[loopx-agent]

Problem and resulting behavior

Quota, Turn and heartbeat callers previously composed overlapping executable inputs. This C1 candidate composes one complete source through the existing TypeScript owner before capture and passes that source to the final host input. Python retains source/transport IO. Fresh input uses loopx_turn_envelope_v1; executor projections must agree with its identity, authority, action and settlement before dispatch. Historical journals keep their recorded decoder, bytes, Turn key and settlement identity.

Tested head: b2cc17ebb1d0de6dcc31132f65a381a37914acf6, integrating main d430c0396017bc9d53350e22126407f30b8bd653 through b11136490. Native context delivery remains opt-in. No live install, default promotion, model experiment or merge is included.

Draft reflects unfinished author work: complete quota presentation, crowded-plan cost and remaining reader/rollback qualification still need implementation. Pending review or CI is not the reason for Draft.

Implementation and consumers

• Quota and native Turn use the same complete composition, integrity and source-binding owner before capture. The original admission/poll receipt is retained once; unknown optional facts remain intact and the checked unsupported root/interaction execution semantics reject before dispatch.
• Exact acceptance, authoring, Vision and task sharing reuse the TypeScript numeric-identity/edit owner. Native planning and encoding share the existing context-delivery transaction; the duplicate algorithm and standalone planner RPC are removed.
• Default turn plan is explicitly inspection-only and omits a second complete contract. The explicit --include-transaction-detail consumer and actual execution keep the complete source, session and transaction. Restoring transaction fields cannot turn a source-less inspection into an executable request.
• Fresh input and recovery preserve the same complete source through native Codex and structured-host seams. Selection, source-loss, wrong-binding, incompatible-version and duplicate-settlement cases exercise actual isolated File/SQLite CLI/Host paths. A successful transport does not establish model retention or comprehension.
• Heartbeat templates own the ordered settlement instruction. Exact-Turn binding adds its canonical source locator instead of another execution instruction. Thin prompts share the unchanged progress/outcome clauses and require complete capture/context reads before action; capture/handoff flags, exact identities, evidence, recovery and stop obligations remain.
• The selected-replan consumer now follows opaque reader references from current main rather than expecting a digest in model output. It compares the full pinned source with the admitted contract and rejects byte-changed captures without allocating admission or spend. No basename assumption or second guard is used for recovery.

The new prompt work removes duplicate presentation in the existing Python heartbeat owner; it creates no parallel decision engine, protocol vocabulary or configuration. Historical decoders remain named migration consumers until their supported recovery/retirement boundary qualifies. Optional SDK/MemT/installed-host paths remain separately qualified.

Validation at this head

All execution uses synthetic fixtures or deterministic local transports. No external model, paid/scientific run, CI query or manual CI trigger ran.

Check	Result and boundary
Complete source, capture, opaque readers, Host input and selection/replan recovery	229 passed, 290.92 s, including actual File/SQLite transport, original receipt, wrong-source refusal and once-only settlement
Heartbeat obligations, native hard limit, platform routes and complete thin-route counterfactual	115 passed / 1 skipped; native 4,000-character limit unchanged
Full TypeScript owners/consumers	5,815 passed / 77 skipped; zero failures/cancellations, 245.41 s. Skipped PostgreSQL integrations are not qualified.
TypeScript checking	Passed
Quick premerge for the committed diff and managed Goal	7 direct + 4 selected local checks passed; overall gate held by a stale exact-scope quality receipt. No merge readiness is claimed.
Complete CLI-output module	36 passed / 4 failed / 1 skipped; the failures below remain delivery holds
Focused lint, diff and bilingual RFC checks	Passed, including staged and committed RFC pairs
Public boundary and DCO	110 changed paths scanned, no errors; one unchanged synthetic Authorization-fixture warning also exists on the verified main. Both new commits are signed.

On the unchanged full-route fixture (320-character scope, explicit CLI and five capabilities), the unbound thin body moves 4,981 → 4,895 budget characters, passing the original 4,900 ceiling. The oversized-route negative still fails. The separately measured exact-Turn variant improves 5,198 → 4,987 and remains over that ceiling. No fixture population, route, capability, required clause or limit was shortened. These character counts are presentation measurements, not token, invoice, model-adoption or outcome-benefit measurements.

The four remaining original output failures are:

Surface	Actual	Existing ceiling
Complete quota Markdown, small	30,462	10,000
Crowded plan	24,044	22,500
Crowded plan with Vision	27,508	22,500
Former envelope alias, complete JSON	24,252	13,000

Absolute, line and growth gates remain independent. Full unmarked Goal material, unknown controls and required reads cannot be omitted to satisfy these ceilings. The original 5 failed / 35 passed / 1 skipped and earlier 15 / 25 / 1 observations remain failures; the table records the later implementation result rather than relabeling history.

The first integrated matrix exposed two old digest-field assertions (227 passed / 2 failed). An initial test migration then incorrectly assumed the recovery basename was decision.json; the transport owns a byte-verified full projection. The final consumer compares the actual pinned source and complete content instead. Both failed observations are retained. The earlier explicit-detail regression (4 failures / 44 dependent setup errors), old native-version results and old TypeScript counts retain their original source/qualification boundaries; they do not certify this head.

Remaining acceptance

1. Finish final carrier/caller presentation and cost repair, including the exact-Turn long-route prompt, without dropping required semantics or raising limits to hide growth.
2. Finish supported-reader exit, refusal/recovery/rollback and packaged-host qualification. SDK profiles lacking explicit native runtime, optional MemT lifetime and PostgreSQL qualification remain explicit gaps.
3. Compare necessary semantics, actual decisions, accepted outcomes and complete costs on the same single-session path, using original quota as the primary baseline. Evaluate two-session operation separately.

The bilingual C1 RFC and its source-convergence checkpoint remain open. This candidate is a migration step, not final C1 cutover or proof of benefit. It changes no visual layout and grants no historical-reader retirement or merge readiness.

Written by: model_agent; Codex.

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @loopx-agent.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @loopx-agent.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @loopx-agent.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @loopx-agent.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @loopx-agent.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[songoow]

Token 优化建议：把验收落到实际消费链与完整成本

针对本 Draft 当前 head 35e4ef22674a2000b22a96241a7cdd7c3ae3ba33 的后续设计建议。本条沿用 PR 已声明的 C1/C2 和 single-session 方向，不把内部 source 合并等同于已交付的 token 收益，也不新增合并阻塞项。

可以优先验证实际 caller 对已有入口的采用。当前 main 21367015cce45294dcf99f54a3211d66f5d842c5 已有同 capture 的批量选读、staged replan reader，以及 settlement_command=refresh-state … --settle-turn；其 Turn envelope 明确要求 settled readback 后不再手动 quota step。建议下一片复用现有 typed settlement owner，验证这些入口是否实际减少调用，而非增加一层结算或把原本合法的分步协议视为错误。当前 stride producer 也已经投递原 explore revision，不能用自动猜测 revision 来缩短恢复。

建议把同来源、同任务状态的 original quota / candidate 对照组织为四条消费者路径：

路径	应证明的行为
冷态选择	目录和必要详情能支持正确选择；小任务也保留 staging 反而更贵的样本
已准入任务继续	同 capture 内批量读取必要字段，避免不必要的根目录再发现；必读约束仍被消费
重规划	原 evidence revision、候选及反证影响实际选择，写回后完成原身份结算
读取中断恢复	使用原 capture/recovery；detail 缺失、截断及来源更新得到明确处理，不通过重新 admission 绕过约束

每条都贯通 entry → review/必要详情 → 实际工作 → writeback → settled readback，保持原 identity、lease/freshness、验证和幂等扣额。原计划中 completion、blocked/no-spend、失败恢复等分支继续适用，不能机械把所有路径替换为组合命令。

成本可复用现有 request usage 计量，记录入口正文、全部工具回执与补读、分页、失败恢复、模型请求数、input/cached/output token、压缩请求，以及到达有效工作的时间。若以后采用 controller/executor 两个会话，两边及交接都计入。单个响应字节下降、少一次 CLI 或内部 source 收敛可以证明局部工程变化；净 token 和费用收益仍需完整请求对照。

语义样本建议显式覆盖：候选正文尾部的决定性约束、显示范围之外的有用替代项、跨 Agent 依赖和反证、未知相关性。未知 scope 回到完整来源；只读目录不证明隐藏正文已读，已选 Todo 也不证明其他候选都无关。验收应检查这些事实是否实际改变选择或约束执行。

验证边界：我在上述 main 运行了三个真实 SQLite 源码 CLI 用例，普通 progress/completion 的组合 refresh/settle 两例通过，staged review/writeback 一例通过；前两例覆盖原 Turn 身份与重放单次扣额，第三例覆盖原 capture/digest、无 registry reader、篡改拒绝和有效语义写回。第三例最后使用 fixture refresh，不能扩大为完整 stride＋组合结算资格。它们不是此 Draft 的全量验证，也未运行模型或长程 benchmark。

这是一项非阻塞的消费者采用与验收建议；不改变本 PR 已披露的 Draft 状态和剩余资格缺口。

Reviewer: actor_kind=model_agent; model=GPT-6 Astra Pro; provider=OpenAI; declaration_source=self_reported.

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @loopx-agent.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork