{selectedCurrent?.mode === "on"
- ? locale === "zh-CN" ? "已为 Codex 保存开启偏好；宿主就绪与实际使用尚未验证。" : "Codex preference is on; host readiness and actual use are not verified."
- : locale === "zh-CN" ? "Codex 未开启。" : "Off for Codex."}
+
{(selectedCurrent?.mode ?? selected.default.mode) === "on"
+ ? selectedCurrent
+ ? locale === "zh-CN" ? "已为 Codex 保存开启偏好；宿主就绪与实际使用尚未验证。" : "Codex preference is on; host readiness and actual use are not verified."
+ : locale === "zh-CN" ? "Codex 默认开启；宿主就绪与实际使用尚未验证。" : "On by default for Codex; host readiness and actual use are not verified."
+ : locale === "zh-CN" ? "Codex 已关闭。" : "Off for Codex."}
{locale === "zh-CN"
? "目前仅支持 Codex App 心跳和 benchmark 心跳，无法确认或不支持的跑法报错。保存偏好不代表当前会话已采用差分，也不会改变其他应用或显式关闭的实验。宿主准备就绪且旧上下文完整时才使用差分，否则保留完整上下文。私有存储与会话隔离自动管理；每轮回执显示实际传输方式。"
: "Currently supports only Codex App and benchmark heartbeats; unknown or unsupported declarations return an error. Saving a preference does not establish use in the current session or change other applications or explicitly disabled runs. Delta requires a ready host and complete retained context; otherwise full context is preserved. Private storage and session isolation are automatic; each delivery reports its actual mode."}
diff --git a/benchmark/README.md b/benchmark/README.md
index ce3f038d86..f4bb9b95ea 100644
--- a/benchmark/README.md
+++ b/benchmark/README.md
@@ -878,7 +878,10 @@ must actually deliver a complete full packet and later deltas across worker
wakes; every fresh receiver must begin with a complete current full packet.
The static inference follows model-visible page cursors, and a separate byte-map
oracle checks complete delivery and retained delta bases before candidate work.
-The default remains `off`. Neither mode measures paid inference, task quality or
+This joint qualifier deliberately retains its explicit `off` control by default;
+new benchmark heartbeat workers default on and can select `--context-delivery off`.
+Do not mutate a frozen trial to adopt that changed default.
+Neither qualifier mode measures paid inference, task quality or
fees; reusing a point still does not count its source test as passed in this run.
The public fixture runs six actual native work wakes, captures the pending
diff --git a/benchmark/edgebench/run.py b/benchmark/edgebench/run.py
index 98f65a8f5e..2068e743f7 100644
--- a/benchmark/edgebench/run.py
+++ b/benchmark/edgebench/run.py
@@ -29,7 +29,7 @@
from sforge.harness.run_agent import run_agent
from sforge.harness.task_spec import make_task_spec
-from benchmark.runtime.codex import TASK_ENTRIES, turn_envelope_receipt
+from benchmark.runtime.codex import Execution, TASK_ENTRIES, turn_envelope_receipt
from loopx.reasoning_effort import REASONING_EFFORTS
from loopx.control_plane.work_items.stride_policy_codec import stride_strategy_options
from benchmark.runtime.sforge import (
@@ -121,8 +121,8 @@ def main(argv=None):
help="New-run default: native public feedback; blind/best-only are explicit controls")
parser.add_argument("--turn-envelope", action="store_true",
help="Opt-in short heartbeat context with same-invocation full captures")
- parser.add_argument("--context-delivery", choices=("off", "on"), default="off",
- help="Experimental native Codex benchmark heartbeat reuse only; off by default")
+ parser.add_argument("--context-delivery", choices=("off", "on"),
+ help="Native Codex context delivery: on by default for heartbeat workers; pass off to disable")
parser.add_argument("--provider-request-admission", action="store_true",
help="Opt-in canonical admission before each heartbeat custom Responses request")
parser.add_argument("--native-goal-continue", action="store_true",
@@ -197,6 +197,8 @@ def main(argv=None):
parser.error("--task-entry loopx-planned requires a heartbeat worker")
if args.turn_envelope and args.worker not in {"heartbeat-resume", "heartbeat-explore"}:
parser.error("--turn-envelope requires a heartbeat worker")
+ if args.context_delivery is None:
+ args.context_delivery = Execution(mode="heartbeat" if args.worker.startswith("heartbeat-") else "plain").context_delivery
if args.context_delivery != "off" and not args.worker.startswith("heartbeat-"):
parser.error("--context-delivery requires a heartbeat worker")
if args.provider_request_admission:
diff --git a/benchmark/runtime/RUNTIME.md b/benchmark/runtime/RUNTIME.md
index bc81447238..0612e59cf7 100644
--- a/benchmark/runtime/RUNTIME.md
+++ b/benchmark/runtime/RUNTIME.md
@@ -45,13 +45,17 @@ fail before execution. Set it back to `false` for the next run to roll back;
do not change a running trial's treatment. Captures contain private Goal context.
Transport tests do not establish lower token cost or better model decisions.
-For an explicitly selected native context-delivery treatment, add
-`context_delivery: "on"` to the same heartbeat agent `kwargs` (default `"off"`).
+New native heartbeat trials default to context delivery `on`. Add
+`context_delivery: "off"` to the same heartbeat agent `kwargs` to disable it.
+An explicit off is pinned into both native tools and worker preflight; it cannot
+inherit a machine-wide on. Plain, native-Goal and Turn execution remain off.
Only the existing Codex heartbeat worker accepts `"on"`; booleans, other modes and
scenario names are rejected. This is an experimental transport setting, separate
from `turn_envelope`.
The existing EdgeBench/SForge entry exposes the same selection through
-`--context-delivery on` on a heartbeat worker (`off` is the default).
+`--context-delivery off` to disable a heartbeat worker's on default. Existing
+running or frozen trials retain their recorded source and treatment; do not
+change them in place or infer a matched comparison from the new default.
The worker preserves its existing `generic_cli` scheduler profile. Its execution
owner requires `mode=heartbeat` and explicitly propagates `LOOPX_EXECUTION_MODE=heartbeat`
and `LOOPX_CONTEXT_DELIVERY=on` into the native tool environment. Generic CLI
diff --git a/benchmark/runtime/codex.py b/benchmark/runtime/codex.py
index 35980340a1..203c560678 100644
--- a/benchmark/runtime/codex.py
+++ b/benchmark/runtime/codex.py
@@ -28,11 +28,13 @@ class Execution:
validation_command: tuple[str, ...] = ()
task_entry: str | None = None
turn_envelope: bool = False
- context_delivery: str = "off"
+ context_delivery: str | None = None
def __post_init__(self) -> None:
if self.context is None:
object.__setattr__(self, "context", "resume" if self.mode in {"heartbeat", "turn"} else "fresh")
+ if self.context_delivery is None:
+ object.__setattr__(self, "context_delivery", "on" if self.mode == "heartbeat" else "off")
if self.context_delivery not in ("off", "on") or (self.context_delivery != "off" and self.mode != "heartbeat"):
raise ValueError("context_delivery supports only off or on with heartbeat execution")
if not isinstance(self.turn_envelope, bool) or (self.turn_envelope and self.mode != "heartbeat"):
@@ -157,7 +159,8 @@ def codex_settings(
# policy explicitly so model tools cannot silently lose it.
"[shell_environment_policy.set]",
'LOOPX_USAGE_PING = "0"',
- *(['LOOPX_CONTEXT_DELIVERY = "on"', 'LOOPX_EXECUTION_MODE = "heartbeat"'] if execution.context_delivery != "off" else []),
+ f"LOOPX_CONTEXT_DELIVERY = {json.dumps(execution.context_delivery)}",
+ *(['LOOPX_EXECUTION_MODE = "heartbeat"'] if execution.context_delivery != "off" else []),
"[features]",
f"goals = {str(execution.native_goal).lower()}",
"unified_exec = true",
diff --git a/benchmark/runtime/harbor.py b/benchmark/runtime/harbor.py
index 8733c3873d..e5f355fb05 100644
--- a/benchmark/runtime/harbor.py
+++ b/benchmark/runtime/harbor.py
@@ -74,7 +74,7 @@ def __init__(
task_entry=None,
planning_timeout_sec=None,
turn_envelope=False,
- context_delivery="off",
+ context_delivery=None,
provider_request_admission=False,
native_goal_continue=False,
task_objective=None,
@@ -634,7 +634,7 @@ def _worker_env(self, *, cwd: str) -> dict[str, str]:
**({"LOOPX_CHECKPOINT_REQUEST": self.checkpoint_request_path}
if self.checkpoint_request_path is not None else {}),
**({"LOOPX_TURN_ENVELOPE": "1"} if self.execution.turn_envelope else {}),
- **({"LOOPX_CONTEXT_DELIVERY": "on"} if self.execution.context_delivery != "off" else {}),
+ "LOOPX_CONTEXT_DELIVERY": self.execution.context_delivery,
**({"LOOPX_PROVIDER_REQUEST_ADMISSION": "on"} if self.provider_request_admission else {}),
**({"LOOPX_NATIVE_GOAL_CONTINUE": "1"} if self.native_goal_continue else {}),
"LOOPX_ITERATION_CONTEXT": self.execution.context,
