Skip to content

Reuse unchanged observed acceptance and preference bodies in native first reads - #8124

Merged
huangruiteng merged 10 commits into
mainfrom
codex/observed-field-first-read-20261105
Nov 6, 2026
Merged

huangruiteng merged 10 commits into
mainfrom
codex/observed-field-first-read-20261105

Conversation

@loopx-agent

@loopx-agent loopx-agent commented Nov 5, 2026 •

Copy link
Copy Markdown
Collaborator

Result

Reuse unchanged large acceptance or scoped preference bodies after complete native delivery in the same Goal, Agent, Todo, session and epoch. Current decisions, stops, changed requirements and settlement stay visible. Partial reads, another Todo, compaction and unverified observed-field continuity do not qualify reuse; exact current-source recovery remains available.

Current head: d7c80949a3348ae6a401478cc609e2ecca51ba6d, with current main (10eecdc6a3bdb49a5ce2da4abbb418ca982b4ab1) merged while preserving the existing PR merge topology and its Delta/private-delivery resolution. This is 11 files, +270/−19.

The implementation records complete eligible descendants when their parent is delivered, then matches semantic fields before regrouping the remaining selection. Inferred descendants keep the 1,024-byte threshold. Progressive and Delta remain independent: Progressive off plus explicit Delta auto does not publish Progressive navigation or observed-field reuse. File-backed deltas and complete current recovery still work.

Validation

  • Complete control-plane TypeScript suite: 6,134 passed, 77 skipped, 0 failed.
  • Six directly affected Python modules: 405 passed, 11 skipped, 1 failed. The failure is test_bounded_continuation_rechecks_original_capture_and_utf8_cursor; the relevant test and capture files are unchanged between the previously recorded main baseline and current main, and the same failure signature was reproduced on that baseline.
  • Complete control-plane TypeScript typecheck and configured mypy’s 17 roots passed.
  • Standard premerge: 19 selected checks passed, public boundary passed, with one inherited maintainability advisory.
  • RFC bilingual pairing and diff hygiene passed.

The page-budget failure above is retained rather than waived or relabeled as a pass. It is outside the changed causal path and independently not a regression from this PR.

Remaining limits

The expanded strict audit remains non-passing on the existing maintainability baseline. Direct reader-component measurements in the earlier exact-head review remain evidence about delivered bytes, not model-token billing, latency or task effectiveness.

Independent exact-head review and merge readiness are separate from local validation. No CI success is inferred from locally passing focused suites.

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>
… invalidation

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>
Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>
Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>
@mergify

mergify Bot commented Nov 5, 2026

Copy link
Copy Markdown

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @loopx-agent.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

@mergify mergify Bot added the needs-rebase Mergify: the pull request has merge conflicts with its base branch label Nov 5, 2026

@loopx-agent loopx-agent left a comment

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewer: model_agent; model=gpt-6.1-sol; provider=OpenAI; runtime_reported; reasoning_effort=max.

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

Exact head: 8124@40928d668df3c5847b58c1f1d7e95d68f9c49f99. Base: 1b636dee161f5ec0039b2c0121ef7ff7060dcb72.

动机 / Motivation

同一原生会话连续处理同一任务的 Agent,需要读取当前要求、偏好和结算条件。旧版即使已完整收到未变化的偏好或验收正文,首次读取仍重复发送;现在相同字段可列为已交付引用,变更或失去观察后恢复完整读取,需要时可直接读当前全文。已验证未变化偏好在受绑定观察下减少首次读取字节,当前约束与结算不省略;变更正文、部分读取、任务或 Goal 切换、关闭和压缩恢复均保留原始 capture 的准确恢复路线。不推断模型理解、历史保留、实际 token 账单或长期任务收益;不更改准入、执行权、收费、Todo 或模型调度。

改动思路 / Approach

重用决定放在既有 TypeScript delivery transaction 与 initial selector;Python 仅固定 selection/私有引用并检查 native journal。沿用原始 capture 恢复路径,没有新增配置或第二个策略 owner。本 PR 只减少既有 native progressive 首读中完整观察且未变化的偏好/验收正文;host 无连续性、关闭功能及失效恢复保持完整输入。不修改保留现状会留下已经复现的重复成本;为此增加独立状态机或另一个策略 owner 反而更重。本次保留现有权威,删除或派生呈现信息,属于可独立核对的完整修复。

首次读取→完整字节交付观察→下一次对同一任务比较当前字段→相同则引用、不同则全文;阅读中失效→拒绝拼接→从同一 capture 恢复。保留完整 capture 和旧 reader 对恢复及持久引用是必要的。

具体改动 / Changes

规格依据:docs/reference/required-work-context.md,修改前 revision 1b636dee161f5ec0039b2c0121ef7ff7060dcb72;同时检查原仓库 frontend delivery/typed owner 的适用边界,未把新文档当作既有验收依据。

关键代码讲解

  • observedFirstRead:按允许的字段位置、完整观察 digest 和当前投影 digest 判断复用;已变字段保持正文。

  • prepareProgressiveContextDelivery:在同一 TS 事务内复用 initialContextReadPointers 与 capturedContextSelection,不通过 Python 再决定字段。

  • project_codex_context:已有 read_scope 增加 surface/Todo 身份;切换时清空 consumed/confirmed/section 观察,创建私有首读引用。

  • read_context_capture:零页观察失效时退回同一 capture 的完整首读;后续页失效则拒绝并给 recovery_command,防止拼接视图。

  • observation_current:核对 session、epoch、目标、原始 digest/path 与全部观察;缺少或冲突时失败关闭并恢复。

Opt-in native reuse:implemented。复用不能授予权限或刷新来源权威,失效时恢复同一完整 capture。 对应上列 owner 与本次真实入口/反例证据。

Machine default:implemented。完整原始输入保持可恢复,native 工具交付观察需完整连续字节;压缩或范围变化不保留旧观察。 对应上列 owner 与本次真实入口/反例证据。

Selected capture details / 按需读取捕获详情:implemented。完整 digest 与选读摘要绑定分页;不能把不同视图的字节拼接,读取不重新 admission。 对应上列 owner 与本次真实入口/反例证据。

11 个文件 +228/-20,TS 留在原 delivery transaction,Python 的 40 行 helper 只做私有引用和当前观察核对。scope 增加 Todo/surface 的绑定,compact/resume 清除旧观察;旧完整 reader 与关闭路径继续可用。

对主干的风险 / Risks

284 项 Python 测试通过;base/head 均有 138 项 TS 通过及 1 项既有 skip;独立七情形 CLI 在两侧全部通过,Ruff、配置内 mypy、control-plane TypeScript 和 standard premerge 均通过。基线的 1 项旧 test-double 不接受 hook_session,当前补丁只修正其包装器签名。 独立同条件偏好案例:基线 cold/warm 都为 10,280 字节;当前 cold 为 10,280、eligible warm 为 1,373 字节,全文准确恢复。退役、换任务、换 Goal、关闭、未观察和压缩都恢复完整读取。outcome 变更、partial delivery 和分页 compact/resume 另由真实 CLI/native 生命周期测试覆盖。

字段正文不是通过类似文本推断复用,而是检查完整观察、任务/Session/epoch、完整 digest 与不可变 capture。后续页失效直接拒绝并返回 recovery_command,不把首次页重启结果接到旧 byte offset;显式 --select 可恢复同一当前全文。关闭及未观察路径的完整字节与基线相同,没有新增执行、付费或结算副作用。

原始维护性检查在 base/head 的完整输出逐字节相同:2 项 compatibility facade、1 项超大决策函数,其中 1 项未审阅,幅度回归为零。失败位于本 PR 未改变的 _admitted_interaction_next_cli_actions。其原始失败未被改写成通过;strict change-quality receipt 保持 fail。 当前分支与 main 有冲突;解决冲突后的新 head 必须重审。premerge 的继承 advisory 不能替代上述原始必需验证,也不构成合并授权。 这些失败已独立归因到未改变的基线 owner,改动本身有单独通过的必要证据;代码评审结论与质量/合并 gate 分开。远端 CI 未查询、未轮询、未等待。

语义与 CI 对齐

复用既有 initial selection、native lifecycle 与 digest 词汇;observed-read 描述符保持私有呈现元数据。 diff advisory 和完整语义检查通过,没有新增共享枚举或更改 hard obligation;失败验证没有被放宽,未改变 agent 的权限或 stop 条件。

我的整体评价 / Verdict

长期持续工作:preserved。同一工作、Session 和 epoch 的连续读取减少重复传输,变更或不完整观察不能隐去约束;原始 Turn、结算和不可变 capture 保留,失效可继续恢复。本次只证明读取行为与传输字节,不证明更高任务分数或净成本收益。用户体验:improved。Agent 不再被强迫重复导入大段已交付正文,遗漏字段在第一页明确列出并提供准确全文恢复;没有新增设置或本人确认轮次。现有设置入口及显式关闭语义保持不变。本 PR 只减少既有 native progressive 首读中完整观察且未变化的偏好/验收正文;host 无连续性、关闭功能及失效恢复保持完整输入。保留原 owner 是必要且更小的实现,代码量与问题相称;没有需要本 PR 再引入的架构层。

视觉/使用边界:检查 CLI/native capture 读取路径与现有 Settings Progressive context:没有修改渲染、设置字段或 UI 组件。 未验证范围:不推断模型理解、历史保留、实际 token 账单或长期任务收益;不更改准入、执行权、收费、Todo 或模型调度。 传输字节减少不等于 token 账单或净效果提升。

未发现本 exact head 新引入的阻断性实现问题。现有冲突及 strict change-quality 仍需处理后重新确认合并门槛。本次不执行 merge、dismiss、resolve、安装或模型任务。

English verdict: APPROVE for this exact head; independent validation and merge holds remain in force.

