[loopx-agent]

A native benchmark wake can be asked to select a Todo before it may work. Its first read needs the selection policy, candidate discovery and the command that binds the choice to the original Turn. Previously the reader could plan navigation again, still omit the binding recipe, and need a second read. Repeating a preflight for the same Turn could also replace the file named by the first reader.

Current head 2666a90534, integrated with main 3c7e0935fd. A policy test now opts into the inline view it inspects. The native checkpoint explicitly enables progressive delivery, follows the published recovery reference, and compares the entire recovered view with the one the CLI actually delivered. When a successor loses its claim, the guard can still return the original review obligation; the stale writeback and debit must both fail. File and SQLite exercise that boundary. Both affected suites pass with ambient progressive delivery enabled (55/55).

Default / opt-out coverage (7d8fdee526). The removed “default-off” check silently supplied an explicit off flag; its Python spy also ran outside the CLI process. The replacement checks an actual explicit opt-out: it returns this Turn’s inline decision and settlement plan without creating the native transport root. The companion default-mode checks omit the flag and follow the advertised recovery reference on File and SQLite. All five cases passed. No activation default changed.

Native input with matched skill catalogs (46541e0). The receiver now uses a disposable OS user home as well as a disposable Codex home. An initial comparison loaded personal skills on only one side, adding 168,450 B across ten requests. We discarded that comparison. With equal skill catalogs and the same two task selections from tool output, the ten serialized Responses input arrays totaled 529,594 B on main and 512,666 B on this branch, a 3.20% reduction. The fixture uses a scripted local provider. Full-task usage and scores await the paired run.

Replan first read, integrated with main 1280335 (head f8888e2). When the guard requires autonomous replanning, the first page now includes the existing capture-bound review command and guidance. A real CLI test on File and SQLite follows the advertised route to the original requirements and source, then checks that a later linked revision reaches the chosen Todo while the earlier capture still returns its original outcome.

Against main, isolating just this selector change on the same replan capture: first read → supplementary fields → review → acceptance became first read → review → acceptance. The first page grew 715 B; across that path stdout fell from 20,209 to 19,480 B (3.6%). Selected and unbound normal fixtures delivered the same values and byte counts. This is one scripted route; tool stdout is not model tokens. At this head the three affected suites passed (104 tests). Quick premerge checks reported no failures and require manual review.

Prepare the first-read selection once, bind it to the capture path and SHA, and use it for both fresh and saved decisions. Include the existing selection route only when the guard requires an explicit choice. Benchmark preflight pins the actual CLI view from that invocation; the original decision is reused only if its bytes match. This matters on main, where displaying the raw decision instead of the CLI view broke warm delta delivery. The off route still returns its ordinary CLI view. The guard remains responsible for admission and settlement.

Receiver-visible selection, integrated with main aa82591fb0. The old loopback receiver obtained the binding recipe directly from the recovery file. The progressive test now obtains the command and both candidate IDs from actual tool output, selects different Todos on the cold and resumed wakes, and checks each returned settlement identity. Full-source validation remains a separate oracle.

With the same scripted native Codex task, looking up the root before each known selection took 14 requests (main 961,551 B, this branch 937,875 B). Selecting the same fields directly took 10 (main 528,801 B, this branch 511,873 B; 3.20% less). These are summed serialized Responses input arrays including replayed history, not measured tokens, scores or unscripted adoption. Index discovery and digest recovery remain covered for other native receivers. Native receiver, preflight and context suites: 130 passed, 4 skipped.