diff --git a/benchmark/runtime/sforge.py b/benchmark/runtime/sforge.py
index 3ccb5e10cc..634647543d 100644
--- a/benchmark/runtime/sforge.py
+++ b/benchmark/runtime/sforge.py
@@ -93,7 +93,7 @@ def __init__(self, config, *, profile: str, cwd: str,
task_objective: str | None = None,
task_entry: str | None = None,
turn_envelope: bool = False,
- context_delivery: str = "off",
+ context_delivery: str | None = None,
provider_request_admission: bool = False,
native_goal_continue: bool = False,
replan_after_turns: int | None = None,
diff --git a/benchmark/runtime/worker.py b/benchmark/runtime/worker.py
index 6603790d58..268bda61f2 100644
--- a/benchmark/runtime/worker.py
+++ b/benchmark/runtime/worker.py
@@ -490,7 +490,7 @@ def run_once(env: dict[str, str]) -> dict:
validation_command=json.loads(env.get("LOOPX_VALIDATION_COMMAND_JSON", "[]")),
task_entry=env.get("LOOPX_TASK_ENTRY"),
turn_envelope=env.get("LOOPX_TURN_ENVELOPE", "0") == "1",
- context_delivery=env.get("LOOPX_CONTEXT_DELIVERY", "off"),
+ context_delivery=env.get("LOOPX_CONTEXT_DELIVERY"),
)
request_admission = False
if env.get("LOOPX_PROVIDER_REQUEST_ADMISSION", "off") != "off":
@@ -512,7 +512,7 @@ def run_once(env: dict[str, str]) -> dict:
home = Path(env["LOOPX_CODEX_HOME"])
env = process_environment(home, base=env)
# Preserve this trial's resolved off/on choice in both preflight and solver
- # subprocesses; an omitted off must not inherit a machine-wide opt-in.
+ # subprocesses; an explicit off must not inherit a machine-wide default.
env["LOOPX_CONTEXT_DELIVERY"] = execution.context_delivery
# The resolved trial treatment must not inherit an ambient parent opt-in.
if request_admission:
diff --git a/benchmark/tests/test_resume_sessions.py b/benchmark/tests/test_resume_sessions.py
index 45fa067eaf..ef82ff3bff 100644
--- a/benchmark/tests/test_resume_sessions.py
+++ b/benchmark/tests/test_resume_sessions.py
@@ -122,6 +122,8 @@ def resume_env(tmp_path, monkeypatch):
skills.mkdir()
env.update(
LOOPX_EXECUTION_MODE="heartbeat",
+ # These legacy resume fixtures pin their original transport treatment.
+ LOOPX_CONTEXT_DELIVERY="off",
LOOPX_ITERATION_CONTEXT="resume",
LOOPX_RUNTIME_ROOT=str(tmp_path / "runtime"),
LOOPX_REGISTRY=str(tmp_path / "registry.json"),
diff --git a/benchmark/tests/test_sforge_runtime.py b/benchmark/tests/test_sforge_runtime.py
index e9fdaf9bdf..f95b4d6642 100644
--- a/benchmark/tests/test_sforge_runtime.py
+++ b/benchmark/tests/test_sforge_runtime.py
@@ -277,7 +277,7 @@ async def installed(self, environment):
assert "turn_envelope" not in profile
assert "turn_envelope_source" not in profile
assert "LOOPX_TURN_ENVELOPE" not in env
- assert env.get("LOOPX_CONTEXT_DELIVERY") == ("on" if context_delivery != "off" else None)
+ assert env["LOOPX_CONTEXT_DELIVERY"] == context_delivery
assert profile.get("context_delivery") == (context_delivery if context_delivery != "off" else None)
assert profile.get("checkpoint_capture_enabled") is (True if capture_path else None)
with pytest.raises(ValueError, match="checkpoint_request_path"):
diff --git a/benchmark/tests/test_shared_codex_runtime.py b/benchmark/tests/test_shared_codex_runtime.py
index 8e6cef4805..62ba43c04f 100644
--- a/benchmark/tests/test_shared_codex_runtime.py
+++ b/benchmark/tests/test_shared_codex_runtime.py
@@ -60,7 +60,9 @@ def test_mode_default_context_preserves_explicit_fresh_and_transport_opt_ins(tmp
expected = "resume" if mode in {"heartbeat", "turn"} else "fresh"
implicit = Execution(mode=mode, **extra)
assert implicit.context == expected
- assert implicit.context_delivery == "off" and implicit.turn_envelope is False
+ assert implicit.context_delivery == ("on" if mode == "heartbeat" else "off")
+ assert implicit.turn_envelope is False
+ assert Execution(mode=mode, context_delivery="off", **extra).context_delivery == "off"