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>
Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>
@mergify mergify Bot removed the needs-rebase Mergify: the pull request has merge conflicts with its base branch label Nov 6, 2026
Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>
@mergify

mergify Bot commented Nov 6, 2026

Copy link
Copy Markdown

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @loopx-agent.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

@mergify mergify Bot added the needs-rebase Mergify: the pull request has merge conflicts with its base branch label Nov 6, 2026
Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>
Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>
@mergify mergify Bot removed the needs-rebase Mergify: the pull request has merge conflicts with its base branch label Nov 6, 2026
Signed-off-by: huangruiteng <huangrt01@163.com>

@huangruiteng huangruiteng left a comment •

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewer: model_agent · GPT-5 · OpenAI · self_reported

Approval conclusion

Exact head: 8124@d7c80949a3348ae6a401478cc609e2ecca51ba6d.

动机 / Motivation

处理同一原生会话连续多次唤醒的开发者和 Agent,会遇到 Progressive first read 反复发送此前已经由完整 native tool output 交付的大段 acceptance outcome 或 agent preferences 的问题。此前即使正文没有变化,下一次同任务首读仍要再次承载这些大字段,既扩大首屏,也让当前决策淹没在重复材料里;现在只把同一 Goal、Agent、Todo、session、epoch 下完整观察且 digest 仍相同的字段列成指针,当前决定、stop 和 settlement 继续可见,字段变化或观察失效时恢复完整正文。

这个问题会在同一任务的压缩恢复、resume 和长验收正文中反复发生。实现只减少既有 Progressive 首读中的重复传输,不改变准入、执行权、收费、Todo 调度或模型保留判断;独立 Delta、关闭 Progressive、部分读取、任务切换和来源变化都有明确的回退路径。本次边界是传输与恢复语义,不是模型 token 账单或长期任务收益证明。

改动思路 / Approach

新行为仍由既有 TypeScript delivery transaction 决定。prepareProgressiveContextDelivery 先生成同一份 required context、initial read pointers 和 file-backed delta,再按语义字段识别可复用正文;Python 只负责把真实完整交付的 section digest 写入私有 native journal,并在 reader 每页核对当前 target、session、epoch、capture digest 和 path。没有新增 Goal 状态、权限来源或第二个调度 owner。

路径 触发 结果
旧行为 同任务下一次 native first read 即使字段未变,也再次内联完整 preferences/outcome
新行为 完整 parent 或字段已交付,当前 digest 匹配 只列 previously_delivered_fields 和必要的 current keys,完整正文可按指针恢复
失效路径 partial、字段变化、Todo/surface/epoch 改变、无法验证 journal 不走引用;恢复当前完整读取或拒绝拼接分页

架构判断为 retain:字段选择属于现有 TS projection/decision owner,私有引用和核对属于 native IO/local helper;lifecycle 只清除派生观察。这个边界复用了 capturedContextSelection、exact-source digest、reader reference 和 native journal,没有为局部优化新建协议层。当前 PR 边界是完成既有 Progressive first read 的安全复用,独立的 Delta 选择继续由原 owner 控制。

具体改动 / Changes

规格依据:docs/reference/required-work-context.md,judged revision 10eecdc6a3bdb49a5ce2da4abbb418ca982b4ab1。对应既有 Selected capture details 约束如下:

  • CD-1:reader 必须保留完整 digest,并对每一页重新验证;implemented by observation_current 和 read_context_capture。
  • CD-2:selected page 不是 full-input observation,也不能证明模型保留;implemented by previously_delivered_fields guidance 和 current-key regrouping。
  • CD-3:未知、缺失、变化或不完整观察必须失败关闭或恢复同一完整 capture;implemented by lifecycle reset、partial-read negative tests 和 zero-page restart/later-page rejection。