Matched CLI evidence. Three isolated SQLite comparisons per version, main at acc00f545, from the initial guard through selecting the second of two candidates, re-entering the same Turn and reading its bound delta:

Per trial	main	This change
Full initial capture	29,143 B	29,143 B
First-read body alone	4,522 B	6,545 B
Body needed for the selection, including follow-up	6,930 B	6,545 B
Reader stdout through bound delta	16,080 B	14,830 B
Reader pages through bound delta	3	2
Internal RPC count	177	174
Bidirectional socket bytes	1,189,492 B	1,091,681–1,092,235 B

The first page is intentionally larger; in this workload it replaces a separate lookup. The bound body itself stayed at 6,132 B. Fixture-file reads decreased by 27,058 B; writes increased by 149–243 B. The wire range varied in the re-entry stage. Counts cover the instrumented CLI path, not model billing, hardware IO or benchmark scores. In a separate immutable-capture replay, 9 selection cases needed 9 instead of 18 pages for equivalent facts; all 52 non-selection cases kept the same first-read body and stdout lengths.

Native benchmark input. The prepared Codex exec session already supplies the read guide in developer instructions. Its checkpoint prompt now carries the original projection and fallback commands without sending a duplicate guide. Standalone preflights continue to carry the full guide. A refused projection still returns the immutable reader and the complete guidance.

After integration with main 76cc8d0d65, the same scripted progressive benchmark session produced 14 native requests per arm. Compact UTF-8 serialization of their observed Responses input arrays totaled 937,744 B on main and 914,068 B on this branch (2.52% less). Each of the 14 requests contained the guide in developer instructions. A separate two-choice control-path replay saved 1,206 B per prepared checkpoint prompt, including on the resumed path. Measurements use loopback inference and count repeated history. Scored-task cost remains open.

All three integrated revisions passed 26 native receiver and queue checks. Both standard premerge runs reported no blocking automated failures, one inherited maintainability advisory, and the benchmark review hold.

Validation. File and SQLite off/on/post-compaction cases; real native Codex benchmark session with loopback inference; repeated same-Turn preflight; distinct raw versus displayed bytes; fixed-source recovery; and actual re-entry after choosing a non-first candidate. The combined integration selection passed all 22 cases. Historical bilingual experiment records stay together in #7430. This change has not merged.

Standard premerge on a clean checkout of the current head completed all 18 selected checks with no blocking automated failures. The catalog reported one inherited maintainability advisory outside the changed files; the benchmark-sensitive review hold remains.

[loopx-agent]

Reviewer: model_agent | gpt-6.1-sol | OpenAI | runtime_reported | max

Request changes conclusion (author-owned PR; GitHub blocks formal self-review)

Exact head: 7d8fdee; reviewed base: 1280335.

动机 / Motivation

通过 CLI 或 native Codex 接收任务的 Agent，需要先读当前要求，再从本次给出的候选中选择任务，继续同一个 Turn。当 guard 要求选择任务时，旧首读缺完整选择命令和候选；staged replan 的首读也缺执行复审的入口。新路径从同一 typed owner 取得首读计划，固定本次 view 的路径和摘要，只在对应 typed 状态交付原选择或只读 review/guidance。功能方面，选择与 staged replan reader 已有实际 CLI/receiver 证据；但当前 head 的 replan 分支仍直接匹配裸 effective_action 字符串，独立 required semantic-owner 检查在 base 通过、head 失败，因此不能批准。这次是首读与选择路径的可用修复；不认证整个 C1/C2 迁移、自然模型采用、已安装用户行为或长程效果和完整成本收益。当前必须先修复 canonical action owner 的引用并重跑 required check；自然模型采用、已安装行为与完整成本资格继续保持 unknown。

改动思路 / Approach

首读选择复用既有 TypeScript policy owner，Python 保留文件、锁和恢复 IO；准备结果只是当前调用的派生数据。benchmark 继续使用原准入和结算 owner，只把实际 view、选择入口与完整 read guide 交给原 receiver。当前 PR 交付既有 CLI/Host 首读与同 Turn 选择/replan reader 修复，以及 benchmark receiver 接入；当前 required semantic-owner 失败尚未解除，没有新增执行权限或模型实验。当前完整差异还将 staged replan 的原 review reader 放入起始选读。它只使既有只读第一步可达，guard/选择/结算权限仍由原 owner 决定。原 capture、session lock、SHA-bound recovery 和历史 reader 不变；两个生产调用者共同消费派生 plan，旧 wrapper 仅承担共同部署的内部/测试兼容，没有独立部署承诺。

typed 状态	当前首读行为
要求选择任务	完整选择路由、policy、候选
active staged replan	原 review command 和完整 guidance，无 writeback
settlement-only、unknown schema、其他 action	不额外暴露 replan review
显式 off 或错误 SHA	完整输出与 base 保持一致