assert Execution(mode=mode, context="fresh", **extra).context == "fresh"
if expected == "fresh":
with pytest.raises(ValueError, match="resume requires"):
@@ -936,7 +938,7 @@ async def task_exec(**kwargs):
assert ("turn_envelope" in receipt) is (expected is not None)
assert receipt.get("turn_envelope_source") == expected
assert receipt.get("context_delivery") == (context_delivery if context_delivery != "off" else None)
- assert agent._worker_env(cwd="/task").get("LOOPX_CONTEXT_DELIVERY") == ("on" if context_delivery != "off" else None)
+ assert agent._worker_env(cwd="/task")["LOOPX_CONTEXT_DELIVERY"] == context_delivery
assert receipt.get("provider_request_admission") == ("on" if provider_request_admission else None)
worker_env = agent._worker_env(cwd="/task")
assert worker_env.get("LOOPX_PROVIDER_REQUEST_ADMISSION") == ("on" if provider_request_admission else None)
@@ -1205,20 +1207,21 @@ def test_native_context_opt_in_is_only_a_heartbeat_treatment(mode):
@pytest.mark.parametrize("declared_mode", [None, "heartbeat"])
-def test_context_preflight_accepts_the_resolved_heartbeat_mode(tmp_path, monkeypatch, declared_mode):
+def test_context_preflight_defaults_on_and_exports_resolved_heartbeat_mode(tmp_path, monkeypatch, declared_mode):
from benchmark.tests.test_resume_sessions import resume_env
from loopx.control_plane.turn_driver.codex_context import context_delivery_activation
env = resume_env(tmp_path, monkeypatch)
if declared_mode is None:
env.pop("LOOPX_EXECUTION_MODE")
- env["LOOPX_CONTEXT_DELIVERY"] = "on"
+ env.pop("LOOPX_CONTEXT_DELIVERY", None)
monkeypatch.setattr("benchmark.runtime.context_delivery.prepare_context_delivery", lambda *args: None)
def preflight(current, *_args, **_kwargs):
activation = context_delivery_activation("on", runtime_profile="generic_cli",
benchmark_mode=current.get("LOOPX_EXECUTION_MODE"))
assert activation["scenario"] == "codex_benchmark_heartbeat"
+ assert current["LOOPX_CONTEXT_DELIVERY"] == "on"
return "Current Todo input."
monkeypatch.setattr("benchmark.runtime.worker.heartbeat_body", preflight)
@@ -1277,7 +1280,7 @@ def test_context_selection_is_fixed_by_trial_home(tmp_path):
args = settings(tmp_path, execution=Execution(mode="heartbeat", context_delivery="on"))
prepare_codex_home(**args)
with pytest.raises(ValueError, match="settings changed"):
- prepare_codex_home(**(args | {"execution": Execution(mode="heartbeat")}))
+ prepare_codex_home(**(args | {"execution": Execution(mode="heartbeat", context_delivery="off")}))
@pytest.mark.parametrize("kind", ["public_directory", "symlink_directory", "existing_hooks"])
diff --git a/docs/heartbeat-automation-prompt.md b/docs/heartbeat-automation-prompt.md
index b9f8f8c325..b36e22985a 100644
--- a/docs/heartbeat-automation-prompt.md
+++ b/docs/heartbeat-automation-prompt.md
@@ -441,7 +441,7 @@ loopx-canary heartbeat-prompt \
### Opt-in native context delivery
-`--context-delivery {off,on}` is experimental and defaults to `off`. It reuses
+`--context-delivery {off,on}` defaults to `on` for supported native Codex App/SSH and benchmark heartbeat entries; save the machine setting as off or pass `--context-delivery off` to disable. An explicitly saved off is preserved. Other hosts and ordinary CLI keep full delivery. It reuses
existing scheduler-owned host declarations and the benchmark worker's explicit
execution settings; it does not guess a host from process names or ambient native
session variables. These declared run modes can activate it:
diff --git a/docs/reference/required-work-context.md b/docs/reference/required-work-context.md
index 0f69b6d3fd..3fe5fb57c8 100644
--- a/docs/reference/required-work-context.md
+++ b/docs/reference/required-work-context.md
@@ -72,7 +72,7 @@ change receipt replay validation or declare a model-input/token saving.