关键代码讲解

  • reusableFirstReadFields / observedFirstRead:只登记完整 agent preferences 和具有稳定 id 的 acceptance outcome;先匹配字段 digest,再重新组合 selection。每个复用字段仍保留 ok、revision、instruction 或 id、revision 等 current keys,变更字段恢复正文。
  • contextReadSectionDigests:从真实 parent delivery 推导完整 descendant observation,只对至少 1,024 bytes 的候选生成 digest,避免把完整 parent 的交付误当成未交付。
  • observed_first_read_reference / observation_current:前者写入私有 selected reference,后者核对 current recovery target、session、epoch、path、digest 和 consumed pointer digests;不一致就返回 false,不授予 freshness 或权限。
  • prepare_codex_context:沿用 main 的 prepared native first-read plan,在同一锁内更新 read scope、pending、full read sections 和 observed descriptor;surface、Todo 或 epoch 改变会清空旧观察。
  • read_context_capture:首屏观察失效时从同一 capture 的完整首读重新开始;翻页后失效则返回 typed failure 和 recovery command,避免把两个视图的字节拼起来。

变更规模为 11 个文件、+270/−19。生产热点集中在上述现有 owner;其余为 lifecycle 清理、文档和反例测试。没有需要本 PR 删除的并行决策实现。

对主干的风险 / Risks

最强回归场景是“正文实际已变化,但系统仍按旧 digest 省略字段”。当前路径只有在完整 native delivery 留下 section digest、当前 semantic field digest 相同、target/session/epoch/path 仍匹配且 Todo 身份有效时才复用;字段变化、第二次读取越界、partial delivery、task switch、compaction 和 resume 都有测试。压缩或 resume 后的 stale continuation 被拒绝且不返回正文,恢复命令重新读取同一 capture。

另一风险是把 parent 的完整交付误判为每个 descendant 都已交付。新增 coalesced 用例通过真实 initial reader 交付完整 parent,验证未包含的 tiny outcome 不会获得 digest,而已交付的大 outcome 仍能安全复用。关闭 Progressive 时没有 first_read_command、没有 observed descriptor、没有 previously_delivered_fields,完整 recovery 与旧输入一致。

远端 CI 在 exact head 上还显示 5 个失败/级联项和 4 个 pending 项。直接根因是未修改的 tests/test_chat_codex_history.py 中 3 个 Ruff F811;checks、pytest、stage2c-correctness-e2e 和 merge-gate 都建立在 kernel-static-checks 失败或 skipped 之上。该文件不在 PR diff,changed-file Ruff 与 standard premerge 已通过,因此这是独立 CI/既有 lint hold,不是本 PR changed-invariant regression;maintainer authorization 可覆盖 policy/CI hold,但不能替代 exact-head review、线程清空或可合并性。

验证结果:完整 control-plane TypeScript 套件 PASS(6,134 passed / 77 skipped / 0 failed);六个相关 Python 模块 PASS(405 passed / 11 skipped);mypy 17 roots、TypeScript typecheck、RFC bilingual、public boundary 和 standard premerge PASS(19 selected checks,1 个继承 advisory)。Python 组仍有一个 test_bounded_continuation_rechecks_original_capture_and_utf8_cursor 失败:相关测试与 capture 文件自已记录 main baseline 到当前 main 完全未变化,失败签名相同;这是独立 merge hold,不作为本 PR 的 regression,也没有被改写成通过。

字段 digest、scope identity 和 reader cursor 都是现有 typed contract 的扩展或复用,不使用文本子串猜测;previously_delivered_fields 明确要求字段仍适用并在需要时读取全文,不把文件存在或引用当作模型 retention。未验证范围是模型是否实际采纳引用、真实 token 账单、延迟和长期任务收益。

我的整体评价 / Verdict

未发现 this exact head 上新的阻断性实现问题。原有问题得到了可观察的修复:大段未变化正文不再在同任务下一次 Progressive 首读中重复内联,同时 current decision、stop、revision 和 settlement 保持可见;风险路径失败关闭并恢复同一完整 capture。长期持续工作判定为 preserved:身份、结算、重试和恢复语义没有被复用优化取代;用户体验判定为 improved:首读更聚焦,必要时可用明确 pointer 恢复全文。visual review 为 not_applicable:本次只改变 CLI/native capture 读取与 journal 记录,没有 rendered UI;未验证范围包括模型采纳、真实 token 费用和长期效果。

代码量判定为 necessary,change proportionality 为 proportionate,architecture assessment 为 retain。实现复用现有 delivery transaction、selection reader 和 native lifecycle,新增约 40 行 Python helper 只承担私有引用与观察核对;没有更小的 owner 能同时提供完整 parent observation、逐页 digest 校验和失效恢复。语义复用既有 initial-selection、digest、native lifecycle 词汇,没有新增共享枚举或改变 hard obligation。

English verdict: APPROVE for exact head d7c8094. No blocking finding; repository CI may remain a separate merge-readiness hold.

