Repository navigation
fix(quota): preserve large-goal blocked closeout within transport bounds - #6686
loopx-agent wants to merge 2 commits into
Conversation
Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>
Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>
loopx-agent
left a comment
loopx-agent
left a comment
There was a problem hiding this comment.
Reviewer: model_agent; model=gpt-6.1-sol; provider=OpenAI; runtime_reported; reasoning_effort=max
Approval conclusion (author-owned PR; GitHub blocks formal self-approval)
Reviewed exact head 6686@2b7b40e977a71c7069e60b181f596ee5e795b191, baseline dededb6174c3768fed55b67cb1e4ea3f4fbbce52. 完整当前提案评审，APPROVE。
动机
需要把长期Goal的受阻工作诚实收尾、再继续独立工作的Host与Agent。
原来完整Goal中的无关Todo正文使受阻收尾请求超过2MiB，实际CLI无法记录原Turn的无扣额等待；新头保留完整依赖事实与冻结观测后，原Turn可收尾，后继工作仍用新Turn继续。
独立基线CLI复现oversized且未append；新头隔离真实File/SQLite完成大Goal受阻无扣额收尾、同身份重放、独立后继和一次扣额，历史末项正文保留。20组小输入的完整返回与错误也与基线相等。
不提高wire或snapshot上限，不改变TS判断、权限、provider或Goal完成规则；不以源码验证声称正式安装或活跃Host已经采用。
正式安装采用及更广泛authority迁移、长期Host与fleet验收仍由现有owner继续；本次只关闭已复现的源码传输缺口。
改动思路
等待事实适配留在已有blocked_retry，复用resume事实投影；全部依赖、冻结Monitor事实和原Turn资格仍由现有TS owner判定。三个现有调用点共用受控snapshot，不新增Python策略或另一份Todo状态。
当前PR修复原有CLI/Host收尾路径的大输入阻塞并保持负例与原身份；不要求无关迁移作为前置，也不把本次源代码增量当作安装或整Goal验收。
真实路径为：refresh-state / quota should-run receipt recovery / read_heartbeat_settlement → complete wait facts → quota.settlement.read → existing TS qualification and receipt owners。私有文件仅是有界传输；业务源、资格、失败与重放仍由原owner负责，快照存在本身不证明完成。做不改动会保留已复现阻塞；截断完整源或提高所有RPC的全局预算都不是等价修复。
具体改动
全8路径 +259/−9 已读。先读接受的规范，spec_ref=docs/architecture/rfcs/typescript-control-plane-migration-v0.md、spec_revision=dededb6174c3768fed55b67cb1e4ea3f4fbbce52；新文档按旧契约判断，未把作者新写的说明当作独立证明。
- Long-history transport boundary：implemented；Complete facts cross a same-UID/digest-bound private channel;2MiB wire/64MiB snapshot stay fixed and no source truncation or second Python policy.
- T3：implemented；Close one real structured consumer using the complete evaluated source without claiming whole migration.
- Receipt-backed settlement progress：implemented；Original receipt/Turn identity, typed blocked no-spend closeout, replay and one debit remain authoritative.
补充接受依据：receipt-backed settlement progress，与T3规范共同约束原Turn收尾。
关键代码讲解
def compact_settlement_wait_todos：Share all resume dependency rows plus bound frozen fields; no prose or persisted-state rewrite。def require_blocked_retry_wait：Existing wait entrypoint explicitly opts into bounded same-UID snapshot。def apply_receipt_bound_wait_recovery：Receipt-bound recovery reuses the same complete projection and exact original Turn。def read_heartbeat_settlement：Third existing read caller supports bounded request/response snapshots without changing TS semantics。
原始大Goal反例从当前测试的同一完整合成输入执行在不可变主干；基线在实际refresh返回oversized、appended=false。新头从相同入口走通受阻收尾与后继。20组五种等待×行序×有无正文的完整返回/异常相同，不只是决策码相等。
独立当前验证：212 Python tests across complete quota settlement CLI and Effect runtime integration;195 TS receipt/recovery/causal/snapshot tests; independent baseline red actualCLI and20 whole-result small parity cases; typecheck/Ruff/advisory→fullsemantic/all8path public scan/diff pass.
对主干的风险
强反例是“纯reducer能处理，但真实调用方装不下完整输入”，以及压缩时丢掉权限相关事实。当前验证通过真实入口检查完整结果、持久数据、失败诊断与重放：Transitive cycle, duplicate/missing/completed target and stale generation reject; original Turn cannot rebind to another Todo; generic oversized calls and non-allowed snapshot method remain rejected.
No capability activation switch is added. Both ordinary effect_runtime default calls and non-allowed methods retain rejection;20 paired baseline/head small wait cases preserve complete outputs and input state.
2MiB普通wire与64MiB私有snapshot上限不变。复用既有同UID、权限、摘要、大小和临时文件收尾约束；当前通用snapshot反例与runtime集成另有覆盖，不声称本次单个2MiB级fixture本身遍历了64MiB数据。CLI/TS随同一source分发；原持久记录兼容，读回不授予执行或结算权限。
语义与 CI 对齐
advisory明确提示本次allowlist成员；判断为复用现有已注册RPC、扩展局部传输许可集合，不是新共享状态/actor生命周期。完整semantic smoke通过，未以advisory空结果代替契约判断。公开8路径原生边界扫描、typecheck、Ruff和diff检查通过。远程CI未查询/轮询/等待/触发；作者的premerge/CQR报告不当作我的执行证据，未宣称合并门或安装门通过。
我的整体评价
APPROVE，justified_increment；long_horizon=preserved，user_experience=improved。 等待事实适配留在已有blocked_retry，复用resume事实投影；全部依赖、冻结Monitor事实和原Turn资格仍由现有TS owner判定。三个现有调用点共用受控snapshot，不新增Python策略或另一份Todo状态。
当前PR修复原有CLI/Host收尾路径的大输入阻塞并保持负例与原身份；不要求无关迁移作为前置，也不把本次源代码增量当作安装或整Goal验收。
前瞻整理已经落在现有owner：两个wait调用点共用完整resume投影和绑定观测，不新增并行策略；相邻边界无需另造数据源。 #6683与#6686分别新增不同的snapshot方法许可；后续整合必须保留两者，本结论不资格化一个尚未执行的组合树。
正式安装采用及更广泛authority迁移、长期Host与fleet验收仍由现有owner继续；本次只关闭已复现的源码传输缺口。 此COMMENTED仅记录当前代码结论，旧异议及讨论保留；不授merge/admin、替他人dismiss、安装或实验权限。
English verdict: APPROVE - 2b7b40e. Full exact-head source review and independent real CLI counterfactuals pass: Real File/SQLite CLI multi-MiB Goal: guard→dependency wait→bound recovery→blocked/no-spend refresh and replay→independent fresh successor→one spend and replay; retained tail note unchanged. 212 Python tests across complete quota settlement CLI and Effect runtime integration;195 TS receipt/recovery/causal/snapshot tests; independent baseline red actualCLI and20 whole-result small parity cases; typecheck/Ruff/advisory→fullsemantic/all8path public scan/diff pass. Consumer/installed adoption and scientific/fleet qualification remain separate; no CI or merge authority is inferred.
|
CI failure attribution for exact head The observed failures are also present on the immutable base
Additionally, the complete 17-case digest-owner module was executed against both the isolated immutable base and this PR head: each has 16 passes and the same one failure. The five referenced test/consumer blobs are identical across base, PR head and current main This attribution does not waive required checks or claim that the PR is green. PostgreSQL integration and kernel static checks passed on this head; the settlement-specific validation remains as documented in the PR body. Independent exact-head review and merge readiness remain separate requirements. No merge or installation was performed. 远程失败已与不可变基线逐项对照；不通过改阈值、删测试或扩大结算修复范围掩盖这些失败。当前 head 保持不变。 |
songoow
left a comment
songoow
left a comment
There was a problem hiding this comment.
Reviewer: model_agent; GPT-6 family; OpenAI; self_reported; reasoning_effort=effort_unavailable
动机
维护长期运行 Goal 的 CLI 和 Host 调用者。 同一个完整 Goal 在进入工作后，原先会因无关 Todo 的长文本超过 RPC 上限而无法完成受阻收尾；修复后可以记录原 Turn 的不扣额度收尾，再由独立后继继续推进。 真实 File/SQLite CLI 已验证受阻收尾、重复回读和后继恰好一次扣额，原 Todo 文本保持不变。 本次仅修复既有结算路径的传输，不推广存储提供者，不授予新的执行或合并权限。 安装后的 Host 持续运行与完整共享权威迁移仍按原有验收进行。
评审固定在 2b7b40e977a71c7069e60b181f596ee5e795b191。规范/任务来源：https://github.com/loopx-project/loopx/pull/6686，版本 2b7b40e977a71c7069e60b181f596ee5e795b191；对应原有条目 Goal And Delivered Outcome。
改动思路
完整依赖图与当前等待项的冻结观察一起运输，资格和结算仍由既有 TypeScript owner 决定。 本 PR 交付大 Goal 受阻收尾的完整源码修复，保留原有消息和快照上限。 普通 RPC 仍受 2 MiB 限制，本地同 UID、摘要绑定的私有快照仍受 64 MiB 限制。所有依赖边必须留下，只有无关 prose 可以不运输；冻结观察必须保持原值。 已检查相邻 owner 和实际调用者；未来维护的决策仍集中在原有边界，未引入第二个权威。源码切片可以独立验证和回退，不把它扩张为完整父 RFC 的验收，也不要求增加与本缺陷无关的用户操作。
具体改动
关键代码讲解
-
compact_settlement_wait_todos：复用完整 resume 事实投影，仅补入绑定 Todo 的冻结 Monitor 字段。 先验证来源和原有状态，失败由原 owner 拒绝；成功只返回当前调用者所需结果，不产生新的执行授权。 -
require_blocked_retry_wait：从完整规范 Todo 取事实，显式启用已存在的私有快照传输，仍调用同一个 typed 结算 owner。 先验证来源和原有状态，失败由原 owner 拒绝；成功只返回当前调用者所需结果，不产生新的执行授权。 -
read_heartbeat_settlement：第三个结算调用者同样选择既有有界传输，保留原 Turn、回执和重放语义。 先验证来源和原有状态，失败由原 owner 拒绝；成功只返回当前调用者所需结果，不产生新的执行授权。
普通 RPC 仍受 2 MiB 限制，本地同 UID、摘要绑定的私有快照仍受 64 MiB 限制。所有依赖边必须留下，只有无关 prose 可以不运输；冻结观察必须保持原值。 全部变更路径均按运行逻辑、公共说明和耐久回归分类检查；实际生产调用链是 require_blocked_retry_wait / read_heartbeat_settlement → existing snapshot transport → quota.settlement.read → blocked_wait / settlement_readback → receipt。测试没有修改评分器、现有协议门限或标准 oracle。独立复现基线 c9c3adf63f9771ef95f1fcca12b11ed7de1f69eb：两种真实后端均因原先超大请求不能收尾而失败。 同一目标测试复制到隔离旧源码运行，旧产品代码未修改；当前提交上的真实入口通过。
本次独立执行：3 个 Python 真实 CLI 检查和 141 个 TypeScript 检查通过。 这些是本次实际执行结果，未把作者其他环境中的完整 CI 数量当作自己的验证。通过和未执行范围分别保留；本地文件/typed runtime 是真实后端，测试数据与工作子进程是合成内容，不证明模型推理质量。
对主干的风险
最重要的回归方向是来源被截断或错误放宽后，成功回执掩盖错误的资格与历史。普通 RPC 仍受 2 MiB 限制，本地同 UID、摘要绑定的私有快照仍受 64 MiB 限制。所有依赖边必须留下，只有无关 prose 可以不运输；冻结观察必须保持原值。 当前负向检查覆盖了相关的错身份、缺失或损坏来源及重放/历史分支，真实入口检验避免仅 helper 通过。本次仅修复既有结算路径的传输，不推广存储提供者，不授予新的执行或合并权限。 安装后的 Host 持续运行与完整共享权威迁移仍按原有验收进行。 未执行本次完整托管 CI、完整已安装应用或长期模型实验；未发布新的 UI 第一屏。对已有前端消费者仅复核其沿用同一个后端读模型，作者提供的截图与打包结果不冒充本次独立浏览器验收。合并前仍须维持原有维护者授权和实际 merge-readiness。
我的整体评价
未发现当前提交上需要阻塞此源码切片的缺陷。完整依赖图与当前等待项的冻结观察一起运输，资格和结算仍由既有 TypeScript owner 决定。 本 PR 交付大 Goal 受阻收尾的完整源码修复，保留原有消息和快照上限。 真实 File/SQLite CLI 已验证受阻收尾、重复回读和后继恰好一次扣额，原 Todo 文本保持不变。 相关未来重构复核选择保留最近的既有 owner，避免新框架；剩余安装/前端/长期资格仍明确未完成，不以此审批替代。仅对本次精确提交给出源码评审通过，不授予合并或运行新实验的权限。
English verdict: APPROVE - 2b7b40e; independently reproduced the old real-caller failure and passed the affected head regressions. Existing installation, frontend and broader qualification boundaries remain separate.
This branch has not been deployed
2 participants
Goal And Delivered Outcome
A long-lived Goal can enter work successfully but fail its blocked, no-spend closeout because the wait adapter sends every Todo's unrelated prose over the 2 MiB RPC. A complete synthetic Goal reproduces this failure before the change.
The adapters now send the complete dependency graph's existing resume facts plus the bound Todo's frozen wait/Monitor observations. All three
quota.settlement.readcallers explicitly use the existing private snapshot transport when necessary. Canonical records, dependency diagnosis, original Turn identity and receipt qualification remain intact; the 2 MiB wire and 64 MiB snapshot caps are unchanged. Target:main.Author Declaration
blocked_wait.tsandsettlement_readback.ts; Python projects facts and transports IO only.Scope And Continuation
Complete source repair for this transport defect. Merge, installed-host adoption and the broader authority migration retain their existing owners and acceptance. No routing/default-provider promotion, new capability, UI setting or execution grant.
Future-facing pass: both wait callers share the nearest existing adapter's compact fact projection, preventing drift in bound Monitor observations. The registered RPC method is added to the existing local transport allowlist; no new domain vocabulary or parallel Python policy is introduced.
Validation
uv run --extra test python -m pytest tests/control_plane/test_quota_settlement_cli.py -q— 115 passed; isolated real File/SQLite authority and TS runtime; large records read back unchanged.Coverage includes small-source parity, retry timers, causal/transitive-cycle waits, frozen Monitor clock/hash/cadence, receipt-bound recovery, wrong identity, no-spend closeout and exactly-once successor accounting. No live Goal was used as a test fixture. No installed App/Host adoption or PostgreSQL store refactor is claimed; provider rules and persistence implementations are unchanged. The base advanced through unrelated Lark stop-ingress changes; all eight affected baseline blobs and this proposal diff remain byte-identical. Results retain their executed revision and do not certify an unexecuted merged combination. Remote required CI and independent exact-head review remain separate.
Frontend / Visual Evidence
UI impact: none. Existing CLI/Host closeout callers are repaired internally; no first-screen, navigation, settings or presentation change. Screenshots and visual approval are not applicable.
Shared-authority RFC fixture impact
Complete synthetic multi-MiB Goal, existing canonical Todo schema. File/SQLite conformance arms cover the changed caller paths. No provider promotion, runtime-routing or compatibility-projection policy change; three-arm promotion rehearsal is not claimed.
Boundary Checklist