Unmarked or mixed ownership keeps the original full progressive read in
`agent_channel.required_reads`. Malformed markers, non-generated content inside
a marked region, unavailable files and invalid UTF-8 fail closed. Unknown
-narrative is never classified by headings or clipped to a size budget. For default-off and signed-envelope callers, read all
+narrative is never classified by headings or clipped to a size budget. For explicit-off and signed-envelope callers, read all
delivered context and remaining reads before dependent work; changed sources need
a fresh guard. Enabled scoped acceptance does not replace original Goal intent.
@@ -359,7 +359,7 @@ statements, source quotes and source references. Each read still supplies the
current revision, membership, keys, lifecycle state, expiry, operation lineage
and unknown fields literally; an empty view replaces earlier preferences.
The existing scope-less preference hook uses the validated capture's exact
-Goal/Agent binding, without adding fields to ordinary/default-off producer output
+Goal/Agent binding, without adding fields to ordinary/disabled producer output
or parsing its read command. Explore retains its explicit scoped hook identity.
Unknown, failed, incompatible or ambiguous hook views stay complete. A changed
scope or lost baseline still selects full delivery; reuse never makes a retired
@@ -403,7 +403,7 @@ the reconstructed context must still match its complete digest. Cold delivery,
session invalidation and authority remain unchanged. This saves transport only;
it does not establish model retention, billed-token savings or useful outcomes.
-These are presentation rules within the existing default-off option, not a new
+These are presentation rules within the existing native option, not a new
configuration or admission policy. A missing continuity basis, a changed epoch, a damaged
patch or an incompatible reader automatically recovers the same original full
capture. Recovery never reruns the guard, asks the owner, spends quota or grants
@@ -425,18 +425,23 @@ host setup or actual delta use; the settings view states this explicitly. Its
`{"schema_version":"context_delivery_machine_defaults_v0","mode":"off"}` or
the same object with `"mode":"on"`. The CLI exposes that same owner through
`machine-config preview/apply --namespace context_delivery --config-json FILE`;
-apply requires the exact preview revision. Removing the namespace restores off.
+apply requires the exact preview revision. Removing the namespace restores the on default for supported native Codex sessions; save `mode: "off"` to keep it disabled.
Sibling settings and Goal records are preserved. The application row selects Codex
within this capability; the existing `mode` remains that Codex preference, with no
additional global switch or host configuration authority. Read-only editors cannot
save it. The UI does not alter other hosts or initialize the current native session.
An explicit `--context-delivery on|off` wins; otherwise each invocation reads the
-machine default, with off when absent. The existing worker environment's explicit
-`LOOPX_CONTEXT_DELIVERY=off` also overrides inheritance; environment on alone does
-not enable delivery. Benchmark trials keep their existing `context_delivery=on`
-opt-in. Workers propagate the resolved trial choice, including default off, to
-both preflight and solver subprocesses without changing the caller's settings.
+machine preference, preserving a saved off. An absent preference defaults on only
+for supported POSIX native Codex App/SSH and declared benchmark heartbeat callers.
+Ordinary CLI, other hosts and unsupported platforms keep full delivery. Explicit
+on, or an explicitly saved on for an unknown declaration, still rejects unsupported
+or conflicting modes. The worker environment's `LOOPX_CONTEXT_DELIVERY=off` also
+overrides inheritance; environment on alone supplies no host or execution proof.
+New benchmark heartbeat trials default to `context_delivery=on`; pass `off` to
+disable. Other benchmark modes remain off. Workers pin the resolved trial choice
+in preflight and solver subprocesses; existing saved/frozen trials must not be
+rewritten or reused to qualify the new default.