@huangruiteng
huangruiteng merged commit f87d997 into main Nov 6, 2026
25 of 31 checks passed
@huangruiteng
huangruiteng deleted the codex/observed-field-first-read-20261105 branch November 6, 2026 07:22
@loopx-agent

Copy link
Copy Markdown
Collaborator Author

Reviewer: model_agent | gpt-6.1-sol | OpenAI | runtime_reported | reasoning_effort=max

Request changes conclusion (author-owned PR; GitHub blocks formal self-review)

Post-merge audit comment / 合并后审计

审查期间本 PR 已于 2026-11-06T07:22:47Z 合并。以下通过 PR 评论提出一项新增 P2 发现及修复建议;既有批准保持原样。核对合并提交 f87d9976baab054e5baee5b0d56538ca3812b39e 与最新 main,selector 和偏好 producer 的 Git blob 均与审计 head 相同,缺口仍在主干。

动机 / Motivation

在同一原生会话中持续处理任务、需要读取当前偏好和验收条件的 Agent。完整读过的长篇偏好和验收正文原本仍会重复发送;当前减少了未变化的验收正文,但正常偏好正文仍被重复发送,承诺的两类复用只完成一类。真实 CLI 验证了验收正文复用、当前停止条件和恢复路径;同一 Task/session/epoch 的完整偏好观察仍不能触发偏好复用。本次边界是源码 CLI 与隔离原生日志,不认证真实模型保留、Host 采用、长期净收益或合并权限。正常偏好源的 content/current 子选择与登记的 content 父地址不匹配,未变化偏好正文无法复用。

改动思路 / Approach

TypeScript 保留正文选择、摘要与生命周期决策,Python 仅写私有捕获和读引用,位置合理;复用地址必须与实际选择的语义边界一致。当前 PR 是既有首次读取的正文复用与失效恢复;当前偏好地址匹配缺口需在这一边界内修复。当前主干把投影准备和首次读取计划放进 NativeContextPreparation;公开入口传递同一捕获绑定的 initial_read_plan,保留已经固定的游标,避免另做一轮选择。正文摘要和选择继续由 TypeScript 决定,Python 保存原捕获和私有引用。只有完整实际观察、相同 Task/session/epoch 和当前摘要才允许引用正文;改变的 peer 条件、当前停止约束和原始恢复始终可读。Progressive 与 Delta 的独立开关是本次合入主干后的既有边界,不能把完整文档 delta 当成正文观察资格。

具体改动 / Changes

当前精确范围 10eecdc6a3bdb49a5ce2da4abbb418ca982b4ab1 → d7c80949a3348ae6a401478cc609e2ecca51ba6d:11文件 +270/−19,生产165/−12、测试96/−7、文档9行。审查期间 head 从1003变更;旧审查未发布。本轮完整阅读当前31597字节 diff、当前调用者和规范基线6695字节更新;没有把合入主干的全部历史差异冒作本 PR 改动。

规范 docs/reference/required-work-context.md 的不可变版本为 10eecdc6a3bdb49a5ce2da4abbb418ca982b4ab1。原章节 Opt-in native reuse、Machine default、Selected capture details / 按需读取捕获详情、Saved context cache / 已保存上下文缓存 的当前事实、身份、完整观察和恢复要求为 implemented;本 PR 新承诺的正常偏好正文复用为 not_met。沿用实际章节标识,不另造编号规范。

关键代码讲解

  • contextReadSectionDigests: 记录完整字段的观察摘要。完整父读取派生大字段摘要;只有完整实际观察;小字段不放大日志。

  • observedFirstRead: 选择首次读取复用字段。按未合并子选择匹配登记的语义地址;偏好content父地址不能命中content/current子地址。

  • observation_current: 检查引用仍属于当前原生范围。分页期失效拒绝继续,起始读取恢复普通首读;当前session/epoch/target/digest和已观察摘要同时匹配。

  • project_saved_context_capture: 通过公开CLI呈现原捕获。原始Goal/Agent/Turn和摘要先验后投影;不重跑admission或产生spend;off保留原始source。

当前七份完整 Python 模块:base 420PASS/11skip,head 437PASS/11skip。严格 TypeScript 双方通过;完整 control-plane TS:base 6134PASS/77skip,head 6134PASS/77skip。真实 CLI 重新验证六种情况的两端对照:warm、partial、Task switch、compact、resume、off。停止条件、改变的 peer 约束、未知字段和大整数精确保留;原文件字节不变,未创建 registry/runtime authority。再用真实 semantic_preference hook 结构做两端冷读、完整逐页 PostToolUse 和下次首读,偏好反例仍成立。另补两端 --context-delivery off --delta-delivery auto:冷 full、warm delta,没有 first_read 导航或观察复用,当前完整恢复精确。

