[loopx-agent]

Supported native Codex App/SSH sessions and new benchmark heartbeat trials now use context delivery when no preference was saved. Existing saved off, --context-delivery off and a trial's explicit off keep working. Ordinary CLI, other hosts/platforms and non-heartbeat benchmark modes keep their existing full-delivery paths. This default change is requested by the maintainer for 2.2.

The registered machine namespace supplies the App default and its existing switch; the CLI resolves that same template instead of adding another configuration. Benchmark adapters resolve an omitted value through their shared Execution owner and pin off/on in worker and native-shell configuration. No new worker, model request, execution grant or Goal writer is created by enabling presentation. Delta still requires a ready native lifecycle and retained complete context.

Native setup failure now narrows that wake to full delivery, including the native shell whose frozen trial configuration still records the requested on. A process-local rollback of the previous worker reproduces the wrong navigation envelope in an ordinary guard; the repaired native File/SQLite cases preserve raw decision readback and the original Turn. The requested setting and setup failure remain observable, without rewriting a frozen trial.

Disable in Settings → This machine → Capabilities → Differential context → Codex, pass --context-delivery off for one command, or set benchmark context_delivery: "off" / --context-delivery off for a new trial. Removing a saved machine namespace restores the new on default. Existing trials retain their recorded source and treatment. The lifecycle and English/Chinese context documentation are updated together.

Validation

At exact head 18726cd40df9e8280101a918528e042fa220ac63, all twelve owning context, quota and benchmark modules pass: 939 passed, 17 explicit native skips with actual Harbor and SForge dependencies. The two original native Codex planning/resume cases pass separately against an isolated local Responses fixture. All eight native File/SQLite default/on/off and unavailable-setup cases also pass separately; seven unchanged saved-preflight native cases remain explicit skips. No benchmark study or paid model call is launched.

The canonical Chat bundle, normalized wheel/sdist, checksums and strict Twine 6.2 checks pass. A fresh Python 3.11 installation of this exact-head wheel passes the existing configuration-backup browser journey against its real backend: default-on, saved off/reload, failed apply preserving off, re-enable and sibling-setting preservation. Desktop and narrow installed viewports were inspected. Changed Python Ruff, all configured mypy modules, bilingual diff and semantic-vocabulary advisory pass. The boundary scan has zero errors and one pre-existing synthetic Authorization-example warning; no secret was found or suppressed.

The broader default-on probe initially failed nine of 514 public entries. All ten targeted entries (the original nine plus the catalog planner) then passed at f6a244aaa9e2; their production and smoke sources are unchanged at this head. Raw policy observers now request explicit off; generated native startup commands execute unchanged and inspect their current hash-verified recovery without another admission. The SSH onboarding smoke follows the actual native reader, and the existing scheduler profile now selects both changed owner paths. Quota policy, original Turn identity, source-state and spend assertions remain in place. A timeout test observes the actual launched PID and checks OS reaping even if its one-second budget expires before fixture startup; that budget is unchanged.

The maintainer's remote rebase and test fixes were integrated with a normal merge. Earlier failed probes remain recorded as failures. Standard Goal premerge completes all six direct checks and 19 selected checks with no test or policy failure. Its exit 1 is the benchmark-sensitive manual review hold. Exact-scope receipt cqr_884cb2ad25ac99e5600b is valid against base d430c0396017; the independent exact-head Review-A conclusion remains pending. No CI status is queried under the configured policy. SHA reference PR #7812 is merged. Full release qualification remains a separate gate at the final frozen release source.

Visual evidence

Synthetic public fixtures; actual settings backend and browser. Before: packaged candidate 9610afb0e256. The displayed after captures are from development source 614d9fe1f924; that production settings module is byte-identical at 18726cd40df9. Fresh installed Python 3.11 captures and the complete real-backend journey were also inspected at 18726cd40df9, with the same composition. Reviewed the complete 1512×982 and 390×844 viewports: one existing Codex switch, effective-default source, readable one-line status and collapsed setup details. The mobile status stays above the existing backup panel. This is browser evidence, not native WebView or live-model adoption.

Before

After · desktop

After · narrow

[huangruiteng]

Rebased onto current main and fixed the integration gap exposed by composing default-on delivery with the new reader-reference path.

Two tests whose purpose is to inspect the unwrapped should-run decision now pass --context-delivery off explicitly; default-on and explicit-on behavior remain covered by their dedicated native File/SQLite cases. The no-saved-preference fixture also follows the current reference navigation contract while preserving its expected absent continuity generation before a setting is persisted.

Exact head cee0d473aa685f84d94ca3badd2997d33e7c4365: 168 passed, 394 explicitly skipped across the directly affected CLI/machine/benchmark files; Ruff and diff checks pass. loopx check reports both touched test files public-boundary clean, while its overall process remains nonzero because this machine's shared registry contains unrelated legacy Goal migration errors.

[loopx-agent]

Reviewer: model_agent | model=gpt-6.1-sol | provider=OpenAI | runtime_reported | effort=max

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

结论：完整审查支持 APPROVE，仅针对 #781518726cd。未发现当前 diff 的阻塞问题；标准 premerge 仍有 benchmark-sensitive 人工合并门槛，本结论不授予合并或发布权限。CI 未查询、轮询或等待。

动机

未保存差分上下文偏好的 Codex App/SSH 用户，以及新建 heartbeat benchmark trial 的维护者，需要默认使用同一已有上下文呈现能力，并能明确关闭和读回实际状态。

此前没有保存偏好时，受支持的 native Codex 与新 heartbeat trial 默认 off；现在默认 on。已保存 off、命令显式 off、worker 环境 off 和 trial 显式 off 继续走原有关闭路径，其他 host 与非 heartbeat 模式保持原路径。

在真实 File/SQLite CLI 与实际 native Codex 的隔离 loopback 中，默认路径可读取当前完整 capture 并保留原 Turn；显式 off 保持 raw guard，native setup 失败同时收窄 worker 与 native shell 到 off。真实设置后端支持默认值、保存 off、reload、失败不覆盖原值与恢复重试。

本次只调整既有上下文呈现选项的省略值和对应设置读回，不启用双会话 controller/executor profile，不改变准入、调度、结算或 benchmark 评分，不重写冻结 trial，也不宣称模型采用、长程收益或完整发布资格已验证。

这里的 on 是已有上下文呈现选项；没有可用 native baseline 时仍需读取当前完整 capture，不能把文件存在、引用或测试 fixture 当成模型已经读完。独立 real CLI 对照中，base 为 raw should-run，head 为 full reference 加一次 EOF 读取；这次读取是实际成本，没有被归一化消掉。

先读取实际 merge base b000bf35d50b06b671799ad81c49ab7a3ae15a24 的 docs/reference/required-work-context.md（Opt-in native reuse、Machine default）以及 docs/architecture/rfcs/controller-executor-unified-contract-v0.md §§1/3/5/9/11。旧规范中的 absent off 是本次明确提出的政策变化，不能称为完全行为等价。审查映射为：Opt-in native reuse / exact-source recovery、Machine default / precedence and opt-out、Machine default / host and unavailable boundaries、Machine default / absent preference policy、Controller/executor §5 / original identity，分别由当前完整来源恢复、配对 off/拒绝、实际 native fallback 和真实设置读回覆盖。以上标签指原章节条款，不是新建的 RFC ID。

Controller/executor §11 C9 / unified-profile adoption 仍在原统一替换计划的验收范围：App/benchmark acceptance 与 matched outcome/full-cost benefit 未完成。本 PR 提升的是已有单会话呈现选项的默认值，没有切换融合 contract producer/reader 或双会话 profile；不能据此关闭 C1–C9，也不能把较少原文输出称为净收益。该区分与 §11 对现有 native C2 precursor 的独立交付边界一致，没有改写冻结实验标准。

改动思路

默认值由现有 machine namespace 与 benchmark Execution owner 分别在各自输入边界解析；CLI、设置页和 native worker 复用它们，避免在 adapter 或界面中再维护一套默认策略。native setup 失败时，实际 shell 配置也必须同步收窄，父进程环境 off 单独不足以覆盖冻结配置中的 on。

当前完整边界是既有选项的默认 on、显式关闭隔离、native setup 失败恢复、真实设置读回及受影响 smoke 的原决策观察；没有新增持久化 mode、第二个权限 owner 或统一双会话协议。

既有 capability namespace context_delivery_machine_defaults_v0 仍只有 off/on。CLI 从同一注册模板取缺省值，设置页显示同一默认；benchmark 的 Execution 将省略值解析成已有 off/on，再由 Harbor、SForge、EdgeBench 和 worker 使用。None 是构造输入的省略态，没有增加持久化 mode。Python 改动处于已有 CLI IO 和 native benchmark adapter，沿用现有 TypeScript context codec 与权限/结算 owner，没有另建 Python 决策体系。

最强反例是 native setup 失败：仅把父进程 env 改成 off，冻结配置中的 native shell on 仍能压过它。本次独立地只移除进程内 shell override，不改测试 oracle 或工作树源码，真实 Codex 的 File/SQLite 两项均失败，返回 navigation 且 should_run:null；原 head 重跑两项通过。这比只检查构造参数或 mock 环境更能验证真实 fallback。

bounded refactoring 结论为 unnecessary：现有 namespace、Execution、设置 apply 和 smoke isolation 已能承载本切片；没有需要再抽出的共享机制。UI-only/docs-only、第二套 adapter 默认值和新 mode 都无法以更小完整边界解决同一问题。

具体改动

关键代码讲解

审查完整 base-to-head 29 文件 +379/-93，不是只审最后一次修复。先前 cee 范围和最终 13 个更新路径逐项检查；其中 12 个已审 production/doc blob 在最终 head 字节一致。当前 target tip 为 d430c0396017bc9d53350e22126407f30b8bd653，实际 merge base 为 b000bf35d50b06b671799ad81c49ab7a3ae15a24；目标 main 的后来提交不被冒充成此 head 的祖先。

• apply_context_machine_options：显式 off、worker env off 与保存值保留优先级，仅没有 namespace 才使用注册默认。默认不可用时走已有 full 路径；saved/explicit on 的无效声明仍在准入前拒绝。显式 hash/source recovery 不再依赖无关 machine/Goal discovery。
• Execution.__post_init__：省略值只在 heartbeat 解析为 on，其他模式 off；显式值不覆盖。resolved off/on 固定到 native shell，已有冻结 trial 的 source/treatment 不被重写。
• native_command 与 run_once：setup 失败记录 unavailable、清除派生 context/trust 参数，同时让实际 shell off。requested on 仍保留在冻结记录，观察失败不被改成配置成功。
• MachineConfigurationSettings：528–542 分支复用已有 switch、preview/apply 和默认来源；saved off 与默认 on 可区分，实际 native 使用保持未验证状态。没有增加第二个开关或 UI 权限。

变更后的 policy observer 明确要求 raw off；生成的 native startup command 原样执行，然后读取它当前 hash-pinned capture 的 typed 决策，不改写命令或伪造新准入。reentry 从 canonical interaction contract 获取。超时测试仍是原来一秒预算，只把进程 PID 的观察放到实际 Popen 边界，继续检查 OS reaping，而不要求高负载下子进程已来得及写 PID 文件。

对主干的风险

独立执行	当前结果与限制
7 个 owning context/quota/benchmark Python 模块	473 passed, 403 skipped；跳过保留，未称全通过
5 个实际 settings API、配置与 context lifecycle/capture/resume 模块	261 passed, 46 skipped
实际 native Codex default/off/unavailable，File/SQLite	8 passed；本地静态 SSE/Responses fixture，无真实模型推理或付费任务
原 planning/resume native 用例	2 passed；初次 opt-in env 用错得到的 2 skips 仍保留
immutable base/head 的 off/host/拒绝配对	各 13 passed；四个既有测试和 configure helper 的 AST hash 完全相同；base 另一个 native SQLite explicit-off control 通过
independent default reader	同 fixture 指纹 26b40e7311f4ec23fa10a8680b7bfb12c44de06144b839a7441f150d4cb501eb；两 provider 都保留完整原决策、Turn、一次 guard receipt、零 spend 和不变 Goal source
fallback oracle 敏感性	私有进程内 mutation 2 expected failures，原 head 2 passed；未把失败日志改为通过
真实设置后端与 browser	默认 on、save off/reload、503 保留 off、retry on、反向失败保留 on、兄弟 SQLite 配置不变；桌面/窄屏整页检查
两项额外 public smoke	原直接运行有 host default-runtime 路由冲突；仓库原生隔离 smoke-suite 2/2 passed，0 failure/无 tracked side effect；没有清理真实 runtime
build/type/static	当前 canonical Chat build；相同 TypeScript/配置 blob 的 typecheck；mypy 17 sources、changed Python Ruff、diff semantic advisory 后 full smoke、bilingual/diff checks 通过；既有 bundle-size advisory 保留
current exact-scope qualification	CQR cqr_884cb2ad25ac99e5600b 已 verify valid；native premerge 6 direct +19 selected，0 test/policy failure，1 benchmark-sensitive manual hold；因此总进程 exit 1 不是 all-green merge/readiness 声明

第一次 premerge 引用了前一 PR 的 CQR，报 quality_stale_receipt；原失败保留。随后写入本 PR 的完整 exact-scope receipt，再执行 standard premerge，并未豁免验证。public/private scan 为 0 error、1 warning：test_quota_settlement_cli.py:7409 的静态 Authorization: example 负例与 base 7391 相同，不是凭据，没有隐藏 warning。

可选 adapter 的全量启动和其余 native preflight 未独立完成，403+46 skips 不能由作者额外依赖环境的结果代替。没有运行 benchmark study、真实模型调用或 active Goal 破坏性测试。默认启用会增加 complete-source reader 的实际调用，长期效果与总成本仍需匹配实验，不能由 JSON、测试数量或界面勾选推断。

语义与 CI 对齐

默认行为有意改变；隔离结论指 saved/explicit off 保持，不是声称 feature 默认 off。ordinary CLI、其他 host/平台、非 heartbeat 模式和冻结 trial 保持原边界；catalog/support/配置成功不表示实际 delta 已使用，也不授予新工作权限。on 不改变 required-read 顺序、原 Turn、Stop、准入或结算。CI 依当前策略未查询、未等待，未知状态不单独阻止本次审查结论；本地负例、人工合并门槛和完整发布资格继续各自保留。

我的整体评价

当前 head 的现有 capability 已有真实调用、错误恢复、原始来源与设置读回，能独立交付这个默认值切片；没有只增加字段或 mock 后就宣布完整交付。显式关闭、saved off、native fallback 与不变冻结 trial 共同构成可回滚边界。可在原设置保存 off、命令加 --context-delivery off，或新 trial 显式 off；删除保存 namespace 会恢复新的 on 默认，不能作为关闭方式。

已在当前 head 的 canonical Chat build 与真实隔离 machine-settings 后端检查完整页面：1200×888/1512×982 桌面和 390×844 窄屏，含默认 on、saved off/reload、saved on、帮助展开、503 失败与重试。页面保留一个 Codex 开关和默认/保存来源，明确实际 native 使用尚未验证；窄屏失败信息在既有卡片内部滚动后可见。

unverified_scope：审查者未验证已安装 wheel、native WebView、真实模型采用或全量可选 adapter 启动；本次浏览器是当前源代码 build 加真实后端的合成隔离实例。PR 的 before 图来自作者标明的 9610afb，相关组件与实际 base 字节一致；作者的安装与额外依赖结果未冒充为本次独立执行。

正常窄屏视图的帮助保持折叠；展开帮助和失败状态另行检查。已有卡片内部滚动约 127px 后能看到窄屏错误，因此不声称每个 viewport 的第一屏都显示完整错误。页面仍有同一能力列表、性能/usage 折叠项与 backup 区域，没有把实现说明铺成额外产品步骤。PR description 已提供作者标明来源的 before/after；本审查另外运行了当前源代码的真实后端 journey。

没有继承作者的安装、可选依赖或模型收益结论，也没有把历史失败改写成 pass。当前之前无正式 review/inline finding，唯一已有 integration comment 已读，不需要 dismiss。本账号与作者相同，故发布 COMMENTED 的 approval conclusion，随后执行 exact-head 远端读回与 closeout；不执行合并、发布或 dismiss。

English verdict: APPROVE for #781518726cd. The supported default-on proposal preserves explicit-off, original-source/Turn and frozen-trial boundaries; actual native setup fallback and real settings recovery pass. Benchmark-sensitive merge authority, optional/installed qualification and measured model benefit remain explicit.

[loopx-agent]

Release-owner merge decision

本批次已有 maintainer 合并授权。本记录针对 18726cd40df9e8280101a918528e042fa220ac63：受支持的 POSIX Codex App／SSH 和新 benchmark heartbeat 默认开启 context delivery，保存的 off、命令 off 和 trial off 继续生效；普通 CLI／其他宿主保留完整交付。机器配置、实际原生 setup 与本轮有效传输各归原 owner，没有新增准入、租约、结算或实验执行权。

作者侧验证：12 个 owning 模块 939 PASS；其中17项显式 native skip 单列，另行完成8项真实 native default／off／setup-failure 与2项原 native resume 的 loopback 检查，余下7项 saved-preflight native case 未执行。安装的 Python3.11 wheel 连接真实 settings backend，默认 on、关闭、重载、503 失败保留 off、重新开启及 sibling preservation PASS，并检查桌面和窄屏截图。规范 bundle／wheel／sdist、Twine6.2、Ruff、配置的 mypy、双语检查和当前 diff 公共边界检查通过；一项原有合成 Authorization 警告单列保留。

当前 exact-head risk premerge 的6个 direct checks 与19个 selected checks 全部通过，自动化失败为零；原始 exit1 来自 benchmark-sensitive 人工审阅门槛。该门槛按本次精确代码、独立复验和 maintainer 已有授权作出判断：改动是已明确披露的新 trial 默认及原 off 隔离，任务内容、打分、judge、模型和预算未改，未启动 benchmark job。早先各轮失败及未测范围保留。

完整精确 head 审阅和原生 merge-readiness 必须在实际合并前单独通过并读回；本记录不能替代它们。合并仅交付本次默认值与关闭／恢复路径，LoopX2.2.0 的完整同源码、真实模型、安装升级与公开渠道资格仍在后续统一版本上完成。