feat(workspace): show analyzer effectiveness with source-bound evidence

[loopx-agent]

Goal and delivered outcome / 必要性

A Goal owner should be able to inspect the analyzer's six separate judgments, native measurements, costs and original evidence without leaving the research workspace. Browsing a different registered source must never show the previous source's result or dispatch analysis.

This proposal includes the already merged child #6705. The follow-up reconciles the analysis branch with current main and repairs a reproduced browser-history identity defect. It is not a new research controller, default prompt, scoring system or checkpoint runner.

Before → after: browser Back selected source A in the URL/selector while delayed or failed A reads left B's judgments visible → selector changes and Back/Forward use one source transition, clear unrelated readback immediately, report an unavailable source truthfully, and retry that same source. Same-pack refresh may still preserve its last verified readback with a warning. The owner supplies no new identifiers, configuration or confirmation; no additional mandatory interaction round is introduced.

Exact source and conflict resolution

• Target: main, synchronized through 72b4093cf75a75beacdab3f66bc842a21a356400.
• Proposed head: 0cc597daea071307b5c17fa1312566b09710a468.
• Previous analysis head: 0eb81926052e9726a5f93a52a55e40367c2a0fc4, the merge of feat(research): read native outcomes and costs from bound evidence #6705 into this branch. Its child commits are retained.
• Three conflicts were resolved explicitly: keep both native-outcome and canonical-digest imports; keep analysis browser coverage together with pathname-only status routing; retain UTF-8, native-result and usage tests, with the native citation expectation matching the same retained Unicode evidence.
• The final main update contains fix(benchmark): enforce shared deadlines within Docker archives #6714's archive changes. Its merge is clean and changes no analysis/HTTP/UI/packaging input relative to tested c8d6df42be6fb27066e6b7de5fc3b967f2c0f950; original validation sources remain identified below. No unrelated open PR was imported.

The existing #6683 usage producer is already part of this analysis proposal. Its separate PR should be reconciled by content, not automatically closed or independently approved by this submission. This update does not import #6624's disputed kernel-prompt changes or the broader #6713 research combination.

Implementation and authority

• Six model judgments remain separate and explicitly uncalibrated: goal alignment, benefit testing, discrimination, information gain, evidence adoption and avoidable repetition. Unknowns remain in the eligible denominator; zero eligibility is N/A. No total score or inferred native gain.
• The feat(research): read native outcomes and costs from bound evidence #6705 native source disclosure retains distinct initial, best-valid, provider-retained and final-valid measurements, exact scope/citation binding, strict real-calendar UTC parsing and historical-source warnings. This is fixed-capture readback, not a complete native gain curve or study countability decision.
• Solver counters and the current analysis attempt retain separate measured windows. Cache is a subset of input, not an additional charge; missing measurements are not zero, and no whole-study monetary bill is inferred.
• useResearchAnalysis.applyLocation is the single existing UI source-transition seam used by selection and popstate. It invalidates pending read/action generations and citation state before replacing source identity. Late responses cannot restore the discarded source. Goal changes also clear pending cancellation state. There is no second stored-state owner.
• A failed cross-pack read renders unavailable, not an indefinite loading message or another source's values. The selector remains usable and retry remains read-only.
• The existing TypeScript benchmark-toolkit reducers own validity/identity/interpretation. Python remains the loopback HTTP and contained-file/process adapter; registration stays trusted-provider/Agent-only. The browser supplies registered Goal/pack/key identities, not model settings, commands or source paths.

The only inherited transport vocabulary addition is benchmark.trajectory.codex-usage in the existing bounded private-snapshot allowlist. Main's artifact and settlement opt-ins are preserved on both sides. Ordinary request and private-snapshot caps, source checks, admission, cancellation and receipt owners are unchanged. Future-facing work was bounded to the shared navigation seam and existing digest/captured-view owners, not another framework.

Validation / 验证

Inputs are synthetic/public-safe; no paid model, live Goal, benchmark run, deployment or upgrade is used as a fixture.

• Decisive counterfactual: the same packaged Back-to-A sequence failed before the source-transition repair: one B metric group remained visible while A's request was held. With the repair it passes delayed read, HTTP503, no borrowed judgment/cost/scope, truthful failure, retry, Forward, source races, original citations, keyboard and 390px. A first follow-up assertion incorrectly matched hidden option labels as displayed source content; it was narrowed to the actual scope element, keeping the original metric/source identity assertions.
• Packaged research-history: final full scenario passed in 26.549 seconds with zero analysis POSTs and zero Agent Turns. It also covers native citations before any model result, six judgments, unknown/N/A, partial/history warnings, refresh, pagination and scope recovery. One new statement fixes the nominal mobile screenshot to actually use a 390px viewport.
• Actual backend, final analysis source: 21 Python CLI/store/HTTP tests passed in 16.96 seconds: real files, deterministic disposable child, busy/cancel/fail/retry/reuse, unavailable/changed sources, Unicode, native citation before analysis and wrong Goal/origin/path/settings refusal. Scripted output does not qualify reasoning quality.
• Typed/native checks: 32 tests passed, zero skips, across assessment, native outcomes, measured usage and the digest single-owner guard. Configured control-plane and Dashboard typechecks, CSS-token checks, Ruff, Node syntax and bilingual/diff checks pass.
• Composition and shared regression: packaged goal-showcase passed in 7.924 seconds and configuration-backup in 10.698 seconds. Whole viewport and recovery screenshots were inspected; no new layout, hero, CTA or raw color was introduced.
• Build and installation: normal Chat build/source verification and normal wheel build pass. A fresh isolated wheel installation has byte-matched affected backend/TS sources. Installed-only CLI → actual HTTP → bound native citation → packaged-page readback passes without an analysis job; the standard installed current/retained/PWA asset verifier passes. This is a disposable installation, not installed-App adoption.
• Semantic/public boundary: changed-source advisory precedes the full semantic smoke, which passes while retaining its existing unresolved-coverage limits. All 31 changed public paths scan clean. No private trajectory, credential, raw evaluator material, local path or generated lockfile is committed.
• Final-head premerge (0cc597dae): all six direct and four selected checks pass, zero failures/skips/timeouts, against the exact 31-path committed scope. Overall exit remains 1 / manual_review_required for the benchmark-sensitive maintainer hold. Local passing commands do not replace required hosted CI, independent review or maintainer merge authority.

The analysis behavior above was qualified at c8d6df42b; final 0cc597dae changes only unrelated already-merged benchmark archive files. A Git diff verifies that analysis, UI, runtime package, docs and browser inputs are unchanged. The normal wheel and browser evidence are not relabeled as new executions on that main-only merge. Original review evidence on 5895f349 remains historical, not approval of this new head.

Visual evidence

Fresh packaged synthetic views from the qualified analysis source; these are test values, not benchmark findings. The six-judgment composition is unchanged; the new recovery view demonstrates that a failed A selection does not retain B's data.

390px analysis view.

Remaining boundary

This delivers the existing fixed-pack workspace reader and explicit analysis journey, including child #6705. Arbitrary-run automatic preparation, complete multi-hour V11/V12 coverage, independent assessor calibration, causal research benefit, threshold/gain-area cost and full-study billing remain separate. Native provider validity/retention and study countability remain with their original owners. No analysis result is automatically fed to the solver or allowed to create work, extend budgets or submit candidates.

Existing frontend and benchmark CLI share the toolkit owner; Lark interaction is unchanged. No merge, reviewer dismissal, release, installed-App upgrade or experiment launch is requested or claimed. Original proposal by loopx-agent; requested conflict/navigation follow-up by an OpenAI Codex model agent, exact serving variant not independently verified. Implemented against Goal workspace §5.11/V9/V11/V12 and the existing trajectory-assessment/source contract; all new commits have DCO.

[songoow]

补充：为什么需要分析入口，以及为什么不等于自动改进 solver

针对源码头 40bc8f79519862d83d7b1a681246817188e919fc 的产品背景说明，不替代当前评审或前端验收。

必要性在于：历史记录存在，不代表 Goal 用户能在工作空间判断分析基于什么、覆盖了哪些片段、有哪些反证和未知项。仅提供汇总次数或用量，无法回答“研究分析具体起了什么作用”。本 PR 将既有有范围、有版本和引用的分析带到 Goal research，并保留原始来源读取与失败/重试/取消，让结论可以被检查，而不是只展示一个看起来较好的总分。

为什么采用显式运行、复用既有分析/store owner：分析本身有成本且会产生判断；打开、刷新、切换来源和读引用应保持不自动调用模型。用户请求深度分析与浏览历史是不同权限/成本动作。前端不应取得任意路径、shell 或模型设置，也不能把分析器判断伪装成原生评测事实。当前正文中六类有效性判断的呈现改进仍是原有后续项，本补充不宣称已完成。

与 #6702 的边界尤其重要：本 PR 是用户查看/请求分析的入口；#6702 是在线 replan 对已声明 Todo 的普通结果引用投递。两者互补，但不是同一数据注入链，也不自动把事后分析写回 solver。#6624/#6698 的运行或恢复准备则属于更前面的可靠性边界，不证明分析已经改变决策。

检验“有具体作用”还需要把来源、上次决定、实际实验、下一轮引用/取舍和后续评测对应起来，并区分信息增益、已发生的分数改善和后续新增收益。现有 HTTP/打包浏览器测试证明交互、范围、引用及零浏览调用；合成输出不能证明真实判断准确，实际只读来源也不能证明因果收益。本文不新增自动分析、自动采用、付费运行或科学效果结论。

[loopx-agent]

Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; reasoning_effort=max

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

HEAD: 5895f3491a53e007102f9753f591c7a000c184ab

动机

受影响的是在 Goal 工作台判断研究分析具体作用、并核对原始依据的用户。此前工作台只能浏览研究历史，无法在原处读取分析器六项效果判断、触发有范围的分析或返回引用原文；只看成本也不能回答研究是否检验了收益。本提交把现有六项判断放在主位，显示是/适用、否和未知；一次展开可读片段、理由与原文，并通过既有 owner 显式执行、取消、重试及复用分析。过程判断不等于原生收益或成功率，不合成总分；浏览不启动模型，也不写回 solver、评分或 Explore 事实。剩余缺口是任意运行的自动准备、原生收益曲线、独立科学校准、完整 V11/V12 与实际安装；本次只资格化已注册固定范围的产品消费路径。

规格依据：docs/architecture/rfcs/goal-workspace-surface-v0.md，不可变版本 fdf03ec6112aedf497b7ab1d6e5bc4db19c2ae5f。逐项核对：5.11：Consume the same versioned analysis with source/window/method/coverage, explicit action and effect-free browsing.（implemented）；V9：Opening, refresh, selection and evidence navigation cause no execution effect.（implemented）；V11：Full real multi-hour history with all required edge cases and authorized sources.（deferred）；V12：Complete shared deep-analysis journey and separate product/evaluator qualification.（deferred）。补充沿同版本的 docs/reference/trajectory-assessment.md 核对原有字段、来源及权限边界，未用本 PR 改写后的说明证明自身。

改动思路

架构判断是复用 benchmark-toolkit 的登记、分析 key、排他进程、资格化和引用 owner，Python 只适配本机 HTTP/文件，TS 拥有规则与用量归约。当前 PR 边界完整交付已注册包的一次显式分析与有依据的阅读，不另造 scorer、调度器、预算或图状态 owner；全运行准备和科学校准留在原有研究验收中。

触发	可读结果	效果边界
打开/刷新/切换范围	当前或带警告的历史判断	不调用分析器
一次显式分析	原 owner 执行或复用，允许取消/失败后重试	不改 solver、分数或事实图
展开指标并读引用	片段、解释和原始行	引用存在不代表解释正确

具体改动

useResearchAnalysis 组合 registered-source GET、显式 execute/cancel、独立读序号和 source generation；默认包已显示时保留身份，引用不因导航误清空。ResearchProgress 复用 TRAJECTORY_METRICS 及共享标签/引用 reader，将六项 producer 数值直接放主位；未知仍在分母、空 eligibility 显示 N/A、无分析包明确无判断。收益检验 yes 不保证正收益，redundancy yes 明确表示问题；成本默认折叠。

ResearchAnalysisRequestMixin 只接收登记的 Goal/pack/key，复用 registry、loopback/Origin 和原 store/process；未提供 renderer 任意路径、模型或命令入口。完整接入本 PR 所含 #6683 用量 producer 与 #6690 导航修正：Python 只读取授权来源的计数/生命周期，summarizeTrajectoryCodexUsage 校验完整单会话、累计计数差分及未知/缺失/重置边界，独立于接收活动半会话的 quota ledger；两端仅为该方法启用有界 snapshot 传输。最终头另外将 parseTrajectoryInput 的摘要匹配改用已有 BARE_SHA256_PATTERN，保留检测器和 allowlist，加入输入接受集/错误兼容负例。两份 RFC、参考文档、合成图片及耐久测试一并核对。

对主干的风险

没有发现当前范围的阻塞问题。15 项完整 Python 检查、26 项 TS 检查均通过且0 skip；包含真实 HTTP/store、实际合成子进程的 busy/cancel/fail/retry/reuse、来源变更后的历史引用及跨 Goal/Origin/输入限制。最终源头标准 canary 6 direct +19 selected 全通过，保留1项 benchmark manual hold；TypeScript/CSS、Ruff、DCO、双语、先 advisory 再完整 semantic、当前 bundle 构建及来源核验通过。

同一独立注册/读取 harness 在基线与最终头得到逐字段完全相同的 optional-off registration/catalog/inspection，且无模型 receipt 或来源写入。Ego 当前打包页面直接连接真实临时 HTTP/store 和确定性本地进程：打开0调用，一次显式请求后显示六项、benefit no、adoption unknown、redundancy yes；展开可读真实固定原文，切换未分析来源不借用结果，刷新与引用不新增分析 POST，390px 无整页溢出。合成 provider 只证明交互和规则执行，未证明模型准确。

494830a 之后的24条原有路径字节未变；新加的3条摘要 owner/测试路径全读，最终头重新执行后端、TS、语义、canary 和 bundle。基线既有摘要重复定义的16 pass/1 fail 已在本头的完整 owner suite 消除，未放宽断言。公开描述保留旧评论是旧版本解释，并未冒充当前验证。全运行自动准备、原生收益/成本比较、独立校准、完整 V11/V12、Lark 新交互与安装采用仍未资格化。

我的整体评价

APPROVE 此注册固定范围的可用消费者切片。收益是用户可在原处核对作用、否定与不确定性，并执行/恢复同一 owner 的分析，而非增加好看的成本卡。未来重构检查已应用共享标签/引用和摘要 owner，刻意保留完整捕获诊断与活动 quota booking 的不同资格与副作用边界；不要求无关大迁移。上述父级缺口与 benchmark manual hold 保留，批准不等于已合并、可绕过门禁或已安装。

English verdict: APPROVE - HEAD 5895f34; Source-bound six-metric consumer, explicit effect isolation and original-citation readback verified;15 Python/26 TypeScript checks and packaged real-owner journey pass. Scientific, full-run and installed qualification remain separate.

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @loopx-agent.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[loopx-agent]

Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; reasoning_effort=max

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

HEAD: 0cc597daea071307b5c17fa1312566b09710a468

动机

受影响的是在 Goal 工作台判断分析器具体作用、核对原始依据和原生测量的用户。此前历史浏览不能在原处回答六项效果问题，也不能区分首次提交、窗口内最佳、实际保留和最后有效结果。当前提交沿同一已登记证据包展示六项独立判断，按需展开原生数值及引用，并通过既有 owner 显式执行、取消、失败重试和结果复用。

这是固定授权范围的产品消费者增量。完整多小时 V11/V12、任意运行自动准备、阈值成本/增益面积、完整研究账单、独立科学校准和安装采用仍未关闭；不修改 solver、评分、Explore 事实或 Lark 执行权限，不把模型判断、token 或 provider 自报有效性当作科研收益。

依据 docs/architecture/rfcs/goal-workspace-surface-v0.md 的不可变版本 72b4093cf75a75beacdab3f66bc842a21a356400，在差异前阅读：5.11 的同源/version/coverage 和显式分析由既有 owner 接入；V9 的打开、刷新、选择和证据阅读不执行分析已验证；V11 的完整真实多小时覆盖与 V12 的完整共享深度分析/独立校准继续 deferred。补充沿同版本 docs/reference/trajectory-assessment.md 核对来源、未知和独立成本边界；本 PR 对两份 RFC 的更新是交付说明，不能倒过来代替原规格。

改动思路

现有 benchmark-toolkit 拥有登记、分析 key、资格化、排他进程、来源和引用；React 格式化投影与保存阅读位置，Python 只适配本机 HTTP/文件。原生测量走既有 typed prepare owner 的可选分支，不另造 scorer、图状态、调度器或手工同步 authority。

当前 PR 边界完整交付已登记固定包的一次显式分析和有原文的结果阅读，新增原生结果仍是同源捕获内的事实读回。已知信息由 host 准备，普通读者不用复制路径或设置模型；已有结果可直接阅读，浏览0额外执行。四种测量和本次分析尝试成本分别显示，不能从“最佳”推断“已保留”，也不把延迟反馈当作更新的提交。

具体改动

完整31路径、+1996/-36已按生产、文档/合成图片和验证分类。上次公开评审为 5895f3491a53e007102f9753f591c7a000c184ab；中间0eb的评审在发布前因head变化作废。当前与0eb相较16路径不变，另外15路径及新主干相关调用者重新检查，并重读当前完整PR差异；旧批准不继承。

• useResearchAnalysis 用独立读取序号/来源 generation 防止旧请求覆盖新范围，显式 POST 后读回原 owner。新增局部 applyLocation 让选择器和浏览器popstate共用同一来源切换，先失效旧读取/引用/动作标记，再显示新范围；读失败不借用另一包。原文区在有无模型结果时都可到达，关闭/刷新/引用不重跑。
• ResearchProgress 复用六项 vocabulary、说明和引用 reader；未知仍在分母，0 eligibility 为 N/A，无益重复的 yes 明确是问题。来源 disclosure 分别展示四种 native 值；成本 disclosure 只列当前分析尝试，不盲目与求解窗口相加。
• projectTrajectoryNativeOutcomes 精确匹配所有 scope 字段，验证真实 UTC 日期、提交序号/窗口、有效性和有界引用；按明确方向选 best，retained 只能取 provider 指定的有效记录，final 依提交序号。部分前缀和无效第一条保留 unknown。
• register_pack、_captured_view 与 read_citation 复用包含路径/摘要/历史 owner，native provenance 改变 pack ID 而不更改相同分析 key；仅已绑定的四类 native 引用可在尚无模型结果时读取。ResearchAnalysisRequestMixin 复用 Goal、loopback/Origin 和 opaque ID 限制，不接收任意路径、shell、模型设置。

其余完整差异包括既有 #6683 用量 producer、受限 snapshot 方法、已合入主干的 canonical SHA matcher 复用、Chat dispatch、主位六指标/窄屏样式、双语 RFC、参考说明和6张合成截图。没有改变实验 oracle 或来源权限。

对主干的风险

未发现当前固定范围的阻塞代码问题。本轮21项完整相关 Python producer/store/真实 HTTP/合成进程检查、32项 TS（usage、assessment、digest owner 和 native outcomes）通过，0 skip；control-plane typecheck、当前完整打包、Ruff、双语和完整语义检查通过。

当前打包页面通过 Ego 连接真实临时 HTTP/store，状态导航为合成夹具，分析进程是明确替代的本地可执行文件，没有调用模型。独立三提交输入的首次/最佳/保留/最后值为 7/3/7/5，第二条反馈更晚也没有把它当最后提交；无模型结果时即可打开对应原文，Escape 返回触发处，桌面及390px原文可读且页面无横向溢出。把来源第一值改为70后仍显示原捕获7并提示历史，恢复原字节后回到 current；切到未分析包不借用六项判断。

本轮另对新head的浏览器历史恢复作配对反例：相同真实HTTP/store数据、相同故障注入下，旧0eb打包前端从B返回不可读的A，仍显示B的6项判断和范围；当前0cc清空判断/范围及无期限loading，选择器保持A并明确不可读。取消故障后“重试读取”恢复同一A，前进回B复用原结果。当前只有1个显式分析POST/1次合成进程，浏览、返回、恢复和前进不再执行分析。这个对照仅替换生产前端，后端统一为当前隔离HTTP/store，不冒充完整旧后端运行。390px失败态实际截图已目检。

中间0eb上已验证原生7/3/7/5、原文返回及历史恢复；当前复用其未变的typed native/counter与引用owner证据，并在新打包页面重验来源/恢复。中间夹具曾因转义错误产生一次失败，修正后为2POST/attempt2；它保留为私有夹具失败，不冒充新head缺陷或新head1POST结果。此前真实历史长窗口与竞态证据也只在相关路径字节核对的范围复用，不声称本轮全量重跑。

同一独立 harness 在本 PR 不可变基线与当前头的 optional-off 登记/发现/检查完整 JSON 相等。新的 wrong-scope、引用逃逸、非法日期、虚构保留、缺失/无效值和历史回放由当前真实入口/typed 检查覆盖；合法零与极小数不替换为 unknown。模型、原生捕获和用量各自的来源及窗口继续独立。

标准 premerge：6直接通过；19选择中18通过、1失败，另保留 benchmark-sensitive 人工 hold。失败为 catalog 临时仓库追加选择了不存在的维护性脚本；同一命令在不可变基线复现同一分支，相关 catalog/planner/runner/blob 未变。它是单独的既有验证限制，不是本次新增功能回归，也未被写成绿色合并 gate。13个贡献/手工整合提交 DCO 通过；另1个 GitHub 生成的双父 merge 已按仓库现行 DCO 规则核验精确 SHA、父节点、web-flow 和 valid signature，才采用该明确豁免。公开路径扫描通过；没有查询或等待 CI。

我的整体评价

APPROVE 此 justified_increment。用户可在原处核对作用、反证、未知与 provider 记录的原生结果，并沿同一 owner 执行和恢复分析。前瞻整理已复用指标标签/引用、contained-source、captured-view 和 canonical digest，并把选择器与浏览器历史的重复切换规则收敛为 applyLocation；typed prepare 的局部扩展比新增服务或第二套 score owner 更小。当前 PR 的注册固定范围边界可以独立审查和回退；完整 V11/V12、科学校准、安装采用及红色 canary/人工合并 hold 仍独立，不因本次批准关闭。

English verdict: APPROVE - HEAD 0cc597d; source-bound six-metric and native-outcome journey verified through packaged Ego plus real HTTP/store;21 Python/32 TS pass. Baseline catalog failure and benchmark manual hold remain, as do scientific/full-run/installed qualification limits.