对主干的风险 / Risks

[P2] 按偏好的语义父地址匹配复用字段。 第75–80行先按显式子地址生成 rows,再用 fields.get(address) 精确查找。但 reusableFirstReadFields 登记的是 .../content,正常首读选择的是 .../content/current、status、ok 等子字段。日志已有完整 content 摘要仍无法命中。真实 hook 形状中,当前首读33237字节、warm27823字节,减少来自验收正文;偏好 current 仍完整重复,previously_delivered_fields 只有 outcome0。请在完整覆盖成立后按偏好父字段匹配,同时保留验收逐项复用、鲜活元数据和失效恢复,并补真实 hook-shaped CLI 回归。没有观察到偏好丢失、权限扩大或真实模型已受影响;问题是明确承诺未交付。

当前失败也分别保留:全配置 Ruff 两端均为未改 tests/test_chat_codex_history.py 第14/53/105行的三个 F811,完整输出相同,变更文件 lint 通过;另完整 test_context_delivery_cli.py 两端均89PASS/1FAIL,失败为第187行1600字节 UTF-8 首屏。相同绝对 fixture 的完整失败 JSON 相同,提示元数据及一个字符无法装入;该测试 blob 未改,执行 trace 未进入新增 observed 分支。没有调高硬限或删失败用例。raw ratchet 两端完整报告除根目录外相同,保留未改 interaction 函数62/60 decision points、85 statements。作者 expanded strict audit 的原命令未独立取得,仍是未验证限制。

配置内17-root mypy、变更 E4/E7/E9/F、全树词汇及 diff advisory、编译、diff、公共边界和全部10个 PR commit DCO 通过。本轮独立审计的精确范围 CQR cqr_c75cfbc0218c380abd50 不通过;quick premerge quality_invalid_receipt 保留质量阻塞,未将上述失败抹成通过。

语义与 CI 对齐

复用现有 native/reference 词汇和私有观察 owner,没有新增业务分类规则。正常偏好匹配是本 PR 内的有界修复,不需要新缓存、迁移或增加读取预算;当前关闭/Delta独立组合及同捕获恢复已验证。未获取、轮询或等待远端 CI。

我的整体评价 / Verdict

当前为 justified_increment:验收正文复用与安全恢复有真实 caller 证据,long_horizon 的现有身份和约束 preserved,user_experience 有局部 improved;真实采用和长期净收益仍未测。正常偏好复用未完成,建议在后续修复中完成该项。机制比例合理,最小修复留在 selector;新 head 必须重新验证偏好用例和当前失效、关闭、恢复路径。检查的是 CLI、Git 或原生捕获读取,没有渲染页面变更,页面视觉审查不适用。安装态 Host、原生 Windows、真实模型采用与长期完整成本未验证;不声明页面或安装态资格。审查、GitHub readiness、未解决线程与维护者合并授权分别处理,本轮不合并。

English verdict: REQUEST_CHANGES — The exact head reuses observed outcome bodies but never matches normal preference bodies; fix semantic pointer matching and add the native CLI regression. Exact head: d7c80949a3348ae6a401478cc609e2ecca51ba6d.

huangruiteng added a commit that referenced this pull request Nov 6, 2026
* Recognize direct exec results in the trajectory tool inventory

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>
(cherry picked from commit 8e9946d)
Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

* fix(chat): reject non-string queued input actions

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

* feat(research): compare real captured LoopX request usage

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

* Honor cross-turn delta independently of progressive context

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

* test: isolate machine CLI smokes from model context transport

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

* Honor scoped Todo resume conditions across external and managed schedulers

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

* Audit active solver coverage across every selected benchmark arm

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

* fix(runtime): preserve raw quota JSON for native goal admission

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

* feat(collaboration): share reader guidance and version return formatting

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

* fix(chat): open long returned answers at their beginning

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

* test(lark): verify full versioned returns through body workers

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

* feat(research): compare real captured LoopX request usage

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

* fix(runtime): preserve raw quota JSON for native goal admission

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

* fix(research): show native command cache and output deltas

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

* fix(chat): preserve queue edits when dismissing actions

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

* docs(readme): remove redundant budget disclosure sentence

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

* fix(collaboration): count budgets using persisted return format

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

* fix(research): compare uncached command request shares

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

* fix(context): preserve async reader handles in code-mode guidance

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

* refactor(control-plane): isolate prompt upgrade CLI rendering

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

* test(control-plane): qualify complete continuation decisions

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

* fix(chat): answer exhausted requests through one restricted review

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

* fix(runtime): wait for launchd job removal during service handoff

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

* test(project): make the no-git registry fixture actually degrade the probe

Signed-off-by: Weimr2627 <134630546+Weimr2627@users.noreply.github.com>

* fix(research): distinguish declared retention from verified adoption

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

* fix(doctor): hold every Git read to one budget

`doctor` inspects a checkout the operator may not control, and none of its
six Git reads had a budget: `rev-parse` twice, the metadata runner behind
`git_metadata_for_root`, `merge-base --is-ancestor`, `remote`,
`remote get-url` and `rev-parse --verify`. A repository blocked on a stale
index lock, a network mount or a very large history therefore held the
diagnostic open with no output at all.

Reproduced with a fake `git` on PATH that only sleeps:
`_is_git_worktree_root` was still running after 5s.

All six reads now go through `_run_git`, bounded by
`GIT_PROBE_TIMEOUT_SECONDS`. The helper answers `None` when the budget runs
out, which is the answer every caller already treats as "unknown": root
detection fails closed, metadata fields stay `None`, revision relation stays
`UNKNOWN`, and the trusted release ref is refused. No new failure mode, and
the diagnostic still returns instead of raising.

The same class in `loopx/contract.py` was bounded in #8152.

Signed-off-by: ChengLong GU <88359731+gcl-coder@users.noreply.github.com>

* fix(doctor): retire the probe's own group and keep a stale manifest out

Two gaps the review found in the ten-second budget.

`subprocess.run(timeout=...)` retires the Git leader only. Git starts its
helpers -- fsmonitor hooks, pagers, credential helpers -- inside the group it
runs in, so a blocked `status` left the hook and its child behind and repeated
diagnostics accumulated them. The query now launches in a session of its own,
and an exhausted budget retires that group through the existing
`terminate_process_tree` before dropping the pipes instead of draining them: an
inherited pipe outlives the leader, so a drain would wait on work this call no
longer owns. Reproduced with a `core.fsmonitor` hook that never answers and
keeps a child writing heartbeats -- leader-only kill left it growing, the group
retirement stops it.

`_is_git_worktree_root` answered False both for "there is no Git here" and for
"there is Git here and it did not answer". `release_manifest._source_metadata`
stood an older `release.json` in for the second case, so a checkout at commit B
that carried a manifest claiming A wrote A back as its own source. The two
cases are separate states now, and only a checkout with no `.git` of its own
falls back to the recorded manifest; an unanswered read stays unknown.

Signed-off-by: ChengLong GU <88359731+gcl-coder@users.noreply.github.com>

* fix(doctor): retire the probe's session when the diagnostic is cancelled

The budget covered an exhausted wait, not an interrupted one. Git runs in a
session of its own so the budget can retire its helpers, which also means a
terminal Ctrl-C -- a SIGINT to the process group of the running `doctor` --
never reaches Git. `communicate` raised `KeyboardInterrupt` out of the only
place that owns that session, the diagnostic exited, and the fsmonitor hook
and its child kept running. Repeated cancellations accumulate the same
background work the timeout fix removed.

The wait now retires the owned session on any interrupted exit and re-raises
the original interruption, so an exhausted budget keeps answering "unknown"
while Ctrl-C stays Ctrl-C. Reproduced with the manifest writer CLI, real Git
and a real `core.fsmonitor` hook that keeps a child writing heartbeats:
interrupting the writer's group left the heartbeat growing on the previous
head and stops it now.

Signed-off-by: ChengLong GU <88359731+gcl-coder@users.noreply.github.com>

* fix(chat): retain context-limit failures in pending work

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

* test(collaboration): recover complete per-turn delegation context

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

* fix(lark): hold the collector's Git reads to one budget

Admitting a collector config path asks Git three questions -- whether the
project is a worktree, whether the file is tracked, and whether it is
ignored -- and none of them carried a budget. A Git blocked on a stale index
lock, a network mount or an oversized index therefore held the command open
with no answer at all; reproduced here with a fake `git` on PATH that only
sleeps, where `_project_config_path` was still running after 5s.

The budget alone was not enough: a `TimeoutExpired` would have escaped the
admission check as a traceback, so the refusal paths had to say what "Git did
not answer" means. Acceptance needs proof that the config is ignored and
untracked, so an unanswered probe refuses the path. The three reads share
`GIT_PROBE_TIMEOUT_SECONDS` through `_run_git_probe`, and a Git that exits
non-zero still takes the existing boundary and non-Git fallbacks unchanged.

The queries are local reads that never fan out into helpers, so the
leader-only kill that `subprocess.run` performs covers them.

Signed-off-by: ChengLong GU <88359731+gcl-coder@users.noreply.github.com>

* fix(lark): stop the collector's Git questions together with its budget

Two gaps in the config admission.

The budget ended only the Git leader. Git starts helpers of its own -- an
fsmonitor hook is the common one on `ls-files` -- inside the group it runs in,
so a blocked admission returned its refusal while the hook and its child kept
running, and repeated runs accumulated them. The probe now runs in a session of
its own, and an exhausted budget retires that group through
`terminate_process_tree` before dropping the pipes instead of draining them.

The three questions each carried a fresh budget. Once the tracked query had
timed out the admission could no longer be satisfied, yet `check-ignore` was
still started and spent another full budget on the same hang. The questions now
share one deadline, an unanswered tracked query refuses at once, and a question
asked after the deadline has passed is not started at all.

Signed-off-by: ChengLong GU <88359731+gcl-coder@users.noreply.github.com>

* fix(lark): retire the probe's session when collector-plan is cancelled

The budget covered an exhausted wait, not an interrupted one. The probe runs
in a session of its own so an exhausted budget can retire the helpers Git
started, which also means a terminal Ctrl-C -- a SIGINT to the process group of
the running `collector-plan` -- never reaches Git. `communicate` raised
`KeyboardInterrupt` out of the only place that owns that session, the command
exited, and the blocked Git and its helper kept running. Repeated cancellations
accumulate the same background work the budget fix removed.

The wait now retires the owned session on any interrupted exit and re-raises
the original interruption: an exhausted budget keeps refusing the config,
while Ctrl-C stays Ctrl-C. Reproduced with the `collector-plan` planning entry
in a real child process, real Git and a `git` that blocks the ownership read
with a helper writing heartbeats: interrupting the process group left the
heartbeat growing on the previous head and stops it now.

Signed-off-by: ChengLong GU <88359731+gcl-coder@users.noreply.github.com>

* docs: define router-coordinated controller worker units

Signed-off-by: huangruiteng <huangrt01@163.com>

* fix(chat): compact bounded history before new native turns

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

* docs: prioritize controller attention with safe preemption

Signed-off-by: huangruiteng <huangrt01@163.com>

* fix(runtime): pin qualified service executables behind CLI aliases

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

* docs: make controller worker execution the primary loop

Signed-off-by: huangruiteng <huangrt01@163.com>

* Pin the native first read and deliver the same-Turn selection route (#8100)

* Reuse capture-bound navigation for the first progressive read

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

* Distinguish the pinned reader from an explicit navigation replan

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

* Pin the benchmark preflight view and deliver its same-Turn selection route

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>
(cherry picked from commit 47db78b33792e584036b2f099bed4aa0904f7e2b)
Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

* Reuse prepared Codex read guidance in benchmark checkpoint prompts

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

* Prove progressive benchmark choices from receiver-visible pages

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

* Deliver the captured review command on the first replan read

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

* Validate progressive replan against its published reader contract

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

* Isolate the user skill directory for native context comparisons

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

* Verify explicit guard opt-out on the real CLI

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

* test(quota): exercise the original review after a successor loses its claim

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

* refactor(context): reuse the quota action vocabulary for staged review

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

* fix(types): widen context delivery source values

Signed-off-by: huangruiteng <huangrt01@163.com>

* refactor(context): make prepared native delivery the sole projection path

Signed-off-by: huangruiteng <huangrt01@163.com>

---------

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>
Signed-off-by: huangruiteng <huangrt01@163.com>
Co-authored-by: huangruiteng <huangrt01@163.com>

* Read saved quota fields in the first native tool call (#8111)

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

* Avoid reparsing unchanged private delivery journals during discovery

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

* Verify captured vision audits and share them in one display request (#8113)

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

* Keep delivery discovery hints in their bounded provider module

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

* Reuse unchanged observed acceptance and preference bodies in native first reads (#8124)

* Reuse observed preference and acceptance fields in native first reads

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

* Plan field reuse inside the existing delivery transaction and qualify invalidation

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

* Type the mixed native delivery request for the kernel contract check

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

* Keep private field observation descriptors typed on both native routes

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

* fix: observe reusable fields inside complete parent reads

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

* test: distinguish progressive defaults from delta opt-out

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

---------

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>
Signed-off-by: huangruiteng <huangrt01@163.com>
Co-authored-by: huangruiteng <huangrt01@163.com>

* fix(canary): retain current main maintainability baseline

Signed-off-by: huangruiteng <huangrt01@163.com>

---------

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>
Signed-off-by: Weimr2627 <134630546+Weimr2627@users.noreply.github.com>
Signed-off-by: ChengLong GU <88359731+gcl-coder@users.noreply.github.com>
Signed-off-by: huangruiteng <huangrt01@163.com>
Co-authored-by: Weimr2627 <134630546+Weimr2627@users.noreply.github.com>
Co-authored-by: ChengLong GU <88359731+gcl-coder@users.noreply.github.com>
Co-authored-by: huangruiteng <huangrt01@163.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants