭据仍然只做认证、不做选择； 托管宿主仍然需要自己的凭据与 runtime；该选择不授予任何权限——它只命名一个由运维方 计费的 runtime，`manager_runtime` 仍是另一项机器决定。管家值损坏或存储不可读时，回落 @@ -475,7 +496,7 @@ journal 与配额语义；B 作为上游接口出现时的低成本替代；只 验证：`tests/capabilities/test_steward_executor_machine_defaults.py`、 `tests/test_manager_channel_binding.py`、`tests/test_chat_machine_configuration_api.py`、 `tests/capabilities/test_capability_configuration_ui.py`，以及 -`examples/loopx-steward-channel-binding-smoke.py`。 +`apps/presentation/dashboard/src/features/personal-workspace/personal-workspace-contract.test.mjs`。 ### 管家回答身份与 Runtime 选择（2026-09-16） diff --git a/docs/architecture/rfcs/ledger/shared-goal-authority-state-provider-v0/2026-09-24-observation-retirement.md b/docs/architecture/rfcs/ledger/shared-goal-authority-state-provider-v0/2026-09-24-observation-retirement.md index d4c8793a85..acc60f25d9 100644 --- a/docs/architecture/rfcs/ledger/shared-goal-authority-state-provider-v0/2026-09-24-observation-retirement.md +++ b/docs/architecture/rfcs/ledger/shared-goal-authority-state-provider-v0/2026-09-24-observation-retirement.md @@ -52,7 +52,7 @@ source checks, event holds and active capture bindings do not change. The old settings entry is read-only in both languages; stale clients fail before writes. The old RPC is a typed rejection tombstone. Historical codecs and reads remain, but Python post-commit projection/retry and TS observation commit are deleted. -State migration retains its response field with `retired/attempted=false`. +State migration retains its response field with `outcome=retired` and `attempted=false`. Validation exercises public CLI replacement bootstrap, lease writes with old and absent settings, invalid-setting cleanup, retained-store readback, and diff --git a/docs/architecture/rfcs/ledger/shared-goal-authority-state-provider-v0/2026-09-24-observation-retirement.zh-CN.md b/docs/architecture/rfcs/ledger/shared-goal-authority-state-provider-v0/2026-09-24-observation-retirement.zh-CN.md index 470ed28a9a..becea013c9 100644 --- a/docs/architecture/rfcs/ledger/shared-goal-authority-state-provider-v0/2026-09-24-observation-retirement.zh-CN.md +++ b/docs/architecture/rfcs/ledger/shared-goal-authority-state-provider-v0/2026-09-24-observation-retirement.zh-CN.md @@ -37,7 +37,8 @@ SQLite 合格默认和所有旧 Goal 迁移不是同一验收范围。PostgreSQL [操作说明](../../../../reference/authority-observation-retirement.md)覆盖拒绝、清理、 bootstrap 与回退。主 Todo/租约规则、来源校验、事件 hold 和活跃绑定不变。中英文 设置中旧入口只读，旧客户端写入前拒绝；旧 RPC 保留 typed 拒绝入口。历史 codec/read -保留，删除 Python 后采样/重试与 TS observation 提交。目录迁移结果明确不再 seed。 +保留，删除 Python 后采样/重试与 TS observation 提交。状态迁移保留响应字段并返回 +`outcome=retired` 与 `attempted=false`，明确不再 seed。 验证真实 CLI bootstrap、旧配置/无配置的租约写入、非法配置清理、历史读回，以及 主文件替换后 committed marker 前进程死亡的单次恢复。保留现有事务、fence 与配置 diff --git a/docs/architecture/rfcs/ledger/shared-goal-authority-state-provider-v0/2026-09-27-recovery-audit.md b/docs/architecture/rfcs/ledger/shared-goal-authority-state-provider-v0/2026-09-27-recovery-audit.md index 906f6b9f13..0ce1ed044f 100644 --- a/docs/architecture/rfcs/ledger/shared-goal-authority-state-provider-v0/2026-09-27-recovery-audit.md +++ b/docs/architecture/rfcs/ledger/shared-goal-authority-state-provider-v0/2026-09-27-recovery-audit.md @@ -1,6 +1,10 @@ # Local default cutover: recovery audit and remaining delivery scopes -- Historical recovery baseline: `157ab7b11`; current inventory: `70b3cca01`, 2026-09-27. +- Latest rechecked baseline: `76ff7c73c`; historical recovery baseline: + `157ab7b11`, inventory `70b3cca01` on 2026-09-27. Historical sections retain + their original baseline. +- Current counts follow the final local-provider-cutover table; historical + planning is not a countdown of remaining PRs. - Owner: overall roadmap #4574 R5/G2; shared authority D2/D3; TS T3/T4. - Supersedes the **current count**, not historical evidence, in the [September 24 reconciliation](2026-09-24-default-cutover-reconciliation.md). diff --git a/docs/architecture/rfcs/ledger/shared-goal-authority-state-provider-v0/2026-09-27-recovery-audit.zh-CN.md b/docs/architecture/rfcs/ledger/shared-goal-authority-state-provider-v0/2026-09-27-recovery-audit.zh-CN.md index ab5f674764..fc29b151aa 100644 --- a/docs/architecture/rfcs/ledger/shared-goal-authority-state-provider-v0/2026-09-27-recovery-audit.zh-CN.md +++ b/docs/architecture/rfcs/ledger/shared-goal-authority-state-provider-v0/2026-09-27-recovery-audit.zh-CN.md @@ -1,6 +1,7 @@ # 本地默认切换：恢复审计与剩余交付范围 - 最新核对基线：`76ff7c73c`；下方历史段落保留其当时基线。 +- 历史恢复基线：`157ab7b11`；2026-09-27 清单基线：`70b3cca01`。 - 当前数量以末尾“本地 provider 切换”表为准，历史规划不是剩余 PR 倒计时。 - 归属：总目标 #4574 R5/G2；shared authority D2/D3；TS T3/T4。 - 取代[九月二十四日清单](2026-09-24-default-cutover-reconciliation.zh-CN.md)的 diff --git a/docs/architecture/rfcs/ledger/shared-goal-authority-state-provider-v0/2026-09-28-retirement-cadence.md b/docs/architecture/rfcs/ledger/shared-goal-authority-state-provider-v0/2026-09-28-retirement-cadence.md index 4091daed28..0ea81a9971 100644 --- a/docs/architecture/rfcs/ledger/shared-goal-authority-state-provider-v0/2026-09-28-retirement-cadence.md +++ b/docs/architecture/rfcs/ledger/shared-goal-authority-state-provider-v0/2026-09-28-retirement-cadence.md @@ -955,7 +955,7 @@ legacy-writer retirement and formal failed/missing D2 evidence remain intact. ### Runtime retirement drains admitted effects -The shared TS Effect server now counts pending handlers independently of TCP +The shared TS Effect server now counts admitted, unfinished request handlers independently of TCP connections. The idle window starts after the last handler and private response sink finish. Explicit shutdown stops accepting connections, waits for admitted effects (including disconnected clients), and then removes only its own locator. diff --git a/docs/architecture/rfcs/ledger/shared-goal-authority-state-provider-v0/2026-09-28-retirement-cadence.zh-CN.md b/docs/architecture/rfcs/ledger/shared-goal-authority-state-provider-v0/2026-09-28-retirement-cadence.zh-CN.md index 55c25c81b3..3d195fa270 100644 --- a/docs/architecture/rfcs/ledger/shared-goal-authority-state-provider-v0/2026-09-28-retirement-cadence.zh-CN.md +++ b/docs/architecture/rfcs/ledger/shared-goal-authority-state-provider-v0/2026-09-28-retirement-cadence.zh-CN.md @@ -647,6 +647,21 @@ OS 缓存，未控制其他进程负载，不代表 p95、provider 对比或完 全部保留。 +### Runtime 退役须排空已准入效果 + +共享 TS Effect server 现独立于 TCP 连接统计已准入、尚未完成的请求 handler；空闲窗口在最后一个 +handler 及私有 response sink 完成后才开始。显式 shutdown 停止接受连接，等待已准入 +效果（含断连调用方），最后只删除自己的 locator。认证、请求预算、原 receipt 与调用方 +恢复不变，不增加 provider 或 Python 决策 owner。 + +旧 close handler 可能在断连调用方写入仍等待真实 mutation lock 时退出。真实 server +回归在空闲退役与显式 shutdown 下重现，用仍连接调用方作对照，同时验证并发 ping、 +认证拒绝、listener 关闭、持久写入读回和最终退役。替换 locator、重启及 File/SQLite +archive crash/recovery 测试仍须保留。 + +这只修复 R5/D2 recovery 的一个 S4/runtime-lifetime 依赖，不证明持续运行，不选择 +release 默认值，不增加冻结容量预算，也不授权删除 legacy writer。 + ### 委派完成阶段的原租约衔接 #5436 的 TS Host 监督覆盖模型执行和 Turn 验证，最终 Todo 独立验收位于其后。 diff --git a/docs/architecture/rfcs/ledger/typescript-control-plane-migration-v0/2026-09-22-replan-history-policy.md b/docs/architecture/rfcs/ledger/typescript-control-plane-migration-v0/2026-09-22-replan-history-policy.md index 94ca839c3b..56d6870ff9 100644 --- a/docs/architecture/rfcs/ledger/typescript-control-plane-migration-v0/2026-09-22-replan-history-policy.md +++ b/docs/architecture/rfcs/ledger/typescript-control-plane-migration-v0/2026-09-22-replan-history-policy.md @@ -34,7 +34,7 @@ The replan evidence consumer could repeat the same continuation once for work and once for its quota debit. The existing TypeScript work-item owner now uses scoped settlement and spend-receipt facts to remove that repetition. Python transports identities and complete-text digests; it does not classify eligibility. -The additional facts stay outside the public row hash, so previously delivered +The additional facts stay outside the public history-row hash, so previously delivered history references still resolve the original immutable record. Reduction requires matching complete Goal/Agent/Todo/Turn/effect identity, an diff --git a/docs/architecture/rfcs/ledger/typescript-control-plane-migration-v0/2026-09-22-replan-history-policy.zh-CN.md b/docs/architecture/rfcs/ledger/typescript-control-plane-migration-v0/2026-09-22-replan-history-policy.zh-CN.md index 3fd3092ba3..01b85eb131 100644 --- a/docs/architecture/rfcs/ledger/typescript-control-plane-migration-v0/2026-09-22-replan-history-policy.zh-CN.md +++ b/docs/architecture/rfcs/ledger/typescript-control-plane-migration-v0/2026-09-22-replan-history-policy.zh-CN.md @@ -20,6 +20,24 @@ Python 保留历史解码、指纹及 obligation 呈现；删除被替代的触 组装、frontier 结算及完整捕获资格仍有各自归属。没有加入模型观察器、provider 切换、前端配置项或可选 capability。 +## 基于回执的证据展示修复 + +Replan 证据消费者原先可能为工作及其 quota 扣记各重复一次相同接续。既有 TypeScript +work-item owner 现使用限定作用域的 settlement 与 spend receipt 事实去重。Python +传递身份及完整文本摘要，不分类资格。新增事实不进入公开历史行 hash，已投递的 history +reference 因此仍解析到原不可变记录。 + +归约要求完整 Goal/Agent/Todo/Turn/effect 身份、实际类型化 progress observation 及 +完整接续都匹配。每个合并 occurrence 都须有自己的匹配，且对应工作须在展示窗口内保留。 +不同 health 仍可见；不同 outcome、缺失或不支持的 receipt、身份不匹配和不同接续尾部 +保留原展示。raw count、负向覆盖与 obligation identity 不变，不新增共享词汇、能力、 +store 或权限。 + +验收使用临时真实 File/SQLite quota CLI fixture、不可变 history-reference CLI +读回、inline/snapshot 对等和类型化负例。本修复减少消费侧重复；完整历史仍有 +O(history) 传输与处理成本，并增加身份字节。不证明已安装采用、模型 token/时间效果、 +整项任务有效性或剩余 T3/provider 资格。 + ## 长历史传输修复 此前 600 行演练不足以证明长期运行的 Goal。即使去掉正文，所有紧凑事实仍随历史 diff --git a/docs/architecture/rfcs/ledger/typescript-control-plane-migration-v0/2026-10-12-1x-prerequisites.md b/docs/architecture/rfcs/ledger/typescript-control-plane-migration-v0/2026-10-12-1x-prerequisites.md new file mode 100644 index 0000000000..f7a86fc2af --- /dev/null +++ b/docs/architecture/rfcs/ledger/typescript-control-plane-migration-v0/2026-10-12-1x-prerequisites.md @@ -0,0 +1,251 @@ +# Historical 1.x prerequisite checkpoints (through 2026-10-12) + +Moved from the [TypeScript migration RFC](../../typescript-control-plane-migration-v0.md), former section “Historical 1.x prerequisite checkpoints (through 2026-10-12)”, on 2026-10-16 at RFC baseline `b2aca67d76af45e554c620818a982a81f8d2d52b`. Preserve the original evidence and unqualified boundaries. The English source recorded `38cb407ed`; the Chinese source recorded `06b6caa07`. Neither is a new qualification of the current candidate. + +[中文版](2026-10-12-1x-prerequisites.zh-CN.md). + +The following records explain the prerequisites and validation at their named +sources. Their references to reachable writers and a “next” cutoff describe +that 1.x baseline, not remaining implementation work in the candidate above. + +Rechecked at main `38cb407ed`: #5413/#5466/#5283 and the affected creation, +Host-stop and UI-history owners #5500/#5805/#5308/#5398 are merged. Reuse +their delivered boundaries rather than reopening the October 2 merge queue. +The [current validation, migration and deletion plan](../shared-goal-authority-state-provider-v0/2026-09-28-retirement-cadence.md#current-closeout-validation-migration-and-deletion-2026-10-02) +now prioritizes installed reversible qualification, affected consumer adoption, +policy migration and last-caller deletion; it records the merged sources and +the remaining evidence separately. + +Canonical new-Goal creation is already implemented by #5500/#5805. The existing +machine setting and `coordination/local_authority_defaults.ts` choose canonical +SQLite with `hard_lease` for unconfigured new Goals; CLI bootstrap and App +creation share the typed initialization and original-operation recovery owner. +Explicit v0 settings and v1 `canonical_creation=false` preserve post-promotion +target behavior. Existing Goals keep their recorded selection. See the +[configuration and disable contract](../../../../reference/local-authority-provider-selection.md#new-goal-authority-machine-setting). +This is the source candidate, not certification of installed adoption, a released +default, full shared Goal intent or D2/D3. Do not rebuild a creation/default owner. + +Canonical Todo entrypoint separation (T4): all five mutation facades now share +`todos/mutation_api.py`; historic imports are lazy and the unpromoted writer is +isolated in `todos/legacy_mutation.py`. The installed File/SQLite oracle can +remove the whole writer module while exercising lifecycle and settlement +recovery. The cold-import oracle now composes reviewed import, fresh leased +updates/new writes and original-operation recovery with that writer absent; +source-display loss and provider outage cannot replace the current authority +or erase later writes. The original import cursor remains historical while the +current provider revision is preserved. This prepares last-caller deletion +without claiming code retirement: +bootstrap, handoff, team-plan and Monitor still have supported source callers; +keep capture/outbox and historical recovery until their own exits. [Caller and +rollback inventory](../../../../reference/canonical-todo-completion-update.md#canonical-mutation-entrypoint-isolation). +Production Todo consumers use the concrete owners instead of the historic `loopx.todos` re-export: +CLI registration/actions, quota and planning, capability writeback, source lease +reads and the Lark source projection import the same concrete mutation, full-read, +path or Markdown display owners. No new wrapper, decision or RPC is introduced. +The historic public imports and their supported unpromoted IO remain available. +Disposable source/normal-wheel probes remove the facade, the whole legacy Todo +writer and four shadow producers together; real File/SQLite CLI lifecycle, +once-only settlement, Monitor replay and App cold-import/action/restart journeys +must still work, with missing-provider/lease and changed-source/backup refusals. +The App HTTP receiver now also removes `bootstrap.py` from that same copied +distribution and checks the complete removed set before each server start, +restart and auxiliary CLI. Separate fixture results cannot prove this combined +absence. The ordinary canonical CLI creation entrypoint remains with its owner; +removing it from the cold-import receiver is a disposable qualification probe, +not a supported package format or permission to break the additive 1.x line. +中文：App 冷导入、后续写入和重启使用同一份缺少旧入口、writer 与 source producer 的 +隔离副本；不能拼接两组各自缺少一部分模块的结果。正常 canonical 创建仍保留其 +现有入口，这个临时卸除验收不等于已完成整族退役、自然试用或正式安装采用。 +Lark dry-run and Explore replay qualify local consumers only, not live external +adoption. The fresh research execution path added by [#5280](https://github.com/loopx-project/loopx/pull/5280) +reintroduced a function-local historic import after the earlier caller inventory. +It now imports `todos/list_readback.py` directly, preserving the same typed +current-Todo validation and the historical replay branch before that read. +The qualification includes fresh research execution, actor/runnable/input +refusals, exact lineage readback and replay after current input/Todo changes +in the same facade-present/absent source and normal-wheel File/SQLite matrix. +A whole-production Python import guard resolves relative imports and aliases; +dynamic loading still requires the isolated real journeys. Keep this guard as +new capabilities arrive, rather than treating a past inventory as a permanent +exit. Last supported source writers, historical recovery, installed cohort +and release exits remain independently open. + +The next T4 package is the [import-first normal-writer cutoff](../../../../reference/local-authority-provider-selection.md#proposed-compatibility-cutoff-and-release-sequence), +not another re-export or producer-loading extraction. At `38cb407ed`, live +unpromoted callers remain in ordinary mutation, bootstrap/creation opt-out, +team-plan, Monitor, ownership/source lease and active capture/binding. Reuse +their typed admission/transaction owners; treat retained source capture, +historical receipts and permanent document IO as recovery obligations. +The existing delivery Todos should carry these concrete exits: + +- Qualify the installed import/backup/recovery journey for the declared source + matrix; importer implementation is already present and is not a missing-code + dependency. Do not reinterpret complete coordination backup as complete Goal + backup. +- Run the bounded reversible core-developer SQLite trial before the breaking + cutoff, recording real Host adoption/use separately from conversion drills. +- Deliver the cohesive 2.0 normal-writer cutoff: fresh unmigrated writes and + execution grants refuse before effects; canonical work and original-operation + recovery pass with the old writer physically absent. Keep the additive 1.x + import/deprecation line compatible. + Admission must preserve original lease release and receipt/outbox recovery + before import; denying the existing shared legacy fence indiscriminately + would also block these prerequisites. Remove the Python missing-fence bypass + with the typed cutoff and validate the combined recovery-to-import journey + specified in the linked release contract. +- After the last source caller exits, reconcile pending outboxes and delete + unused capture producers/private decisions together. Keep supported historical + readers and current-head rollback; do not wait for every external user to + migrate or claim full T4/D2/default qualification from internal deletion. + +This updates the existing R5/T4 frontier and release proposal; it creates no +parallel migration owner, runtime gate or release activation. + +Team-plan recovery prerequisite: an unpromoted plan that published its original +receipt can now recover through the Chat confirmation owner while shadow +bootstrap is interrupted. Registry/Todo/source locks still protect the read, +and the existing typed identity validator rejects changed intent, actor or +reviewed basis. Recovery verifies source durability without loading the capture +producer or admitting new writes; fresh plans still obey all source, management +and promotion guards. This repairs the existing 1.x recovery path and does not +activate the 2.0 cutoff or settle the remaining lease/outbox/Host obligations. + + +The retained import-compatible field writer now composes resume normalization +and contradictory-clear rejection in its existing typed field plan. Keep blank +Python input omission and locked IO; retire the duplicate normalization crossing, +not the still-supported writer or migration reader. + +The remaining legacy writer and bootstrap capture adapter now avoids loading +rollout history and constructing a Todo projector when runtime shadow is off +and there is no active durable binding. It still resolves the source identity; +an active binding continues to require durable preparation even after config +is disabled. This removes optional capture work from ordinary legacy writes, +without changing their output, history retention or outbox recovery. Python +retains this Host IO adapter until its last supported source writer is replaced; +this is neither whole-writer retirement nor default-provider qualification. +Unpromoted lease acquire now loads the capture adapter only when the typed +result carries a capture request. The real CLI and normal-wheel oracle cover +acquire/replay, rejected stale renewal, renewal, transfer and release with the +four legacy shadow producer modules physically absent and with no enabled +capture or active binding. An active binding still delivers capture after the +setting is removed. This retires a default-off dependency, not the supported +source writer or pending capture/history recovery. + +Handoff/continuation display decisions now belong to the existing TypeScript Todo +context owner. Summary reuses its normalized identity/claim/exclusion/class +facts in one batch; the index keeps source compaction before labelling and audit +merging in one native batch. Planning and quota collectors project whole chosen +sets. Oversized display context uses byte-bounded read-lens batches while +counts, dependency decisions and closure retain their full-source owner. A +single oversized historical record reuses the existing private snapshot transport: +credential checks see its full text before display truncation. The +Python facade keeps shared metadata codecs and historical tuple/SHA-1 identity +encoding, with no Python decision fallback. Retain nested-empty precedence, +Unicode whitespace/codepoint limits and credential rejection before truncation; +these are compatibility obligations. File/SQLite CLI and normal-wheel recovery +must preserve exact source and provider revision when Markdown display is absent +or the selected provider is unavailable. This read-model retirement does not +retire the supported mutation/Host callers or certify a released SQLite default. + +Public add now composes scope, supported wait and bounded Monitor metadata in +one typed creation-scope request. The legacy add writer consumes that same +fresh draft rather than re-planning it; standalone line codecs and successor +creation retain their own admission. Priority and validation-declaration +checks keep their prior diagnostic order, and canonical provider transactions +still recheck registry/claim/lease/CAS authority. This retires duplicate add +composition, not the supported Markdown writer or bootstrap/Host/history IO. + +The canonical team-plan caller now loads capture and Markdown editing only in +its supported unpromoted arm. Real File/SQLite Chat and normal-wheel source +removal cover confirmed batch commit, later-write replay, provider restoration, +projection recovery and imported historical receipts. The existing TS +transaction, source guards and projection owner remain unchanged; the legacy +batch IO instrumentation seam stays lazy for its current consumers. This is a +caller-isolation exit, not deletion of the live legacy writer or completion of +receiver adoption, Host execution, PostgreSQL or D2 qualification. +[Contract and retained duties](../../../../reference/canonical-todo-completion-update.md#team-plan-source-writer-isolation). + +Public CLI isolation now keeps shadow configuration in `coordination/configuration.py` +and complete source capture in `coordination/authority_source_capture.py`. Cold import, +source inspection and historical promotion recovery reuse those retained owners; +only explicit enabled shadow actions load the old producers. Ordinary new-Goal +SQLite creation, leased work, once-only settlement and reversible exit, plus cold +File/SQLite import and original-operation replay, run through the real CLI with +all four shadow producers physically absent in disposable source/normal-wheel +copies. The old module still re-exports the retained APIs for current consumers; +enabled capture, outbox and legacy commands remain supported. Preserve exact +source identity, archive dependencies, safe lease reads and later-write recovery. +This removes an eager-import blocker; deleting live producers still requires +their last-caller exit. App/Lark contracts, provider transactions, cohort adoption +and frozen D2 evidence remain separate. + +The Monitor router likewise isolates its live source writer. Historical receipt +codec/replay has a small shared scheduler IO owner, while the existing TS batch +still owns operation identity and decisions. File/SQLite CLI and normal-wheel +source removal must preserve later canonical writes and original successors; +promoted replay leaves old outbox bytes inert. Unpromoted markerless batch +recovery retains its existing bounded drain. Business-receipt replay does not +guarantee shadow catch-up: lock deferral or an expired proof budget preserves +pending evidence for an independent `authority-shadow drain`. Recovery keeps +the original source bytes, successor IDs and once-only quota effect; it does +not replay the writer to finish catch-up or increase the inline limits. +This removes a canonical import dependency, +not the supported legacy writer. The absent arm also removes all four shadow +producer modules using the qualified CLI startup isolation above. +[Retained duties and rollback](../../../../reference/canonical-todo-completion-update.md#monitor-source-writer-isolation). + +Shadow diagnostics now have an independent read-only boundary: retained outbox +disk codecs live in `local_authority_shadow_history.py`, and status/candidate +read transport in `local_authority_shadow_readback.py`. The public status and enabled +`coordination-shadow inspect`/`qualify`/`read-candidate` commands call that owner +without loading source producers. Full source and normal-wheel observations +retain matched/refused, default-off, source-drift and missing/corrupt-store +recovery behavior with all four producer modules absent. Historical imports +remain exact aliases; bootstrap, rollback and promotion retain their live adapter. +The existing TS qualifier now propagates provider read refusals before lineage +validation can mislabel corruption as `bootstrap_required`; valid/missing stores +retain their behavior. This is an explicit failure-diagnostic correction, with +no new RPC or migration authority; drain still uses its existing orchestration. +Original entry identity, malformed evidence, cursor residue and missing-store +behavior remain unchanged. Python retains historical filesystem decoding and +presentation IO; TS retains history proof, delivery and cleanup authority. +Existing producer imports are aliases for supported callers, not duplicate +implementations. Source and normal-wheel File/SQLite recipient checks compare +complete status results and unchanged original bytes with producers present or +absent. This is a historical-reader exit prerequisite, not writer deletion, +outbox disposition, installed cohort adoption or release-default qualification. +See [operator readback and rollback](../../../../reference/authority-observation-retirement.md#retained-readback-without-source-producers). + +Existing Goal migration, two-policy ownership retirement and storage-format +upgrade retain separate receipts and exits. Original-receipt recovery does not +justify retaining `legacy` as a live policy. Required migration readers remain. + +Imported canonical bootstrap reconnect now reuses the existing typed authority +reader, keeping current Todos, leases and original import receipts without +entering the Markdown writer. File/SQLite real CLI coverage includes an old v0 +preference naming the other provider, missing display, missing selected authority, +force/route rejection and later-write replay with legacy producers absent. +Python retains bootstrap registry/Host IO; it adds no decision owner or creation +receipt. This closes a reconnect dependency, not the remaining unpromoted writer, +active outbox, Host or release-default acceptance. + +A bounded cohort can start after its installed recovery and relevant execution +controls pass; it does not certify a released default or formal ten-day D2. +Frozen failures/missing evidence remain visible. T4 deletes proven redundant +owners alongside implementation, without waiting for R6 or all Python to vanish. +This replaces stale current-count estimates, not historical execution evidence. + +Public-scan privacy checkpoint: the retained Python filesystem/regex owner +classifies canonical inputs before reader submission, independently of display +paths. Overlapping roots cannot remove a private classification; reports use the +widest requested root consistently. Narrow explicit files/directories retain +private ancestry. Git-verified worktrees remain their own namespace beneath +private parent directories, while a directory merely named `.git` grants no +exception. Outside a worktree, explicit inputs beneath private state remain +excluded. Tracked-file policy, fresh symlink resolution and existing error rules +remain in this owner; no second control-plane decision source or new setting is +introduced. This safety repair does not qualify scanner latency, SQLite release +defaults or whole T4 retirement. CLI checks and quota preparation use the rule; +App status continues to report repository scanning as deferred. diff --git a/docs/architecture/rfcs/ledger/typescript-control-plane-migration-v0/2026-10-12-1x-prerequisites.zh-CN.md b/docs/architecture/rfcs/ledger/typescript-control-plane-migration-v0/2026-10-12-1x-prerequisites.zh-CN.md new file mode 100644 index 0000000000..bf6e52eb15 --- /dev/null +++ b/docs/architecture/rfcs/ledger/typescript-control-plane-migration-v0/2026-10-12-1x-prerequisites.zh-CN.md @@ -0,0 +1,152 @@ +# 历史 1.x 前置 checkpoint（截至 2026-10-12） + +从 [TypeScript 迁移 RFC](../../typescript-control-plane-migration-v0.zh-CN.md) 的“历史 1.x 前置 checkpoint（截至 2026-10-12）”小节迁出；迁移日期 2026-10-16，RFC 基线 `b2aca67d76af45e554c620818a982a81f8d2d52b`。保留当时证据与未验收边界；英文源记录 `38cb407ed`，中文源记录 `06b6caa07`，均不是当前候选的再次验收。 + +[English](2026-10-12-1x-prerequisites.md)。 + +以下记录解释具名源码上的前置条件与验证。“writer 仍可达”及“下一次截止” +描述当时的 1.x 基线，不是上方候选仍未实现的工作。 + +按 main `06b6caa07` 复核，#5413/#5466/#5283，以及创建、Host 停止、UI 历史 +相关 owner #5500/#5805/#5308/#5398 均已合并。复用各自已交付的边界，不重开 +10 月 2 日的合并队列。 +[当前验证、迁移与删除计划](../shared-goal-authority-state-provider-v0/2026-09-28-retirement-cadence.zh-CN.md#当前收尾验证迁移与删除2026-10-02) +现在优先安装态可回退验证、相关消费者采用、策略迁移及最后调用方删除，并分别 +记录已合并源码和仍缺的证据。 + +#5500/#5805 已实现 canonical 新 Goal 创建。既有机器设置与 +`coordination/local_authority_defaults.ts` 为未配置的新 Goal 选择 canonical +SQLite／`hard_lease`；CLI bootstrap 和 App 创建共享 typed 初始化及原操作恢复 +owner。显式 v0 设置和 v1 `canonical_creation=false` 保留晋升后目标行为；存量 +Goal 保持已记录的选择。见[配置及关闭契约](../../../../reference/local-authority-provider-selection.md#new-goal-authority-machine-setting)。 +这是源码候选，不认证安装采用、发布默认、完整共享 Goal 意图或 D2/D3；不重建 +创建／默认值 owner。 + +canonical Todo 入口隔离（T4）：五种 mutation facade 统一进入既有 +`todos/mutation_api.py`；历史导入改为惰性，未迁移 writer 隔离在 +`todos/legacy_mutation.py`。安装态 File/SQLite 检查可物理移除整个 writer，验证 +生命周期及结算恢复。冷导入检查进一步组合审核导入、新租约下的更新／新增写入、 +原操作恢复，并保持整个 writer 不存在；显示源丢失或 provider 中断不能替换 +当前 authority 或抹去后续写入。原导入 cursor 仍是历史回执，当前 provider +revision 保持。这为最后调用方删除建立边界，不宣称代码已退役：bootstrap、 +handoff、team-plan 和 Monitor 仍有受支持的旧源调用；capture/outbox 及历史恢复 +各等自己的出口。见[调用方及回滚清单](../../../../reference/canonical-todo-completion-update.md#canonical-mutation-entrypoint-isolation)。 +生产 Todo 消费者直接使用具体 owner：CLI 注册／操作、quota 与规划、 +能力写回、旧源租约读取及 Lark 源投影直接导入相同的 mutation、完整读取、路径或 +Markdown 显示 owner，不新增 wrapper、决策或 RPC。历史公开导入及其受支持的旧源 +IO 继续保留。隔离源码／正常 wheel 同时移除 facade、整个旧 Todo writer 和四个 +shadow producer，验证真实 File/SQLite CLI 生命周期、恰好一次结算、Monitor 重放 +及 App 冷导入／操作／重启；缺 provider／租约及源／备份变化须拒绝。Lark dry-run +与 Explore 重放只验证本地消费者，不计 live 外部采用。 +此前调用方盘点后，[#5280](https://github.com/loopx-project/loopx/pull/5280) 新增的 +fresh research execution 又在函数内导入历史 facade；现直接导入既有 +`todos/list_readback.py`，保持相同 typed 当前 Todo 校验以及先于读取的历史重放。 +同一 facade 存在／缺席、源码／正常 wheel、File／SQLite 矩阵补 fresh 执行、 +actor／可运行状态／输入拒绝、精确 lineage 读回，以及当前输入／Todo 改变后的 +原观察重放。完整生产包 import 守卫解析相对导入与 alias，动态加载仍依赖真实 +隔离路径验证。新能力进入时持续守卫，不把历史库存当永久出口。最后受支持的 +旧源 writer、历史恢复、安装 cohort 与发布验收各自保持开放。 + +保留的 import-compatible field writer 在既有 typed field plan 中统一等待条件 +归一化及矛盾 clear 拒绝；保持 Python 空白输入省略和锁内 IO，只退役重复的 +normalization crossing，不删除仍受支持的 writer 或迁移 reader。 + +剩余 legacy writer 和 bootstrap 的 capture 适配器，在 runtime shadow 关闭且没有 +活跃持久 binding 时，跳过 rollout 历史读取和 Todo projector 构建。原源身份仍须 +解析；已有活跃 binding 即使配置关闭，也继续要求持久 prepare。普通旧源写入因此 +省去可选捕获工作，输出、历史保留及 outbox 恢复保持原契约。Python 保留这层 +Host IO 适配，直到最后受支持的源 writer 被替换；本批不代表整个 writer 退役或 +默认 provider 资格通过。 +未迁移 lease acquire 现在仅在 typed 结果带有 capture 请求时加载 capture 适配器。 +真实 CLI 与正常 wheel 检查覆盖领取／重放、陈旧续约拒绝、续约、转交及释放：没有 +启用 capture 或活跃 binding 时，可物理移除四个旧 shadow producer 模块。已有活跃 +binding 在移除配置后仍完成 capture。这只退役默认关闭时的依赖，不删除仍受支持的 +源 writer，也不结束待处理 capture／历史恢复窗口。 + +handoff／continuation 显示决策已归入既有 TypeScript Todo context owner。summary +在同一个 batch 复用已归一化的身份、claim、exclusion 和任务类型事实；index 在单个 +原生 batch 保留先压缩源、再标注、最后合并审计事件的顺序。planning 与 quota +收集器整组投影已选记录。过大的显示上下文按字节预算分批读取，计数、依赖决策与 +闭合仍由完整源 owner 处理。超大单条历史记录复用既有私有快照传输，完整文本 +先进入凭证检查，再截断显示；不另加单条 frame 上限。Python facade 保留共享 metadata codec 和历史 +元组／SHA-1 身份编码，没有 Python 决策回退。nested-empty 优先级、Unicode 空白／ +codepoint 上限和截断前凭证拒绝都是需要保留的兼容义务。File／SQLite CLI 与正常 +wheel 的恢复验收要求：Markdown 显示缺失或选定 provider 不可用时，完整源与 +provider revision 仍被保留。这项读模型退役不等于受支持的 mutation／Host 调用方 +已删除，也不认证已发布的 SQLite 默认值。 + +公开 Todo 创建现在以一次 typed creation-scope 调用组合 scope、受支持的等待条件和 +有界 Monitor metadata。旧 add writer 复用同次准备结果，独立 Markdown codec 与后继 +创建仍自行校验；priority 和 validation declaration 保留原错误顺序，canonical 事务 +仍复核 registry、claim、lease 和 CAS。本批只退出重复创建编排，不删除仍有调用方的 +Markdown writer、bootstrap、Host IO 或历史恢复路径；发布默认与整项退役验收保持独立。 + +canonical team-plan 只在受支持的未迁移分支加载 capture 和 Markdown 编辑依赖。 +真实 File/SQLite Chat 及正常 wheel 的物理删源检查覆盖确认整批提交、后续写入后 +重放、provider 恢复、投影恢复和导入前历史回执。既有 TS 事务、源锁和投影 owner +保持；旧批量 IO 的故障注入入口为当前消费方保留惰性加载。这是调用隔离出口， +不等于删除活跃旧 writer，或完成 receiver adoption、Host 执行、PostgreSQL／D2 +资格。见[合同及保留义务](../../../../reference/canonical-todo-completion-update.md#team-plan-source-writer-isolation)。 + +公开 CLI 的 shadow 配置归入 `coordination/configuration.py`，完整源捕获归入 +`coordination/authority_source_capture.py`；冷导入、源检查和历史 promotion 恢复 +复用保留 owner，只有显式开启的 shadow 动作加载旧 producer。隔离源码及正常 +wheel 的副本中物理删除四个 shadow producer 后，真实 CLI 仍覆盖新 Goal 默认 +SQLite、租约工作、一次结算及可回退出口，以及冷 File／SQLite 导入和原操作重放。 +旧模块为现有消费者保留 API 重导出；启用的 capture、outbox 和旧命令仍受支持。 +精确源身份、归档依赖、安全 lease 读取和后续写入恢复均须保留。本批移除提前导入 +阻塞；删除活跃 producer 仍须其最后调用方退出。App／Lark 合同、provider 事务、 +cohort 采用及冻结 D2 证据保持独立。 + +Monitor router 同样隔离活跃旧源 writer；历史回执 codec／replay 共用 scheduler +只读 IO owner，原操作身份和决策继续归既有 TS batch。File/SQLite CLI 与正常 +wheel 删源检查须保留后来写入及原 successor；晋升后重放保持旧 outbox 静止， +未晋升的 markerless batch 恢复保留原有界 drain。业务回执重放不保证 shadow +立即追平：锁延期或 proof 预算耗尽时保留待处理证据，由独立的 +`authority-shadow drain` 恢复。恢复须保持原 source bytes、successor ID 和 quota +effect 恰好一次；不能为追平而重放 writer 或扩大 inline 上限。 +本批只移除 canonical 导入依赖， +不删除受支持的旧 writer；缺席臂复用上述 CLI 启动隔离，同时移除四个 shadow +producer module。 +见[保留义务及回滚](../../../../reference/canonical-todo-completion-update.md#monitor-source-writer-isolation)。 + +shadow 诊断现在有独立只读边界：历史 outbox 磁盘 codec 位于 +`local_authority_shadow_history.py`，status／candidate read transport 位于 +`local_authority_shadow_readback.py`。公开 status 和启用的 +`coordination-shadow inspect`／`qualify`／`read-candidate` 直接调用保留 owner， +不加载源 producer。源码和正常 wheel 物理删除四个 producer 后，完整读回保持 +匹配／拒绝、默认关闭、源漂移、store 缺失／损坏及恢复结果；历史 import 保留 +同一函数 alias，bootstrap／rollback／promotion 的活跃 adapter 继续受支持。 +既有 TS qualifier 保留 provider 读取失败，避免把损坏 journal 误称尚未 +bootstrap；正常／缺失状态保留原结果。这是明确的失败诊断修复，无新 RPC 或 +迁移权限；drain +仍走现有 orchestration。原 entry 身份、损坏证据、cursor 残留和缺失 store 行为 +保持。Python 保留历史文件解码及展示 IO；TS 保留历史证明、投递与清理权限。 +旧 producer 的已有导入为支持调用方保留 alias，不复制实现。源码及正常 wheel +的 File/SQLite 接收端检查，在 producer 存在／缺席两臂比较完整 status 响应和 +原文件字节。这是历史 reader 的退役前置，不代表 writer 删除、outbox 处置、 +安装 cohort 采用或发布默认资格。 +见[操作读回与回滚](../../../../reference/authority-observation-retirement.md#retained-readback-without-source-producers)。 + +存量 Goal 迁移、两策略退役和格式升级仍各有独立回执及出口；原回执恢复不能成为 +保留 legacy 活跃策略的理由，必要迁移 reader 保留。 + +导入后 canonical bootstrap 重连复用既有 typed authority reader，保留当前 +Todo、租约及原导入回执，避开 Markdown writer。File／SQLite 真实 CLI 覆盖旧 +v0 偏好指向另一 provider、显示缺失、选定权威丢失、force／改向拒绝，以及旧 +producer 不存在时的后续写入重放。Python 保留 bootstrap registry／Host IO， +不新增决策 owner 或创建回执。本批关闭重连依赖，未关闭未晋升 writer、活跃 +outbox、Host 或发布默认验收。 + +有界 cohort 在安装恢复和相关执行控制通过后可开始，不代表发布默认值或正式十天 +D2 已通过；冻结的失败／缺项保持可见。T4 随实现删除已证明重复的 owner，不等 R6 +或所有 Python 消失。本节替代陈旧的当前数量估算，不覆盖历史执行证据。 + +公共扫描隐私检查点：保留的 Python 文件系统／正则 owner 在提交 reader 前分类 +canonical 输入，分类独立于显示路径。重叠扫描根不能移除私有分类；报告统一使用 +最宽的请求根。窄范围显式文件／目录保留私有祖先信息。经 Git 核验的 worktree +即使位于私有父目录下，也保留自己的命名空间；仅名为 `.git` 的目录不构成例外。 +worktree 外、私有状态目录下的显式输入仍须排除。tracked 文件策略、每次重新 +解析的符号链接及既有错误规则均留在这个 owner，不新增第二份控制面决策源或 +配置项。这次安全修复不认证扫描耗时、SQLite 发布默认值或整个 T4 退役。CLI +检查和 quota 准备复用此规则；App status 继续明确报告仓库扫描为 deferred。 diff --git a/docs/architecture/rfcs/loopx-overall-roadmap-v0.md b/docs/architecture/rfcs/loopx-overall-roadmap-v0.md index f5ec93c78e..3c1fccfc08 100644 --- a/docs/architecture/rfcs/loopx-overall-roadmap-v0.md +++ b/docs/architecture/rfcs/loopx-overall-roadmap-v0.md @@ -18,7 +18,7 @@ no duplicate writer task, released-default claim or global RFC wait is implied. Conversational preparation from [PR #4376](https://github.com/loopx-project/loopx/pull/4376) is integrated under R1/GQ01 through the existing Chat draft and reviewed Goal creation path; see the [absorption map](app-conversation-and-async-inbox-v0.md#conversational-goal-preparation-integrating-the-team-workspace-proposal). -Its separate workspace/executor is not adopted. This entry improvement does not +Its separate workspace/executor is not adopted. This draft-creation entry improvement does not close GQ01 execution/return or R2 small-team acceptance. **S2/S12 startup diagnostic checkpoint (2026-10-04)** moved to diff --git a/docs/architecture/rfcs/loopx-overall-roadmap-v0.zh-CN.md b/docs/architecture/rfcs/loopx-overall-roadmap-v0.zh-CN.md index abe64edcaf..600cc57d3d 100644 --- a/docs/architecture/rfcs/loopx-overall-roadmap-v0.zh-CN.md +++ b/docs/architecture/rfcs/loopx-overall-roadmap-v0.zh-CN.md @@ -14,6 +14,11 @@ **S2/S12 启动诊断检查点（2026-10-04）** 已移至[执行账本](ledger/loopx-overall-roadmap-v0/2026-10-04-s2-s12-startup-diagnostic.zh-CN.md)。 +[PR #4376](https://github.com/loopx-project/loopx/pull/4376) 的对话式准备已在 R1/GQ01 +下整合到既有 Chat draft 与已审阅 Goal 创建路径，见 +[吸收映射](app-conversation-and-async-inbox-v0.zh-CN.md#对话式目标准备吸收团队工作台提案)。 +没有采用其独立 workspace/executor；草稿创建入口改进不代表 GQ01 执行/回传或 R2 小队验收完成。 + ## 1. 总目标与产品路线 LoopX 的目标是让人用本地前端或 Lark 提出、修订和验收复杂目标，由持久管家协调多个拥有独立工作承诺的长程 LoopX Agent，在本地 managed 与云端 runtime 上持续完成可验证的工作。单 Agent 的长程可靠性是基础，多个 Agent 的协作、handoff、恢复和共享目标收敛是核心能力，百 Agent 规模是需要独立证明的系统资格。 diff --git a/docs/architecture/rfcs/post-outcome-memory-utility-attribution-v0.md b/docs/architecture/rfcs/post-outcome-memory-utility-attribution-v0.md index cd109144f8..ef7f4bce34 100644 --- a/docs/architecture/rfcs/post-outcome-memory-utility-attribution-v0.md +++ b/docs/architecture/rfcs/post-outcome-memory-utility-attribution-v0.md @@ -415,7 +415,7 @@ This pilot closes no Stage 3/4 ranking or general review-quality qualification. The Agent-binding prerequisite uses the existing Reward Memory configuration owner: an optional exact Agent override preserves the legacy/shared route and every sibling, while disabled/invalid overrides fail closed. Configuration, -runtime admission, same-Turn receipt reuse and pending-outcome reconciliation +runtime admission, receipt reuse within the same Turn and pending-outcome reconciliation share the binding identity; bounded retries select the current route before applying the limit, retaining other routes' ambiguous journals unchanged. Provider writability and exact readback remain mandatory. The Goal settings diff --git a/docs/architecture/rfcs/post-outcome-memory-utility-attribution-v0.zh-CN.md b/docs/architecture/rfcs/post-outcome-memory-utility-attribution-v0.zh-CN.md index 8d1d03216c..c01822153f 100644 --- a/docs/architecture/rfcs/post-outcome-memory-utility-attribution-v0.zh-CN.md +++ b/docs/architecture/rfcs/post-outcome-memory-utility-attribution-v0.zh-CN.md @@ -316,6 +316,13 @@ baseline/experience 两组，包含合理内部前置阶段与误阻断对照。 ## 10. 验证标准 +Agent binding 前置能力复用现有 Reward Memory 配置 owner：可选的精确 Agent 覆盖保留 +legacy/shared 路由与全部 sibling，禁用或非法覆盖失败关闭。配置、runtime 准入、同 Turn +receipt 复用及 pending outcome 对账共享 binding 身份；有界重试先选择当前路由再应用 +上限，保留其他路由的不确定 journal。provider 可写性与精确读回仍是必需条件。 +Goal 设置旅程复用相同 preview/apply owner，并区分已提交配置和失败读回。这只验证 +配置与生命周期，不代表 Stage 3/4 效用或排序资格。 + Focused fixture 必须证明： - 记忆即使被 `applied`，在 artifact evidence 反驳时仍可判为 `harmful`； diff --git a/docs/architecture/rfcs/shared-goal-authority-state-provider-v0.md b/docs/architecture/rfcs/shared-goal-authority-state-provider-v0.md index a9daeb51ad..79b266600d 100644 --- a/docs/architecture/rfcs/shared-goal-authority-state-provider-v0.md +++ b/docs/architecture/rfcs/shared-goal-authority-state-provider-v0.md @@ -1089,7 +1089,7 @@ primitives; the contract does not pretend they are interchangeable databases: For PostgreSQL, `commit_authority` is one transaction, not a series of independent repository calls: lock or conditionally update the scoped head, -verify the expected provider revision, allocate the next scoped cursor, insert +verify the expected provider revision, allocate the next Goal-scoped cursor, insert the committed transaction/events/receipts, update the projection head, and commit. A connection failure before any write is a proved `failed` result; a connection loss after commit may have started is `ambiguous` and is reconciled diff --git a/docs/architecture/rfcs/shared-goal-authority-state-provider-v0.zh-CN.md b/docs/architecture/rfcs/shared-goal-authority-state-provider-v0.zh-CN.md index 56ae2f6195..64e8405646 100644 --- a/docs/architecture/rfcs/shared-goal-authority-state-provider-v0.zh-CN.md +++ b/docs/architecture/rfcs/shared-goal-authority-state-provider-v0.zh-CN.md @@ -883,6 +883,39 @@ transition、claim/lease fencing、Turn admission、quota 语义、settlement receipt 的含义。特别是，adapter 不得把 provider transaction result 重新解释为领域 判断。 +Stage 1 TS 合同显式区分读取失败：已证明 head `missing` 不同于存储 `unavailable`； +字节损坏或 lineage 无效是 `failed`。只有已证明不存在才允许 bootstrap。提交保留封闭 +结果 `applied | conflict | ambiguous | failed`；`ambiguous` 表示已尝试发布却无法从响应 +证明耐久性，须通过 `read_receipt` 和新鲜 head 读回对账。provider 异常或可读错误串 +从不构成提交证明。 + +三种 adapter 用不同原生机制实现同一逻辑操作，不把它们当成可互换的数据库： + +| 事项 | File Stage 1 | NoKV Stage 2A | PostgreSQL Stage 2B | +| --- | --- | --- | --- | +| 条件 revision | 跨进程文档锁内比较 revision chain | compare-and-publish 携带路径 `generation` | 每 tenant/Goal head-row revision，在行锁或条件更新下检查 | +| 原子 event/projection/receipt 提交 | 完整 journal 文档，文件 fsync、原子 rename、目录 fsync | 单个 generation-CAS envelope；在多记录协议合格前内嵌 receipt/scan 数据 | 一个 SQL 事务更新 head 并插入有序 event/receipt 行 | +| operation 唯一性 | 保留 journal 拒绝重复 `operation_id` | CAS envelope 中的 authority receipt index | 唯一 `(tenant_id, goal_id, operation_id)` 约束，只作存储 fencing，不作领域判断 | +| cursor | 文档局部单调递增 opaque string | 内嵌 journal cursor，仍待容量验收 | 在同一事务分配每 Goal 序号，不声称全局顺序 | +| lineage | 持久目录 `store-identity` | workbench 与永不复用的 `workspace_incarnation_id` | 绑定 provider 部署的服务管理数据库 incarnation | +| 信任边界 | 受信任嵌入式 LoopX 进程 | LoopX authority 持有的 NoKV 凭证 | 经认证的 tenant 作用域服务角色，Agent 不接收数据库表凭证 | + +PostgreSQL 的 `commit_authority` 是一个事务：锁定或条件更新 scoped head、核验预期 +provider revision、分配下一 Goal 作用域 cursor、写入 transaction/event/receipt、更新 +projection head 后提交。任何写入前的连接失败是可证明的 `failed`；可能开始提交后的 +断连是 `ambiguous`，经唯一 operation 行与 receipt 读回对账。`READ COMMITTED` 配合 +显式 head 行锁/条件更新可以实现此合同；选择 `SERIALIZABLE` 是 adapter 决策，不能 +替代 LoopX CAS、operation identity 或 lease fencing。认证、tenant routing、audit、 +连接池耗尽、取消、超时与 failover 在服务边界均须失败关闭。 + +NoKV 现有 `load` / `compare_and_put` 参考实现映射缺失、generation 冲突、不确定发布 +及 workbench incarnation lineage，尚未证明扩展的 event/receipt/cursor 服务合同。 +容量、保留、重启/恢复、可用性与 HA 合格前，`read_receipt` 与 `scan_committed` 只能 +读取单个 CAS envelope 内保留的 journal，不能静默映射为最终一致 listing API。 +File provider 因此是一致性证据，不是生产级事件存储。完整 journal 便于检查原子性和 +历史 receipt replay，代价是整文档增长；Stage 1 可接受的取舍不能直接成为 PostgreSQL +物理 schema 或 NoKV 容量证明。 + ### 6.3 三个版本号不是一回事 | 版本域 | Owner | 含义 | Consumer | @@ -2125,6 +2158,24 @@ provider 合同与 file backend 已落地，第一个 Stage 2C 提交后 runtime shadow 读取决策，上述 migration、rollback、parity、read flip 与 legacy-writer fencing 门禁仍然开放。 +### Deferred hard-lease 生命周期澄清（2026-09-23） + +上述终态租约门禁适用于处于 `open` 的执行型 Todo。`deferred` Todo 在等待期间本就 +无法取得 hard lease，若仍要求先持有租约才能离开等待态，负责人既不能恢复也不能 +终止该等待。对于已晋级的 `hard_lease` Goal，已注册且具备该 Todo 所有权的 Agent +可以显式执行 `status=open` 加 `clear_resume_when`，或将该 deferred 等待标记为 +superseded；前提是没有仍在有效期内的租约，也未提交旧执行租约凭证。Provider CAS +会把遗留的过期租约代际与 Todo 状态一并更新。重新打开不授予执行权限，下一次 +执行必须重新获取租约。`complete`、挤占有效租约、跨负责人修改及混入执行内容的 +更新仍受原有门禁约束。 + +反向转换同样由当前 claim/lease 持有者凭有效证明，原子延期开放 Todo、写明等待及原因 +并释放当前执行代际，不混入工作内容或所有权修改。legacy 模式保留的租约 lineage +也遵守此规则，重新打开要求无有效持有者。同一 TS owner 和 provider CAS 保留 receipt +及重试。延期后的已注册 Todo/monitor 等待仍可按原 Turn 身份完成无扣额阻塞结算，见 +[因果收尾](../../reference/protocols/quota-blocked-causal-closeout-v0.md)。这只关闭 S3 +owner 等待生命周期缺口，不代表通用 shared amendment 或 SQLite 默认准入合格。 + ### 与分阶段交付的关系 对应 #2787 评审结论中的五阶段计划：先在 characterization 阶段把今天的真实行为 @@ -2457,6 +2508,15 @@ D1–D3 与永久投影规划不变。 **D1 — 资格化永久投影交付，可与 T1/T2 重叠推进。** +周期报告 staging、live editorial fallback 与批准重试现共用一份 canonical-first Todo +来源，frontier/progress 从同一完整求值 snapshot 选择，缺失/过期展示不能制造或隐藏工作。 +`capabilities/periodic_report_progress.ts` 拥有报告选择和拒绝重试排序，删除 Python +选择/排序循环。带 offset 的时刻保留微秒，canonical 归档拒绝记录仍有效，显式 runtime-root +同时作用于 intent 与 Todo IO；冻结 editorial 请求保留原 basis。见 +[操作与边界](../../../loopx/capabilities/periodic_report/README.md#todo-authority-and-report-retries)。 +这只关闭 T3/L5 的该消费者族，不代表 D1 永久展示新鲜度、D2 持久性、D3 整 Goal 资格或 +默认 provider 选择。当前核对清单继续区分代码缺口与资格验证工作。 + Todo 摘要现由一个 TS 批次决定范围、lanes、计数、claim 展示分配和收尾证明，删除 Python 的重复汇总分支及分离的 lane／closure 内部调用。最近完成按真实完成时刻排序， 不把编辑时间或 ISO 字符串顺序当作完成顺序；partial 来源不能在再次筛选后重新取得 diff --git a/docs/architecture/rfcs/typescript-control-plane-migration-v0.md b/docs/architecture/rfcs/typescript-control-plane-migration-v0.md index 42939aec8b..ea102e2072 100644 --- a/docs/architecture/rfcs/typescript-control-plane-migration-v0.md +++ b/docs/architecture/rfcs/typescript-control-plane-migration-v0.md @@ -90,253 +90,7 @@ its last real caller or an explicit compatibility exit and affected real-path validation. Use the [retirement ledger](ledger/shared-goal-authority-state-provider-v0/2026-09-28-retirement-cadence.md#current-candidate-checkpoint) for current ownership; the dated evidence below is not a new work queue. -### Historical 1.x prerequisite context - -The following records preserve prerequisites and validation at their named -sources through 2026-10-12. Their references to reachable writers and a “next” cutoff describe -that 1.x baseline, not remaining implementation work in the candidate above. - -Rechecked at main `38cb407ed`: #5413/#5466/#5283 and the affected creation, -Host-stop and UI-history owners #5500/#5805/#5308/#5398 are merged. Reuse -their delivered boundaries rather than reopening the October 2 merge queue. -The [current validation, migration and deletion plan](ledger/shared-goal-authority-state-provider-v0/2026-09-28-retirement-cadence.md#current-closeout-validation-migration-and-deletion-2026-10-02) -now prioritizes installed reversible qualification, affected consumer adoption, -policy migration and last-caller deletion; it records the merged sources and -the remaining evidence separately. - -Canonical new-Goal creation is already implemented by #5500/#5805. The existing -machine setting and `coordination/local_authority_defaults.ts` choose canonical -SQLite with `hard_lease` for unconfigured new Goals; CLI bootstrap and App -creation share the typed initialization and original-operation recovery owner. -Explicit v0 settings and v1 `canonical_creation=false` preserve post-promotion -target behavior. Existing Goals keep their recorded selection. See the -[configuration and disable contract](../../reference/local-authority-provider-selection.md#new-goal-authority-machine-setting). -This is the source candidate, not certification of installed adoption, a released -default, full shared Goal intent or D2/D3. Do not rebuild a creation/default owner. - -Canonical Todo entrypoint separation (T4): all five mutation facades now share -`todos/mutation_api.py`; historic imports are lazy and the unpromoted writer is -isolated in `todos/legacy_mutation.py`. The installed File/SQLite oracle can -remove the whole writer module while exercising lifecycle and settlement -recovery. The cold-import oracle now composes reviewed import, fresh leased -updates/new writes and original-operation recovery with that writer absent; -source-display loss and provider outage cannot replace the current authority -or erase later writes. The original import cursor remains historical while the -current provider revision is preserved. This prepares last-caller deletion -without claiming code retirement: -bootstrap, handoff, team-plan and Monitor still have supported source callers; -keep capture/outbox and historical recovery until their own exits. [Caller and -rollback inventory](../../reference/canonical-todo-completion-update.md#canonical-mutation-entrypoint-isolation). -Production Todo consumers use the concrete owners instead of the historic `loopx.todos` re-export: -CLI registration/actions, quota and planning, capability writeback, source lease -reads and the Lark source projection import the same concrete mutation, full-read, -path or Markdown display owners. No new wrapper, decision or RPC is introduced. -The historic public imports and their supported unpromoted IO remain available. -Disposable source/normal-wheel probes remove the facade, the whole legacy Todo -writer and four shadow producers together; real File/SQLite CLI lifecycle, -once-only settlement, Monitor replay and App cold-import/action/restart journeys -must still work, with missing-provider/lease and changed-source/backup refusals. -The App HTTP receiver now also removes `bootstrap.py` from that same copied -distribution and checks the complete removed set before each server start, -restart and auxiliary CLI. Separate fixture results cannot prove this combined -absence. The ordinary canonical CLI creation entrypoint remains with its owner; -removing it from the cold-import receiver is a disposable qualification probe, -not a supported package format or permission to break the additive 1.x line. -中文：App 冷导入、后续写入和重启使用同一份缺少旧入口、writer 与 source producer 的 -隔离副本；不能拼接两组各自缺少一部分模块的结果。正常 canonical 创建仍保留其 -现有入口，这个临时卸除验收不等于已完成整族退役、自然试用或正式安装采用。 -Lark dry-run and Explore replay qualify local consumers only, not live external -adoption. The fresh research execution path added by [#5280](https://github.com/loopx-project/loopx/pull/5280) -reintroduced a function-local historic import after the earlier caller inventory. -It now imports `todos/list_readback.py` directly, preserving the same typed -current-Todo validation and the historical replay branch before that read. -The qualification includes fresh research execution, actor/runnable/input -refusals, exact lineage readback and replay after current input/Todo changes -in the same facade-present/absent source and normal-wheel File/SQLite matrix. -A whole-production Python import guard resolves relative imports and aliases; -dynamic loading still requires the isolated real journeys. Keep this guard as -new capabilities arrive, rather than treating a past inventory as a permanent -exit. Last supported source writers, historical recovery, installed cohort -and release exits remain independently open. - -The next T4 package is the [import-first normal-writer cutoff](../../reference/local-authority-provider-selection.md#proposed-compatibility-cutoff-and-release-sequence), -not another re-export or producer-loading extraction. At `38cb407ed`, live -unpromoted callers remain in ordinary mutation, bootstrap/creation opt-out, -team-plan, Monitor, ownership/source lease and active capture/binding. Reuse -their typed admission/transaction owners; treat retained source capture, -historical receipts and permanent document IO as recovery obligations. -The existing delivery Todos should carry these concrete exits: - -- Qualify the installed import/backup/recovery journey for the declared source - matrix; importer implementation is already present and is not a missing-code - dependency. Do not reinterpret complete coordination backup as complete Goal - backup. -- Run the bounded reversible core-developer SQLite trial before the breaking - cutoff, recording real Host adoption/use separately from conversion drills. -- Deliver the cohesive 2.0 normal-writer cutoff: fresh unmigrated writes and - execution grants refuse before effects; canonical work and original-operation - recovery pass with the old writer physically absent. Keep the additive 1.x - import/deprecation line compatible. - Admission must preserve original lease release and receipt/outbox recovery - before import; denying the existing shared legacy fence indiscriminately - would also block these prerequisites. Remove the Python missing-fence bypass - with the typed cutoff and validate the combined recovery-to-import journey - specified in the linked release contract. -- After the last source caller exits, reconcile pending outboxes and delete - unused capture producers/private decisions together. Keep supported historical - readers and current-head rollback; do not wait for every external user to - migrate or claim full T4/D2/default qualification from internal deletion. - -This updates the existing R5/T4 frontier and release proposal; it creates no -parallel migration owner, runtime gate or release activation. - -Team-plan recovery prerequisite: an unpromoted plan that published its original -receipt can now recover through the Chat confirmation owner while shadow -bootstrap is interrupted. Registry/Todo/source locks still protect the read, -and the existing typed identity validator rejects changed intent, actor or -reviewed basis. Recovery verifies source durability without loading the capture -producer or admitting new writes; fresh plans still obey all source, management -and promotion guards. This repairs the existing 1.x recovery path and does not -activate the 2.0 cutoff or settle the remaining lease/outbox/Host obligations. - - -The retained import-compatible field writer now composes resume normalization -and contradictory-clear rejection in its existing typed field plan. Keep blank -Python input omission and locked IO; retire the duplicate normalization crossing, -not the still-supported writer or migration reader. - -The remaining legacy writer and bootstrap capture adapter now avoids loading -rollout history and constructing a Todo projector when runtime shadow is off -and there is no active durable binding. It still resolves the source identity; -an active binding continues to require durable preparation even after config -is disabled. This removes optional capture work from ordinary legacy writes, -without changing their output, history retention or outbox recovery. Python -retains this Host IO adapter until its last supported source writer is replaced; -this is neither whole-writer retirement nor default-provider qualification. -Unpromoted lease acquire now loads the capture adapter only when the typed -result carries a capture request. The real CLI and normal-wheel oracle cover -acquire/replay, rejected stale renewal, renewal, transfer and release with the -four legacy shadow producer modules physically absent and with no enabled -capture or active binding. An active binding still delivers capture after the -setting is removed. This retires a default-off dependency, not the supported -source writer or pending capture/history recovery. - -Handoff/continuation display decisions now belong to the existing TypeScript Todo -context owner. Summary reuses its normalized identity/claim/exclusion/class -facts in one batch; the index keeps source compaction before labelling and audit -merging in one native batch. Planning and quota collectors project whole chosen -sets. Oversized display context uses byte-bounded read-lens batches while -counts, dependency decisions and closure retain their full-source owner. A -single oversized historical record reuses the existing private snapshot transport: -credential checks see its full text before display truncation. The -Python facade keeps shared metadata codecs and historical tuple/SHA-1 identity -encoding, with no Python decision fallback. Retain nested-empty precedence, -Unicode whitespace/codepoint limits and credential rejection before truncation; -these are compatibility obligations. File/SQLite CLI and normal-wheel recovery -must preserve exact source and provider revision when Markdown display is absent -or the selected provider is unavailable. This read-model retirement does not -retire the supported mutation/Host callers or certify a released SQLite default. - -Public add now composes scope, supported wait and bounded Monitor metadata in -one typed creation-scope request. The legacy add writer consumes that same -fresh draft rather than re-planning it; standalone line codecs and successor -creation retain their own admission. Priority and validation-declaration -checks keep their prior diagnostic order, and canonical provider transactions -still recheck registry/claim/lease/CAS authority. This retires duplicate add -composition, not the supported Markdown writer or bootstrap/Host/history IO. - -The canonical team-plan caller now loads capture and Markdown editing only in -its supported unpromoted arm. Real File/SQLite Chat and normal-wheel source -removal cover confirmed batch commit, later-write replay, provider restoration, -projection recovery and imported historical receipts. The existing TS -transaction, source guards and projection owner remain unchanged; the legacy -batch IO instrumentation seam stays lazy for its current consumers. This is a -caller-isolation exit, not deletion of the live legacy writer or completion of -receiver adoption, Host execution, PostgreSQL or D2 qualification. -[Contract and retained duties](../../reference/canonical-todo-completion-update.md#team-plan-source-writer-isolation). - -Public CLI isolation now keeps shadow configuration in `coordination/configuration.py` -and complete source capture in `coordination/authority_source_capture.py`. Cold import, -source inspection and historical promotion recovery reuse those retained owners; -only explicit enabled shadow actions load the old producers. Ordinary new-Goal -SQLite creation, leased work, once-only settlement and reversible exit, plus cold -File/SQLite import and original-operation replay, run through the real CLI with -all four shadow producers physically absent in disposable source/normal-wheel -copies. The old module still re-exports the retained APIs for current consumers; -enabled capture, outbox and legacy commands remain supported. Preserve exact -source identity, archive dependencies, safe lease reads and later-write recovery. -This removes an eager-import blocker; deleting live producers still requires -their last-caller exit. App/Lark contracts, provider transactions, cohort adoption -and frozen D2 evidence remain separate. - -The Monitor router likewise isolates its live source writer. Historical receipt -codec/replay has a small shared scheduler IO owner, while the existing TS batch -still owns operation identity and decisions. File/SQLite CLI and normal-wheel -source removal must preserve later canonical writes and original successors; -promoted replay leaves old outbox bytes inert. Unpromoted markerless batch -recovery retains its existing bounded drain. Business-receipt replay does not -guarantee shadow catch-up: lock deferral or an expired proof budget preserves -pending evidence for an independent `authority-shadow drain`. Recovery keeps -the original source bytes, successor IDs and once-only quota effect; it does -not replay the writer to finish catch-up or increase the inline limits. -This removes a canonical import dependency, -not the supported legacy writer. The absent arm also removes all four shadow -producer modules using the qualified CLI startup isolation above. -[Retained duties and rollback](../../reference/canonical-todo-completion-update.md#monitor-source-writer-isolation). - -Shadow diagnostics now have an independent read-only boundary: retained outbox -disk codecs live in `local_authority_shadow_history.py`, and status/candidate -read transport in `local_authority_shadow_readback.py`. The public status and enabled -`coordination-shadow inspect`/`qualify`/`read-candidate` commands call that owner -without loading source producers. Full source and normal-wheel observations -retain matched/refused, default-off, source-drift and missing/corrupt-store -recovery behavior with all four producer modules absent. Historical imports -remain exact aliases; bootstrap, rollback and promotion retain their live adapter. -The existing TS qualifier now propagates provider read refusals before lineage -validation can mislabel corruption as `bootstrap_required`; valid/missing stores -retain their behavior. This is an explicit failure-diagnostic correction, with -no new RPC or migration authority; drain still uses its existing orchestration. -Original entry identity, malformed evidence, cursor residue and missing-store -behavior remain unchanged. Python retains historical filesystem decoding and -presentation IO; TS retains history proof, delivery and cleanup authority. -Existing producer imports are aliases for supported callers, not duplicate -implementations. Source and normal-wheel File/SQLite recipient checks compare -complete status results and unchanged original bytes with producers present or -absent. This is a historical-reader exit prerequisite, not writer deletion, -outbox disposition, installed cohort adoption or release-default qualification. -See [operator readback and rollback](../../reference/authority-observation-retirement.md#retained-readback-without-source-producers). - -Existing Goal migration, two-policy ownership retirement and storage-format -upgrade retain separate receipts and exits. Original-receipt recovery does not -justify retaining `legacy` as a live policy. Required migration readers remain. - -Imported canonical bootstrap reconnect now reuses the existing typed authority -reader, keeping current Todos, leases and original import receipts without -entering the Markdown writer. File/SQLite real CLI coverage includes an old v0 -preference naming the other provider, missing display, missing selected authority, -force/route rejection and later-write replay with legacy producers absent. -Python retains bootstrap registry/Host IO; it adds no decision owner or creation -receipt. This closes a reconnect dependency, not the remaining unpromoted writer, -active outbox, Host or release-default acceptance. - -A bounded cohort can start after its installed recovery and relevant execution -controls pass; it does not certify a released default or formal ten-day D2. -Frozen failures/missing evidence remain visible. T4 deletes proven redundant -owners alongside implementation, without waiting for R6 or all Python to vanish. -This replaces stale current-count estimates, not historical execution evidence. - -Public-scan privacy checkpoint: the retained Python filesystem/regex owner -classifies canonical inputs before reader submission, independently of display -paths. Overlapping roots cannot remove a private classification; reports use the -widest requested root consistently. Narrow explicit files/directories retain -private ancestry. Git-verified worktrees remain their own namespace beneath -private parent directories, while a directory merely named `.git` grants no -exception. Outside a worktree, explicit inputs beneath private state remain -excluded. Tracked-file policy, fresh symlink resolution and existing error rules -remain in this owner; no second control-plane decision source or new setting is -introduced. This safety repair does not qualify scanner latency, SQLite release -defaults or whole T4 retirement. CLI checks and quota preparation use the rule; -App status continues to report repository scanning as deferred. +Checkpoint moved to the execution ledger: [1.x prerequisites through 2026-10-12](ledger/typescript-control-plane-migration-v0/2026-10-12-1x-prerequisites.md). ## Native authority qualification and prototype retirement (2026-09-26) diff --git a/docs/architecture/rfcs/typescript-control-plane-migration-v0.zh-CN.md b/docs/architecture/rfcs/typescript-control-plane-migration-v0.zh-CN.md index 8f8555a477..4960718ac3 100644 --- a/docs/architecture/rfcs/typescript-control-plane-migration-v0.zh-CN.md +++ b/docs/architecture/rfcs/typescript-control-plane-migration-v0.zh-CN.md @@ -75,154 +75,16 @@ tree 相同；后续 main 同步与自动合并结果相同，并包含 #6597 当前归属见[退役 ledger](ledger/shared-goal-authority-state-provider-v0/2026-09-28-retirement-cadence.zh-CN.md#current-candidate-checkpoint)； 下方具名历史证据不是新的任务队列。 -### 历史 1.x 前置背景 - -以下记录保留截至 2026-10-12 的具名源码前置条件与验证。“writer 仍可达”及“下一次截止” -描述当时的 1.x 基线，不是上方候选仍未实现的工作。 - -按 main `06b6caa07` 复核，#5413/#5466/#5283，以及创建、Host 停止、UI 历史 -相关 owner #5500/#5805/#5308/#5398 均已合并。复用各自已交付的边界，不重开 -10 月 2 日的合并队列。 -[当前验证、迁移与删除计划](ledger/shared-goal-authority-state-provider-v0/2026-09-28-retirement-cadence.zh-CN.md#当前收尾验证迁移与删除2026-10-02) -现在优先安装态可回退验证、相关消费者采用、策略迁移及最后调用方删除，并分别 -记录已合并源码和仍缺的证据。 - -#5500/#5805 已实现 canonical 新 Goal 创建。既有机器设置与 -`coordination/local_authority_defaults.ts` 为未配置的新 Goal 选择 canonical -SQLite／`hard_lease`；CLI bootstrap 和 App 创建共享 typed 初始化及原操作恢复 -owner。显式 v0 设置和 v1 `canonical_creation=false` 保留晋升后目标行为；存量 -Goal 保持已记录的选择。见[配置及关闭契约](../../reference/local-authority-provider-selection.md#new-goal-authority-machine-setting)。 -这是源码候选，不认证安装采用、发布默认、完整共享 Goal 意图或 D2/D3；不重建 -创建／默认值 owner。 - -canonical Todo 入口隔离（T4）：五种 mutation facade 统一进入既有 -`todos/mutation_api.py`；历史导入改为惰性，未迁移 writer 隔离在 -`todos/legacy_mutation.py`。安装态 File/SQLite 检查可物理移除整个 writer，验证 -生命周期及结算恢复。冷导入检查进一步组合审核导入、新租约下的更新／新增写入、 -原操作恢复，并保持整个 writer 不存在；显示源丢失或 provider 中断不能替换 -当前 authority 或抹去后续写入。原导入 cursor 仍是历史回执，当前 provider -revision 保持。这为最后调用方删除建立边界，不宣称代码已退役：bootstrap、 -handoff、team-plan 和 Monitor 仍有受支持的旧源调用；capture/outbox 及历史恢复 -各等自己的出口。见[调用方及回滚清单](../../reference/canonical-todo-completion-update.md#canonical-mutation-entrypoint-isolation)。 -生产 Todo 消费者直接使用具体 owner：CLI 注册／操作、quota 与规划、 -能力写回、旧源租约读取及 Lark 源投影直接导入相同的 mutation、完整读取、路径或 -Markdown 显示 owner，不新增 wrapper、决策或 RPC。历史公开导入及其受支持的旧源 -IO 继续保留。隔离源码／正常 wheel 同时移除 facade、整个旧 Todo writer 和四个 -shadow producer，验证真实 File/SQLite CLI 生命周期、恰好一次结算、Monitor 重放 -及 App 冷导入／操作／重启；缺 provider／租约及源／备份变化须拒绝。Lark dry-run -与 Explore 重放只验证本地消费者，不计 live 外部采用。 -此前调用方盘点后，[#5280](https://github.com/loopx-project/loopx/pull/5280) 新增的 -fresh research execution 又在函数内导入历史 facade；现直接导入既有 -`todos/list_readback.py`，保持相同 typed 当前 Todo 校验以及先于读取的历史重放。 -同一 facade 存在／缺席、源码／正常 wheel、File／SQLite 矩阵补 fresh 执行、 -actor／可运行状态／输入拒绝、精确 lineage 读回，以及当前输入／Todo 改变后的 -原观察重放。完整生产包 import 守卫解析相对导入与 alias，动态加载仍依赖真实 -隔离路径验证。新能力进入时持续守卫，不把历史库存当永久出口。最后受支持的 -旧源 writer、历史恢复、安装 cohort 与发布验收各自保持开放。 - -保留的 import-compatible field writer 在既有 typed field plan 中统一等待条件 -归一化及矛盾 clear 拒绝；保持 Python 空白输入省略和锁内 IO，只退役重复的 -normalization crossing，不删除仍受支持的 writer 或迁移 reader。 - -剩余 legacy writer 和 bootstrap 的 capture 适配器，在 runtime shadow 关闭且没有 -活跃持久 binding 时，跳过 rollout 历史读取和 Todo projector 构建。原源身份仍须 -解析；已有活跃 binding 即使配置关闭，也继续要求持久 prepare。普通旧源写入因此 -省去可选捕获工作，输出、历史保留及 outbox 恢复保持原契约。Python 保留这层 -Host IO 适配，直到最后受支持的源 writer 被替换；本批不代表整个 writer 退役或 -默认 provider 资格通过。 -未迁移 lease acquire 现在仅在 typed 结果带有 capture 请求时加载 capture 适配器。 -真实 CLI 与正常 wheel 检查覆盖领取／重放、陈旧续约拒绝、续约、转交及释放：没有 -启用 capture 或活跃 binding 时，可物理移除四个旧 shadow producer 模块。已有活跃 -binding 在移除配置后仍完成 capture。这只退役默认关闭时的依赖，不删除仍受支持的 -源 writer，也不结束待处理 capture／历史恢复窗口。 - -handoff／continuation 显示决策已归入既有 TypeScript Todo context owner。summary -在同一个 batch 复用已归一化的身份、claim、exclusion 和任务类型事实；index 在单个 -原生 batch 保留先压缩源、再标注、最后合并审计事件的顺序。planning 与 quota -收集器整组投影已选记录。过大的显示上下文按字节预算分批读取，计数、依赖决策与 -闭合仍由完整源 owner 处理。超大单条历史记录复用既有私有快照传输，完整文本 -先进入凭证检查，再截断显示；不另加单条 frame 上限。Python facade 保留共享 metadata codec 和历史 -元组／SHA-1 身份编码，没有 Python 决策回退。nested-empty 优先级、Unicode 空白／ -codepoint 上限和截断前凭证拒绝都是需要保留的兼容义务。File／SQLite CLI 与正常 -wheel 的恢复验收要求：Markdown 显示缺失或选定 provider 不可用时，完整源与 -provider revision 仍被保留。这项读模型退役不等于受支持的 mutation／Host 调用方 -已删除，也不认证已发布的 SQLite 默认值。 - -公开 Todo 创建现在以一次 typed creation-scope 调用组合 scope、受支持的等待条件和 -有界 Monitor metadata。旧 add writer 复用同次准备结果，独立 Markdown codec 与后继 -创建仍自行校验；priority 和 validation declaration 保留原错误顺序，canonical 事务 -仍复核 registry、claim、lease 和 CAS。本批只退出重复创建编排，不删除仍有调用方的 -Markdown writer、bootstrap、Host IO 或历史恢复路径；发布默认与整项退役验收保持独立。 - -canonical team-plan 只在受支持的未迁移分支加载 capture 和 Markdown 编辑依赖。 -真实 File/SQLite Chat 及正常 wheel 的物理删源检查覆盖确认整批提交、后续写入后 -重放、provider 恢复、投影恢复和导入前历史回执。既有 TS 事务、源锁和投影 owner -保持；旧批量 IO 的故障注入入口为当前消费方保留惰性加载。这是调用隔离出口， -不等于删除活跃旧 writer，或完成 receiver adoption、Host 执行、PostgreSQL／D2 -资格。见[合同及保留义务](../../reference/canonical-todo-completion-update.md#team-plan-source-writer-isolation)。 - -公开 CLI 的 shadow 配置归入 `coordination/configuration.py`，完整源捕获归入 -`coordination/authority_source_capture.py`；冷导入、源检查和历史 promotion 恢复 -复用保留 owner，只有显式开启的 shadow 动作加载旧 producer。隔离源码及正常 -wheel 的副本中物理删除四个 shadow producer 后，真实 CLI 仍覆盖新 Goal 默认 -SQLite、租约工作、一次结算及可回退出口，以及冷 File／SQLite 导入和原操作重放。 -旧模块为现有消费者保留 API 重导出；启用的 capture、outbox 和旧命令仍受支持。 -精确源身份、归档依赖、安全 lease 读取和后续写入恢复均须保留。本批移除提前导入 -阻塞；删除活跃 producer 仍须其最后调用方退出。App／Lark 合同、provider 事务、 -cohort 采用及冻结 D2 证据保持独立。 - -Monitor router 同样隔离活跃旧源 writer；历史回执 codec／replay 共用 scheduler -只读 IO owner，原操作身份和决策继续归既有 TS batch。File/SQLite CLI 与正常 -wheel 删源检查须保留后来写入及原 successor；晋升后重放保持旧 outbox 静止， -未晋升的 markerless batch 恢复保留原有界 drain。业务回执重放不保证 shadow -立即追平：锁延期或 proof 预算耗尽时保留待处理证据，由独立的 -`authority-shadow drain` 恢复。恢复须保持原 source bytes、successor ID 和 quota -effect 恰好一次；不能为追平而重放 writer 或扩大 inline 上限。 -本批只移除 canonical 导入依赖， -不删除受支持的旧 writer；缺席臂复用上述 CLI 启动隔离，同时移除四个 shadow -producer module。 -见[保留义务及回滚](../../reference/canonical-todo-completion-update.md#monitor-source-writer-isolation)。 - -shadow 诊断现在有独立只读边界：历史 outbox 磁盘 codec 位于 -`local_authority_shadow_history.py`，status／candidate read transport 位于 -`local_authority_shadow_readback.py`。公开 status 和启用的 -`coordination-shadow inspect`／`qualify`／`read-candidate` 直接调用保留 owner， -不加载源 producer。源码和正常 wheel 物理删除四个 producer 后，完整读回保持 -匹配／拒绝、默认关闭、源漂移、store 缺失／损坏及恢复结果；历史 import 保留 -同一函数 alias，bootstrap／rollback／promotion 的活跃 adapter 继续受支持。 -既有 TS qualifier 保留 provider 读取失败，避免把损坏 journal 误称尚未 -bootstrap；正常／缺失状态保留原结果。这是明确的失败诊断修复，无新 RPC 或 -迁移权限；drain -仍走现有 orchestration。原 entry 身份、损坏证据、cursor 残留和缺失 store 行为 -保持。Python 保留历史文件解码及展示 IO；TS 保留历史证明、投递与清理权限。 -旧 producer 的已有导入为支持调用方保留 alias，不复制实现。源码及正常 wheel -的 File/SQLite 接收端检查，在 producer 存在／缺席两臂比较完整 status 响应和 -原文件字节。这是历史 reader 的退役前置，不代表 writer 删除、outbox 处置、 -安装 cohort 采用或发布默认资格。 -见[操作读回与回滚](../../reference/authority-observation-retirement.md#retained-readback-without-source-producers)。 - -存量 Goal 迁移、两策略退役和格式升级仍各有独立回执及出口；原回执恢复不能成为 -保留 legacy 活跃策略的理由，必要迁移 reader 保留。 - -导入后 canonical bootstrap 重连复用既有 typed authority reader，保留当前 -Todo、租约及原导入回执，避开 Markdown writer。File／SQLite 真实 CLI 覆盖旧 -v0 偏好指向另一 provider、显示缺失、选定权威丢失、force／改向拒绝，以及旧 -producer 不存在时的后续写入重放。Python 保留 bootstrap registry／Host IO， -不新增决策 owner 或创建回执。本批关闭重连依赖，未关闭未晋升 writer、活跃 -outbox、Host 或发布默认验收。 - -有界 cohort 在安装恢复和相关执行控制通过后可开始，不代表发布默认值或正式十天 -D2 已通过；冻结的失败／缺项保持可见。T4 随实现删除已证明重复的 owner，不等 R6 -或所有 Python 消失。本节替代陈旧的当前数量估算，不覆盖历史执行证据。 - -公共扫描隐私检查点：保留的 Python 文件系统／正则 owner 在提交 reader 前分类 -canonical 输入，分类独立于显示路径。重叠扫描根不能移除私有分类；报告统一使用 -最宽的请求根。窄范围显式文件／目录保留私有祖先信息。经 Git 核验的 worktree -即使位于私有父目录下，也保留自己的命名空间；仅名为 `.git` 的目录不构成例外。 -worktree 外、私有状态目录下的显式输入仍须排除。tracked 文件策略、每次重新 -解析的符号链接及既有错误规则均留在这个 owner，不新增第二份控制面决策源或 -配置项。这次安全修复不认证扫描耗时、SQLite 发布默认值或整个 T4 退役。CLI -检查和 quota 准备复用此规则；App status 继续明确报告仓库扫描为 deferred。 +历史检查点已移至执行账本：[1.x 前置条件（截至 2026-10-12）](ledger/typescript-control-plane-migration-v0/2026-10-12-1x-prerequisites.zh-CN.md)。 + +## 原生 authority 验收与原型退役（2026-09-26） + +仅用于覆盖验证的 Python coordination executor、head codec、File provider 与 +bootstrap bridge 已随最后 example/test 调用方退役。Stage 0 现运行完整原生 +File/SQLite conformance，不再使用旧 Python provider；复用既有 TS domain owner +与共享 fixture。`authority_core.py` 仍是活跃 adapter，未删除。这是早期有界 T4 +删除切片，不代表默认 cutover 或全部 Python 退役。见 +[覆盖、行为差异与格式边界](../../../examples/shared-goal-authority-e2e/README.md#native-qualification-and-prototype-retirement)。 ## Todo 事件路径退役（2026-09-25） @@ -1095,8 +957,13 @@ TS 生产者验证器通过共享 guard fixture 执行真实 TS 分类器，并 codec；较大的完整事实快照通过私有临时文件和摘要绑定的引用传递。同一 reducer 校验全部记录、agent 作用域内的 ACK 及重试身份；RPC 预算和展示窗口都不允许截断 历史。快照缺失、改变或无效时在决策前拒绝，适配器在返回或失败后清理临时文件。 -这修复 T3/S2 的结算阻塞并补充 S7/R7 的传输增长证据，不代表全历史解析已经恒定 -内存，也不证明分布式执行。游标/checkpoint 归约保留为以测量驱动、完整源语义一致 +Replan 语义投影也通过既有同 UID、摘要绑定的请求/响应 snapshot 通道传递完整生命周期 +和 receipt 恢复事实。调用方共用一个 transport adapter；生命周期、stride 与 receipt +决策仍归同一个 TS owner。普通 RPC 保留 2 MiB 上限，本地 snapshot 保留 64 MiB 上限。 +File/SQLite CLI 恢复覆盖超过 wire 预算的完整事实、后续独立工作与用户 gate、持久 refresh +及 replay，以及精确一次 quota 扣记。这修复 T3/S2 的结算阻塞并补充 S7/R7 的传输增长 +证据，不代表全历史解析已经恒定内存，也不证明已安装宿主采用或分布式执行。 +游标/checkpoint 归约保留为以测量驱动、完整源语义一致 为前提的后续工作，不再造 Python 规则。见[历史决策证据](ledger/typescript-control-plane-migration-v0/2026-09-22-replan-history-policy.zh-CN.md)。 **Checkpoint 恢复编写契约。** 现有 TS vision owner 只能投影校验器接受的恢复 @@ -1329,10 +1196,10 @@ Python 拥有的投影只传入紧凑的读取 facts。每个投影一次请求 status projection 迁入 kernel（§4 已将其列为 facade 退出条件），由 TS 直接收集 facts，adapter 随之删除。 -推广顺序。`status`（含 `--goal-id` 与 projection cache 命中）、`global-summary` -与 `global-gates` 现已携带 envelope。其他 `collect_status` 调用方会在 payload 里 -收到 status envelope，但尚未输出自己的 envelope。下一步依次为：`global-todos` 与 -`global-risks`（同样的组合，各一次调用）、`quota should-run`、`review-packet`， +推广顺序。`status`（含 `--goal-id` 与 projection cache 命中）、`global-summary`、 +`global-gates`、`global-todos` 与 `global-risks` 现已携带 envelope。其他 `collect_status` +调用方会在 payload 里收到 status envelope，但尚未输出自己的 envelope。下一步依次为： +`quota should-run`、`review-packet`， 以及 Decision Context packet。新加入或迁入 TypeScript 的读模型在同一个 PR 里输出 envelope；§6 把这一条定为 promotion 门禁。 @@ -1392,7 +1259,7 @@ replay、receipt 与 settlement。这个架构选择已经落地，不再是假 | Quota monitor-poll commit transaction | TypeScript 拥有 monitor admission 复核、target/event/result 构造、effect replay/index CAS、provider intent，以及可修复的 JSON/Markdown/index persistence | Python 投影 compact `should-run` facts，在最多两次 reduction 之间调用真实 Todo provider，刷新 legacy status，并持有 cross-writer index lock | | Runtime decoder（[#3443](https://github.com/loopx-project/loopx/pull/3443)） | 稳定 primitive decoding 进入一个很小的共享模块；domain decoder 仍留在本地 | 没有理由建设更大的 schema framework | | Transaction 兑现（[#3464](https://github.com/loopx-project/loopx/pull/3464)、[#3481](https://github.com/loopx-project/loopx/pull/3481) 与 Todo completion） | Turn settlement、quota delivery routing 与 Todo completion 均只跨一个粗粒度 TS boundary；Todo transaction 拥有 identity、replay fence、validation planning/result reduction、continuation/recovery 与 completion metadata | Python 仍执行显式 external provider，并物化 legacy Markdown result；其他 domain 仍需各自的 bounded cutover | -| Projection envelope | TypeScript 拥有 `loopx_projection_envelope_v0` 的解码，以及全部 freshness、告警、完整性与重放判定 | 在 `status`、`global-summary`、`global-gates` 迁移前，Python 仍为它们收集读取 facts | +| Projection envelope | TypeScript 拥有 `loopx_projection_envelope_v0` 的解码，以及全部 freshness、告警、完整性与重放判定 | 在 `status`、`global-summary`、`global-gates`、`global-todos`、`global-risks` 迁移前，Python 仍为它们收集读取 facts | Scheduler facade exit 已交付第一段有边界的 Stage 3 路径。带版本的 `heartbeat_followup_cli.ts` 从生成的 ACK/failure hint 接收有大小上限的 compact host