具体改动 / Changes

采用既有 required-work-context，spec_revision 12803354ab13a003de8620ab496250617224ff37：first_read_command 的当前事实/入口为 implemented；selection digest 的固定地址、摘要与旧 reader 恢复为 implemented；Disabled native delivery 为 implemented。这些是既有条款名称，没有新增验收编号。C1 整体模型效果、完整成本及安装采用仍在本次范围之外。完整差异为 18 文件，+512/−128。

关键代码讲解

• prepareProgressiveContextDelivery / nativeContextReadPlan 从既有 TurnEnvelope 字段 owner 取得同一套决策字段，在原 transaction 内派生首读计划；只在 typed selection_required=true 时纳入完整选择入口，未把导航变成执行权。新增9行 staged-replan 分支还仅在原 typed action/packet/decision 且非 settlement-only 时交付原 review/guidance，不交付 writeback；unknown schema 或其他 action 不进入该分支。
• prepare_codex_context 保留原 session lock，并先保存当前完整 recovery，再尝试可选规划。返回的是 delivery 加临时 plan；plan 不写进原始 capture，也不建立第二份 journal truth。
• native_context_capture_view 校验 plan 的 capture path、SHA 和实际文件字节，固定地址/顺序与 selection digest。foreign plan 或相同 JSON 的字节变化均拒绝；metadata 不可写时保留原 recipe 和同 capture 恢复。
• capture_before_replan 绑定本次实际 CLI stdout view；只有字节相同才复用原文件，否则另存本次不可变 view，重复 preflight 不覆盖旧 reader。显式 off 继续普通 view。
• preflight_context_instruction 与 worker 调用 仅在准备好的 transport 可用时省去 wake 中重复的 guide；真实 native input 断言完整 guide 留在 developer instructions，独立 fallback 仍有完整原文。

对主干的风险 / Risks

REQUEST_CHANGES：当前 required semantic-owner 检查有一项新增阻塞。 本次新增 staged-replan 分支直接比较裸 "autonomous_replan_required"，当前 required semantic-vocabulary-drift-smoke.py 因 effective_action literal 位于 owner 之外而失败；同一检查在实际 base 12803354 通过。最新 head 又修正了显式 off 的真实 CLI 测试；生产代码的这处失败仍在。请从现有 ./effective_action.generated.ts 引入 EffectiveAction，改用 EffectiveAction.AUTONOMOUS_REPLAN_REQUIRED，保留其他 gate 条件，再重跑 semantic scan、typecheck 和 first-read/replan 场景；无需新增 vocabulary owner 或放宽检查。

最新 7d8fdee 的显式 off 真实 CLI 场景也已通过：inline 原 guard、无 native 目录、1 次 guard receipt、0 spend，测试仍沿实际入口验证。功能证据独立保留： 相对已完整实审的 c0ef0a1，本次 net scope 新生产行为只有既有 TS 首读 owner 的9行 replan reader gate；两测试文件的修正和三个已进 main 的上游文件已分别核对。相对原16文件检查的14个 blob 未变；最新18文件 head 与 f8888e2 的全部生产 blob 相同；复用了这些 source/caller 证据，并重跑受影响的实际入口，没有继承旧 approval 轨迹。

在生产代码相同的 f8888e2 上，完整 test_context_first_read.py、test_replan_staged_read.py、test_quota_acceptance_references.py 为 104 passed、0 failed、0 skipped。原先六项 navigation-as-inline 失败现在通过既有 read_cli_policy_payload 读回原 capture，再执行原断言；没有删断言、放宽 limit 或绕过实际 reader。新增 File/SQLite acceptance 场景从实际 first-read 执行 review reader，再读取原 outcome；后续接受新 revision 后，旧 reader 仍返回原捕获版本。

在 f8888e2 的独立实际 CLI 共 20 次调用：12项原选择/off/摘要路径，以及8项 active replan、settlement-only、unknown schema、other-action 对照。只有对应 typed gate 交付原选择或 review/guidance；错误 SHA 的完整 diagnostics、off 输出和共同首读事实逐字段保持一致，仅归一化实际 checkout/interpreter 路径。源字节未变，没有创建 authority registry/runtime。foreign plan、相同 JSON 的字节变化、ENOSPC、opaque continuation 和 unsafe integer 在当前 reader 负例中保留。

在 46541e0 的 HOME/USERPROFILE 隔离 fixture 另重跑 2 项真实 native Codex/local fixture 验证；当前生产与该 native fixture 的 blob 均相同，沿明确适用性复用；其中 progressive case 从实际页面读取 cold 第一项、warm 第二项，使用实际命令选择并 read back 同 Turn 绑定，核对原 receipt 与一次显式 settlement。它们不是自然模型实验。f8888e2 的 110 项 TS owner tests、typecheck、变更 Python Ruff/compile、RFC 双语及 diff hygiene 通过。较早 c0ef0a1 的 501 passed/6 failed/10 skipped 和 TS 6,121 passed/77 skipped 保留原版本；它们不累计成当前通过数，旧失败 receipt 也未改写成绿色。

语义与 CI 对齐

协议沿既有 vocabulary，新增分支只读取 typed 状态与已有 command 的存在，不从 prose、标题或 substring 推断生命周期。首读和 guide 不增加执行权、重准入、quota debit 或 model-retention 证明。完整 guide 的 actor、依赖顺序、必要范围、来源、继续/停止和原 Turn 结算条件保留；只改变已准备 Host 的呈现位置，fallback 仍有完整 guide。CI 按配置未查询、轮询或等待。

本地 standard premerge 在生产代码相同的 f8888e2 实际执行18项：16项通过，semantic vocabulary 一项 required FAIL，maintainability 一项 inherited advisory FAIL。该 advisory 在实际 base/head 的完整报告除 repository_root 外一致；没有调整阈值或 exception。当前 head 的 required semantic scan 再次失败，base 同命令通过。完整 native gate 因本次新增语义 owner 问题为 FAIL；change-quality 记录也保留此 required failure，未将通过的功能测试当作豁免。

我的整体评价 / Verdict

功能交付仍是 justified_increment：生产调用者复用原 owner，receiver 已能选择并读回任务，acceptance reader 也保留原捕获版本。long_horizon 为 preserved、user_experience 为 improved，但这些通过项不能抵销当前 required semantic alignment 的 violated。18文件范围已连同最新 fixture 隔离与显式 off 真实 CLI 测试核对；需要先采用已有 canonical action binding 并重跑同一检查，再 review 新 exact head。自然模型、已安装采用与完整成本仍 unknown。此 author-owned COMMENTED / REQUEST_CHANGES 不执行 merge、dismissal 或 thread resolution。

English verdict: REQUEST_CHANGES — 7d8fdee retains an introduced required semantic-owner failure in the staged-replan branch; passing functional coverage does not waive that check.

[loopx-agent]

[P2] 复用 canonical EffectiveAction binding

本次新增 staged-replan 分支直接比较裸 "autonomous_replan_required"，当前 required semantic-vocabulary-drift-smoke.py 因 effective_action literal 位于 owner 之外而失败；同一检查在实际 base 12803354 通过。最新 head 又修正了显式 off 的真实 CLI 测试；生产代码的这处失败仍在。请从现有 ./effective_action.generated.ts 引入 EffectiveAction，改用 EffectiveAction.AUTONOMOUS_REPLAN_REQUIRED，保留其他 gate 条件，再重跑 semantic scan、typecheck 和 first-read/replan 场景；无需新增 vocabulary owner 或放宽检查。