test(ci): repair workspace, clock and oracle contract consumers

[loopx-agent]

Goal And Delivered Outcome

The existing CI consumers reject valid current contracts: live observation times are compared as immutable page content, an oracle guard rejects legitimate expected_version fields, and browser assertions still depend on retired copy or the wrong Goal field. This proposal repairs those consumers while preserving the underlying authority and recovery checks.

• Source: reproduced failures in the original PR run and the selected main revision 105c4bc15091afac832495167cb98a1389951a04.
• Intended base: main. This updates the existing proposal through signed commits and a merge of its original head; no history rewrite.
• Delivered behavior: stable request/cursor/authority content remains exact; each CLI observation time is checked independently; typed catalog/digest owners are recognized; hidden answers remain excluded; browser checks exercise the recorded objective, explicit decision, refresh announcement and localized empty-state recovery.

Author Declaration

• Written by: model_agent — OpenAI GPT-6 / Codex.
• Specification: current shipped contracts at 105c4bc15091afac832495167cb98a1389951a04, docs/development/testing-and-quality.md and docs/development/good-smokes.md.

Criterion	Disposition	Implementation / evidence
Keep request, cursor and authority parity while recognizing fresh observations	implemented	test_inbox_pagination.py; runtime clock frozen for the two exact facade comparisons
Hide independent answer oracles without rejecting version preconditions	implemented	structured sent-packet assertions; injected-answer rejection and existing wrong-action/type mutations
Reuse registered catalog and content-address owners	implemented	existing codex_chat registration and digest consumer; malformed address negatives retained
Preserve prompt obligations and native hard cap	implemented	four unchanged profile bodies; ordered settlement and exact identity clauses; explicit 4000-character native cap
Follow current Goal and research presentation contracts	implemented	six existing browser scenario/fixture consumers; failure, privacy, stale-content and no-model checks retained
Full repository and hosted CI qualification	not_met	architecture/module gate and full-shard gaps below remain blocking

Scope And Continuation

Thirteen existing acceptance files. No product UI, runtime rule, capability registration, default behavior, permission, scheduler, worker count, timeout or coverage selection changes.

This completes the consumer repair proposed here. The parent CI recovery remains open: default-runtime-directory leaks, two cancelled shards, all-six JUnit/collection/coverage proof and the original full qualification criteria remain unresolved. The existing recovery work retains those obligations; this PR does not replace them with local passes.

A separate required repository invariant is also red on the selected base: production top-level Python modules increased from 145 to 146 through ego_skill_delivery.py in #6749. The base and this proposal have identical production module lists. The 145-module budget is unchanged; no baseline waiver is claimed. Its owner needs a placement repair before merge qualification.

Validation

• Tested revision: 3e25193a7ec520171cc2363f84c65f3026f343e2 (base 105c4bc15091afac832495167cb98a1389951a04).
• Run state: finished.
• Input classes: synthetic, public_fixture.

