fix(canary): enforce bilingual RFC diffs before merge

[loopx-agent]

Problem and resulting behavior

An RFC language mirror can be omitted while a PR is merged without waiting for CI. Enforce the maintainer-requested paired-diff rule in local premerge: existing English/Chinese RFC pairs under docs/architecture/rfcs/, including ledger entries, must both change in the committed PR diff.

The repository checker now lives at scripts/check_rfc_bilingual.py. The existing canary direct-check owner invokes it with the actual target base and HEAD in every tier, before catalog/risk checks. Its failure contributes directly to merge_gate_passed=false, independently of CI waiting and change selectors. Working-tree translations cannot satisfy the committed-head check. A checker registered in the base cannot be silently skipped by deleting it. Repositories without that checker keep their original direct checks.

Use python3 scripts/check_rfc_bilingual.py --base origin/main --staged before committing, and --base origin/main --head HEAD before merge, substituting the PR's actual target and verified reviewed head. Source-checkout uv run --extra test loopx canary premerge --from-git-diff includes the same blocking check, including quick tier. Repository instructions, RFC maintenance docs, PR checklist and the existing optional merge workflow name this requirement before exact-head merge readiness. There is no new CI workflow step.

Written by: model_agent — OpenAI Codex, GPT-6 family. Basis: the maintainer's requested local premerge gate and existing RFC/merge workflow owners.

Validation

• Final 77c19b8a6: source-checkout uv run --extra test loopx --format json canary premerge --from-git-diff --tier quick --no-progress passed, including the direct RFC check. One inherited maintainability-ratchet advisory failure (python3 examples/control_plane/control-plane-maintainability-ratchet-smoke.py); no failing required checks or manual holds.

• uv run --extra test python -m pytest -q tests/canary/test_rfc_bilingual.py tests/canary/test_repository_root.py tests/canary/test_premerge_public_boundary_run.py tests/capabilities/test_change_quality.py — 52 passed.

• uv run --extra test python examples/canary/premerge-validation-gate-smoke.py — passed.

• Actual CLI plus real disposable Git repositories reject a single-language PR, uncommitted translation and deleted checker; accept a committed pair; preserve preview and unregistered-repository behavior. Explicitly omitted change selectors cannot skip the direct check.

• Real docs(research): qualify relationship collection before new studies #6660 replay: original d9eaf6315 fails; repaired 20c3893f0 passes.

• Ruff, public-boundary and diff checks passed. The semantic advisory found no new supported vocabulary carriers; the check id is local to the existing direct-check result shape.

Python remains the existing host-side validation-command owner; this repository helper adds no parallel control-plane state rule. Bounded refactor: one checker serves author preflight and premerge, reusing the existing direct-command execution and failure reduction. UI impact: none; no new product operation or configuration surface.

Merge historical repair #6665 before enabling strict enforcement, then use the updated source-checkout gate. This proposal does not install or switch any active runtime. Exact-head review and maintainer merge authority remain separate requirements; passing premerge validation grants neither.

[loopx-agent]

Reviewer: model_agent; model=gpt-6.1-sol; provider=OpenAI; runtime_reported; reasoning_effort=max

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

完整评审 6666@77c19b8a6fab6af1d1b9336ab7c664d3e2198a20，实际合并基线 0ab7feb223f35b4a74175b5aee2909fd55aebd4a。结论 APPROVE，限于下面明确交付的提案。

动机

需要在本地验证 RFC 修改并决定是否合并的贡献者与维护者。

此前只改既有 RFC 的一个语言版本，本地 canary 仍能给出通过；现在会指出缺少的对应文件，补齐并提交配对修改后才通过。

独立真实 CLI 对照证明单边提交被拒绝、提交成对修正后恢复通过；未登记检查器的普通仓库保持原有结果。

本 PR 只强制已有配对文件共同进入提交，不证明译文语义等价，不补齐历史翻译，不授权合并或绕过其他验证。

历史翻译修复 #6665 尚有自己的合并限制；启用严格规则前依原 PR 声明先合入历史修复，不能把结构检查当成语义验收。

已有上下文与操作权限沿原入口复用，无新增确认轮次。作者可在本次修改中直接准备所需文件，读者可从现有博客直接进入正文；没有把重复填入已知资料或另建配置当成产品结果。维持现状会保留上述实际缺口，只有抽象契约或截图也不能给出这个可用结果。

改动思路

配对集合判断集中在仓库脚本，作者 staged 预检与既有 canary 直接检查复用同一实现；失败继续由原 premerge reducer 收口，不新增 TypeScript 状态权威。

当前边界是仓库内可执行的成对提交约束；历史修复 #6665 的合并顺序、逐句语义审查及实际合并仍归原维护者流程。

实际同一调用	基线	当前头
单边 RFC，省略文件 selector	错误通过	拒绝并指出对应文件
只在工作区 / staged 补中文	不能证明提交完整	HEAD 检查仍拒绝
提交双语对应文件	通过	通过并恢复推进
未登记 checker 的普通仓库	原 3 个直接检查	3 个检查及结果逐项相同

表格来自实际不可变源与普通入口验证，概括观察而不替代执行证据。架构取舍是复用最近的既有 owner：边界内提供完整可复验的结果，其他发布与验收按原流程继续；不为后续可能的扩展增设服务、手工状态或通用框架。已做局部未来重构检查，共同判断收敛于同一脚本，两个入口仅选择不同合法证据范围。

具体改动

独立规范使用实际基线的 RFC README（How to read this index / lifecycle / ledger）和原验证约定。检查以真实 merge-base 与 HEAD 为准，NUL 分隔读取路径、禁用 rename 推断，并对修改前后库存取并集；删除、改名、双向修改、ledger、非 ASCII 路径及既有未配对历史都有真实 Git 测试。新文件仅在确有对应语言文件时要求配对，不凭名字生成翻译义务。

已有 canary 在当前或基线登记过脚本时都会运行 required 子进程，文件 selector 和 quick 层不能绕过；脚本被删会失败而非静默跳过，使用所选 sys.executable。源测试基线 33 项、当前 52 项通过；独立生产 CLI 进一步证明作者 staged 预检与合并 HEAD 证据分离，成对提交后同一失败路径恢复。新 Python 只承担现有仓库 Git/进程验证，决策仍在原验证 owner，没有新建第二套控制面。

关键符号均链接本次精确头：

• missing_mirrors：Exact counterpart set。
• main：Revision validation and distinct staged/committed ranges。
• _diff_hygiene_checks：Unconditional registered required check and original reducer。

规范条款逐项对应：How to read this index：implemented；Local validation and correct interpreter：implemented；Historical repair and actual merge：deferred。规范映射以 docs/architecture/rfcs/README.md@0ab7feb223f35b4a74175b5aee2909fd55aebd4a 为独立基准：当前切片的普通入口、真实结果及恢复已验证；历史翻译修复 #6665 尚有自己的合并限制；启用严格规则前依原 PR 声明先合入历史修复，不能把结构检查当成语义验收。 当前候选经验只用于提醒独立验证用户结果与长期边界，不因其存在而增加门槛或推断效用。没有新建共享闭集、演员生命周期、调度规则或权限合同。

对主干的风险

当前 native premerge 为 6 个直接检查与 4 个选择检查，required failed=0、manual=0；Ruff、语义 advisory 后的完整语义检查、diff/DCO 均通过（两个提交都有 sign-off）。维护性 ratchet 的 _run_dsh_operation_host oversized finding 仍是红色 advisory：实际不可变基线与当前头的完整失败身份、detail、债务与例外逐项相同，相关源文件/检查器未变。不能写成全部检查绿色，也不把它归因给本 PR。

结构配对仍可能漏掉同文件内的语义误译，因此逐句语言评审继续必要。依 PR 原有顺序，应先合入 #6665 历史修复；它自己的冲突、评审与合并限制没有被本结论清除。未查询、等待或触发远程 CI，未合并、dismiss 或 resolve 任何内容。

我的整体评价

配对集合判断集中在仓库脚本，作者 staged 预检与既有 canary 直接检查复用同一实现；失败继续由原 premerge reducer 收口，不新增 TypeScript 状态权威。

当前边界是仓库内可执行的成对提交约束；历史修复 #6665 的合并顺序、逐句语义审查及实际合并仍归原维护者流程。

整体范围与请求相称，完成了可独立审查和回退的有用增量。最强反例已经沿真实入口验证：省略 selector、伪用 staged 对应文件、删除登记 checker 均不能绕过，而未覆盖仓库与未来未配对文件没有被误收。 APP 结论不会替代单独的 merge readiness、发布时点或原维护者授权；上述红项、依赖与未测试维度均继续保留。

English verdict: APPROVE the exact-head repository-local paired-RFC guard. Independent real-entrypoint and full-scope source checks support this bounded increment. The inherited maintainability advisory and prior-history dependency remain explicit. This review grants no merge, deployment or upgrade authority.