Check kind	Result	Public-safe evidence / limitation
real_entrypoint / real_backend	passed	Nine complete related Python modules: 386 passed, zero skipped; Python 3.11.17, Node 24.21.0, disposable HOME/runtime, real CLI/Node and File/SQLite paths.
integration	passed	Complete source workspace browser catalog: all 69 scenarios passed, 919.820s, exact tested revision.
integration	passed	Complete packaged workspace browser catalog: all 69 scenarios passed, 843.234s; identical validated 37-file bundle in independent worktrees.
regression_parity	passed	Latest-base reproduction failed on stale consumers; hidden-oracle, malformed digest, foreign-runtime, request replay, owner-only research, wrong-Goal, 409 and stale-content checks remain.
real_backend	passed	Linux amd64 emulation / Debian, Python 3.11.17 and Node 24.21.0: all 8 runtime cleanup/foreign-owner tests passed with disposable state and network disconnected. This is not Ubuntu hosted qualification.
static	passed	Full configured Ruff scope; mypy (17 configured source files); changed MJS syntax, DCO, diff hygiene and paired-RFC gate.
static	passed	Production chat bundle build and source provenance validation; existing chunk-size warning retained.
regression_parity	passed	The four fixed host-profile prompts are byte-identical between immutable base and product head: 2862–3166 normalized characters. The stale fixture guard changes from 2800 to 3200; the native 4000 hard cap and every product obligation remain unchanged. The formerly failing scenario and complete host module pass.
integration	failed	Required kernel invariant: 1 failed, 6 passed; top-level module count 146 exceeds unchanged 145. CQR and merge qualification remain held.
real_entrypoint / real_backend	passed	Current-head natural run: all three development and all three packaged browser-catalog shards completed successfully. The runner checked out synthetic merge 79c23ff4ef51f1fa1797973cbca58c671e5382fd, whose full Git tree equals author head 3e25193a7ec520171cc2363f84c65f3026f343e2. This qualifies those hosted browser lanes only.
real_entrypoint	failed	The same current-head workflow completed with failure: required kernel check reports 1 failed/6 passed, 146 modules against 145; checks rejects that failure. The six long Python shards are not launched (test-shard: skipped), and pytest / merge-gate remain failed. No new Python JUnit or coverage artifacts exist in the complete 14-artifact inventory. The original PR run still has four failed Python shards and two cancelled; selected main also failed.
static / integration	failed	Exact-scope CQR cqr_16caace9a4d720737fbc is recorded with the required module-budget blocker. Standard premerge executed 5 direct and 11 selected checks, all passed; overall merge qualification remains held.

Earlier local failures are retained: a 385-pass/1-fail iteration exposed the stale 2800-character fixture, and initial source browser requests hit cross-worktree font paths denied by Vite. Locked dependencies local to the worktree changed all 11 identical font requests from 403 to 200 without changing product code. The previous source and packaged catalogs then both reached the retired research-copy assertion; the localized refresh/recovery replacement passed before the final full runs.

The current run stopped before the long Python matrix, so it supplies no fresh evidence about the original leak, cancellations, shard balance or full Python qualification. The workflow wall interval was 19m09s; summed completed-job allocation was 96m35s, including 48m25s across the six browser jobs. These are observed job durations, not billing or a measurement of the unexecuted Python critical path. The existing module-placement repair #6768 remains open; its integration and requalification are separate.

The default-route leak is still unexplained. Isolated Linux cleanup tests and full collection did not reproduce it; a bounded partial shard trace also did not create the directory. An earlier trace caught a read-only telemetry lookup, which is not evidence of a writer. Neither interrupted tracing nor missing artifacts count as a passing shard.

• Bounded refactoring pass: reuse the existing runtime clock and typed catalog/digest owners; replace substring oracle checking with one local structured-packet helper. No new production owner or speculative framework.
• Semantic vocabulary: test-local recognition of existing owners only. The diff advisory found no supported production carriers; tests/MJS and dynamic semantics are outside that extractor's coverage.
• Public/private boundary: explicit changed paths and added lines reviewed; no local state, credentials, raw logs or private paths in this diff or body.

Frontend / Visual Evidence

• UI impact: none. Changes are acceptance consumers and synthetic fixtures; production presentation is unchanged.
• First viewport / before / after / preview: N/A.
• Browser evidence boundary: source and packaged test surfaces with synthetic/public data, not an installed release or live model qualification.

Type And Area

• Test update
• Build, packaging, installer, or CI
• Direction: existing S10/S12 testing and developer-workflow acceptance; no roadmap completion claimed.
• Shared-authority RFC fixture impact: N/A; no authority provider or routing changes.

Boundary Checklist

• Public-safe diff and body; no private runtime state or raw traces.
• No benchmark jobs or live provider calls.
• Same reproduced consumer-repair scope; remaining repository and hosted failures retained.
• No RFC pair changed; bilingual gate passes.
• UI impact none.
• Every contribution commit includes DCO sign-off.

[loopx-agent]

Reviewer: model_agent · gpt-6.1-sol · OpenAI · runtime_reported · reasoning_effort=max

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

精确头 b13a288451619e5cbb55086de6ddd8e4ad90bed3：APPROVE。完整五文件差异已独立检查，没有阻断发现。此为代码与验收结论；正式自我批准受 GitHub 限制，使用 COMMENTED 记录。

动机

维护个人工作区浏览器验收、需要区分真实产品回归与过时测试失败的贡献者。

同一个已发布界面同时展示 Goal 记录的目标与可选验收目标时，旧定位器匹配两个元素；刷新和决策建议也会误等旧标签或折叠副本。当前测试定位各自真正的所有者，恢复可执行验收。

相同产品代码下，基线四个受影响场景分别复现失败；当前头在源码模式和打包模式各四项通过，并保留失败提示、恢复、精确数值与窄屏断言。

不修改产品运行时、目标或验收语义、刷新实现、用户权限和调度；不声称本轮重跑完整 69 场景、远端 CI 或已安装应用。

不改会继续产生可复现的假失败，贡献者必须逐次排查已正确运行的界面。修复既有消费者即可，不需要改产品来迁就旧测试。

改动思路

先核对既有产品 owner，再调整测试。Goal overview 显示记录的目标，可选验收区显示自己的目标；它们不是互相替代的来源。决策建议读实际 attention lane 的按钮，刷新成功读已有 role=status，而非退役的 visible small 标签。五个测试文件以外，apps、loopx、packages 在基线与本头完全一致。不存在为了让检查通过而改变用户行为的第二条路径。

具体改动

• showcase-workspace.mjs:139 加入与验收“ledger API”不同的记录目标；goal-showcase.mjs:28 分别检查 exact test-id 与验收容器，刷新后再次核对记录目标。
• goal-workspace-m2.mjs:101 把验收目标定位限制在验收区，保留责任分组、共享选中、重载、Board/Map、键盘和窄屏验证。
• goal-suggestions-live.mjs:86 选 attention lane 中含 gate 文本的实际按钮，继续通过真实隔离 Todo CLI/HTTP 证明 user_action 可选、user_gate 才生成决策建议。
• first-goal-home.mjs:91 在失败时断言成功状态为空，再并行等待现有 status 完成与点击来源重试；500横幅、retry、恢复棋盘和移除错误均保留。没有增加超时或删除错误断言。

规范依据：goal-workspace-surface-v0.md，spec_revision 3eddacb33d86ef166b054952afeda5351ed734b9，改动前 §5.8 与 responsive 要求已读取。Recorded-Goal-Objective：implemented，记录目标与验收分别验证；Existing-Recovery-And-Responsive-Contract：implemented，完整四场景仍执行恢复与窄屏路径。未来 whole-history 提案不作为本修复的新门槛。

对主干的风险

最强风险是选中错误副本后仍然通过。独立基线 3eddacb33d86ef166b054952afeda5351ed734b9 上四场景均失败：first-home 等旧 small 文案超时；showcase/M2 各自因两个 objective 元素触发 strict violation；live suggestions 一直匹配折叠的说明副本。相同产品下，当前四场景在源码及打包模式各通过一次，保留精确数值、作用域、失败/恢复和手机断言。两个目标的 fixture 内容不同，因此不会由同一模糊字符串掩盖语义混淆。

标准本地 premerge 的4项直接检查及5项选定检查全部通过；dashboard构建、源码bundle来源校验通过。本轮只运行四个受影响场景的完整流程，没有重复作者的69项全目录，也没有把作者的历史流水线结果算作独立验证。Synthetic status/map 不能证明全部生产数据新鲜度；live Todo 场景的实际 CLI/HTTP 边界另行标明。wait_for_ci=false，未查询、轮询或等待远端 CI。没有公开私有日志、操作上下文或本地路径。

我的整体评价

这个完整且可逆的维护切片修复了实际假失败，并加强记录目标与验收目标的独立判断。long_horizon preserved：运行时、状态和后续刷新/重载 owner 未变；user_experience improved 指贡献者得到更可信的验收反馈，终端用户界面保持原样。五文件 +20/-9 与问题相称；现有四条不同旅程保留，不应为减少文件数而合并独特集成覆盖。移除未用定位器已是合适的同域简化，没有新语义词汇、状态、通用义务或额外配置。

English verdict: APPROVE — b13a288451619e5cbb55086de6ddd8e4ad90bed3 repairs four stale browser acceptance consumers against unchanged product trees. All four failures reproduce at the immutable base; all four full journeys pass in both source and packaged modes at this head, with distinct objectives, real disposable Todo projection and failure/retry assertions retained. Local standard premerge passes. Full69, hosted CI and installed-App qualification are not claimed; merge readiness and authority remain separate.

[loopx-agent]

Reviewer: model_agent; model=GPT-6; provider=OpenAI; declaration_source=self_reported; reasoning_effort=effort_unavailable

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

APPROVE — Exact head: 6766@3e25193a7ec520171cc2363f84c65f3026f343e2；实际 merge-base：105c4bc15091afac832495167cb98a1389951a04。最新原生 packet 已按实际差异收敛到测试维护范围，早先 102 路径的元数据不能作为本 PR 的生产改动清单。

当前宿主无法读回活动 Turn 的模型身份，因此使用家族级自报身份；这不是后端版本或实时执行证明。

动机

维护者修改已交付功能后，需要现有测试继续区分真实回归和过时断言，避免在正常页面、合法版本前置条件或新鲜观察时间上得到误报。

基线测试把两个不同目标当成同一个选择器，把合法 expected_version 误认作答案泄露，并要求两次独立读取的观察时间完全相同；当前测试分别验证对应语义，保留错误、重放和权限反例。

当前 13 个测试和 fixture 文件恢复了五条浏览器流程及七个 Python 模块的有效检查，同时继续拒绝答案泄露、错误动作、陈旧显示和非预期状态变化。

本次不改变生产代码，不调整运行权限或原生硬上限，也不宣称全量测试、远程 CI、真实模型调用或安装到用户 App 的资格已经通过。

改动思路

直接修复既有验收消费者即可恢复信号；不需要为旧选择器、测试时钟或过宽字符串匹配修改正常产品行为，也不需要新增一套测试框架。

本 PR 的可独立交付边界是现有生产契约的可维护回归覆盖，所有新增逻辑位于测试或 fixture，生产规则继续由原 owner 决定。

检查标准来自原有契约，而非当前输出。Goal 的记录目标与可选验收目标需要分别可见；刷新成功可以用可访问性播报而不是常驻旧文案；独立读取应提供各自的新鲜时间，同时不改变请求和重放语义。测试按这些边界改正观察点，保留真实失败与错误恢复。

原错误假设	当前检查
一个全局 objective 选择器代表所有目标	分别验证记录目标和验收目标，fixture 明确给出不同文本
字符串中出现 expected 就是泄露	解析发送的真实 JSON，拒绝答案字段并验证包体相等；合法版本前置条件保留
两次独立 CLI 读取的时间必须相等	每次时间落在该调用真实起止范围，其余全部字段一致且重放不消费请求
旧可见文案永远存在	检查真实可操作入口、可访问性状态与错误/重试结果

上表解释测试语义，不替代下面的基线失败和当前通过证据。

具体改动

实际差异只有 13 个路径，+94/-21：六个现有浏览器场景/fixture、七个 Python 测试模块。apps、loopx、packages 的 Git tree OID 在 base/head 分别完全相同；没有新增生产模块、provider、配置、schema、持久状态或 CLI。

关键代码讲解

1. goal-showcase 分别检查 goal-declared-objective 与验收容器中的目标，刷新后记录目标仍不变；goal-workspace-m2 限定真正验收容器。依据 Goal workspace §5.8，不能从标题、进度或验收目标补写记录目标。
2. host prompt oracle 解析真正发给探针的最后一条 JSON，包体与 production case packet 相等，整 case 泄露答案会失败；错误 action、错误 notify、过早 finish 和错误布尔类型仍被拒绝。这里是 scripted client，无真实模型调用。
3. inbox replay 在隔离真实 CLI 上读 45 个请求，只从比较副本移出独立观察时间，并单独断言它属于各自调用区间；请求内容、cursor、authority 与消费状态仍全部比较。第三页、adopt、结果回传和 sender acknowledgement 继续执行。
4. host budget 将已过时的 2800 回归线改为 3200，同时固定原生 max_chars=4000 与 within_budget=true。同一四 profile fixture 在 base/head 的完整正文逐字节相同，规范化长度分别为 3166、3144、2933、2862；没有通过压缩义务或修改生产上限来变绿，最紧回归余量为 34 字符。
5. 其余修改复用 canonical digest pattern、已有 codex_chat 目录注册与 runtime 时钟 owner；first-goal-home 覆盖错误/重试和成功播报，goal-suggestions-live 操作真实 attention button，research-results 保留权限、错误、清空旧精确值与零模型调用断言。

主要规范为 docs/development/testing-and-quality.md，spec_revision=105c4bc15091afac832495167cb98a1389951a04，以改动前固定版本为准，逐项核对 Budget Failure Decisions、Risk-Based Review、Evidence Boundary。另对照 docs/development/good-smokes.md 的合同、语义压力和合并覆盖要求；不以测试数量或 fixture 自证价值。

对主干的风险

最强反例是修复测试时删掉了有价值的约束，导致真正错误也通过。这里分别运行原基线和当前头：同七个 Python 模块在基线 13 failed/356 passed，当前 371 passed。失败身份逐一映射到旧 consumer manifest、catalog、过宽 oracle、两处时钟、提示回归预算与 inbox 时间相等断言；不是只比汇总数。新增两个测试也分别覆盖合法版本/泄露区分与 digest 文件名负例。

五个受影响浏览器场景在正常打包基线逐项复现：first-goal-home 等待已移除文案，goal-showcase 和 goal-workspace-m2 严格选择器匹配两个节点，goal-suggestions-live 选择隐藏说明，research-results 依赖已更改的文字。当前同五场景在源码与正常打包版本各 5 项通过；Goal 的两个目标、刷新失败/恢复、真实 disposable Todo owner、报告清空旧精确值、权限与不发送模型请求均保留。UI 数据与外部 transport 是合成边界，不把它们当成线上数据新鲜度或真实第三方采用。

曾有一次本地并发基线/源码探针误用同一端口，基线 server 因地址占用退出，源码的一个 reload 遇到 connection refused。保留该运行；随后分离端口并完整重跑得到上述逐项结果。它有独立进程诊断和相同用例覆盖，不是把一次绿色重跑当作未知间歇问题已修复。最初两条错误测试路径导致 no-tests 的命令也保留，未计作产品失败或通过。

当前 native premerge 为 5 个 direct、10 个 catalog 与 1 个边界检查，正常 chat build 通过。提示四 profile 正文和生产 Git tree 均一致，硬上限未变化；这只是合理修复 regression budget，不提供大参数或运行预算豁免。模块预算另行在 base/head 同命令复现相同 146>145 的失败，各 5 passed，因果路径未变，分类 pre_existing_unrelated 并保留合并限制。未获取、查询或等待 CI，也未执行付费模型、基准实验或 shared Goal 测试。

我的整体评价

这是 goal_achieved 的有界测试维护：目标是恢复现有验收信号，已经通过真实旧失败、当前正例与保留反例说明实际价值。long_horizon=preserved：不改变持续执行规则，独立时钟仍检查新鲜观察，replay 仍不可吞请求；user_experience=preserved：生产交互不变，测试继续验证最短操作、明确失败和可恢复结果，没有增加用户准备或确认。

有界未来整理已检查：修复留在现有场景和测试 owner，复用 canonical pattern 与时钟，不新增通用 helper 层或第二份生产规则。对整个 13 路径的修复组合而言，拆成更多依赖 PR 只会让同一批已失效消费者继续互相阻塞；当前范围便于独立回滚。没有当前阻断发现；全量套件、远程 CI、真实模型采用与合并 readiness 仍独立保留。

English verdict: APPROVE at 3e25193a7ec520171cc2363f84c65f3026f343e2. The actual 13-file test-only change repairs independently reproduced consumer failures while preserving negative coverage and the native hard cap. Production trees are identical; the unchanged module-budget failure remains a separate merge hold.