Machine consumers that parse `should_run`, selected work or settlement identities
must explicitly request raw output on internal `quota should-run` calls using
@@ -721,7 +726,7 @@ context delivery 时，未标记或混合归属仅在内部桥接传路径与修
安装后重新生成旧展开式 heartbeat 提示；此 PR 不热更新 runtime/automation，
也不证明模型已采用或获得质量收益。回滚需恢复旧版本并重新生成提示。
-既有默认关闭的原生 context delivery 由同一 TypeScript codec 处理普通 quota 与
+既有原生 context delivery 由同一 TypeScript codec 处理普通 quota 与
TurnEnvelope。在基线连续性成立的口径内，两入口仍逐轮发送 `planning_horizon.core_goal` 的
原始目标、来源和可用性，包括目标改变或缺失。完整 `acceptance_contract` 与已登记
规划树按精确复用、子树变化或全量交付；累计验收树不等于原始目标句。未知 horizon
@@ -765,15 +770,18 @@ quota 能力候选沿用同一精确 codec 复用已登记 Todo 的正文、标
设置页明确区分已保存偏好与尚未验证的原生初始化、实际差分使用。机器 namespace 为 `context_delivery`，配置为
`{"schema_version":"context_delivery_machine_defaults_v0","mode":"off"}`；开启时
把 `mode` 改为 `on`。CLI 的 `machine-config preview/apply --namespace context_delivery
---config-json FILE` 使用同一 owner；应用须带原预览修订。移除此 namespace 恢复关闭，
+--config-json FILE` 使用同一 owner；应用须带原预览修订。移除此 namespace 恢复受支持 Codex 原生会话的默认开启；保持关闭须保存 `mode: "off"`，
不改写其他配置和 Goal 记录。应用行选择的是此能力下的 Codex；既有 `mode` 仍表示
该 Codex 偏好，不新增总开关或宿主配置 authority。只读编辑器不能保存；界面不会
改变其他应用或初始化当前原生会话。
-显式 `--context-delivery on|off` 优先；省略时每次读取机器设置，未配置则关闭。
-已有 worker 环境的 `LOOPX_CONTEXT_DELIVERY=off` 也覆盖继承；环境 on 本身不启用投递。
-benchmark trial 保留既有 `context_delivery=on` 启用方式。worker 将本次运行已解析的选择
-（含默认关闭）传给预检和 solver 子进程，不改写调用方原设置。
+显式 `--context-delivery on|off` 优先；省略时每次读取机器设置，已保存的关闭继续生效。
+未配置时，仅在受支持的 POSIX Codex App／SSH 和已声明的 benchmark 心跳入口默认开启；
+普通 CLI、其他宿主和不支持的平台仍完整交付。显式开启或已保存开启遇到未知／冲突声明
+仍拒绝。worker 环境的 `LOOPX_CONTEXT_DELIVERY=off` 也覆盖继承，环境 on 本身不证明宿主或执行权限。
+新 benchmark heartbeat trial 默认 `context_delivery=on`，指定 `off` 可关闭；其他跑法仍关闭。
+worker 把本次运行已解析的选择固定传给预检和 solver 子进程，不改写调用方原设置，
+不修改或复用旧的在途／冻结 trial 来宣称新默认合格。
开启接受以下原生声明：Codex App 心跳（`--codex-app` 或等价完整调度声明）、
Codex App SSH Goal（`--runtime-profile codex_app_ssh_goal`），以及现有 Codex benchmark 心跳 worker（`generic_cli` 与其显式心跳环境）。缺失、冲突、
不支持的 Codex 声明在准入前报错。机器偏好仅作用于 Codex；其他已明确解析的宿主
diff --git a/examples/personal-workspace-browser/configuration-backup.mjs b/examples/personal-workspace-browser/configuration-backup.mjs
index 57d89eeb11..73c3f9163c 100644
--- a/examples/personal-workspace-browser/configuration-backup.mjs
+++ b/examples/personal-workspace-browser/configuration-backup.mjs
@@ -199,7 +199,47 @@ export const configurationBackupScenario = {
await english.getByText(backend.source_position.provider_revision, {exact: true}).waitFor();
await english.getByRole("status").scrollIntoViewIfNeeded();
await page.screenshot({path: resolve(outputDir, "state-recovery-english.png"), animations: "disabled"});
- return {coverageEntries: context.coverageEntries, errors: context.errors, backend, verified: `Packaged configuration recovery and full archive inspection; real ${backend.source_provider} head/history after original-source loss, no Goal registration, keyboard, corrupt-input recovery, immutable history reload and narrow viewport`};
+ // Reuse this real disposable settings backend for the default/opt-out
+ // journey; no live machine preferences or Goal execution are touched.
+ await page.route("**/api/chat/machine-configuration**", async route => {
+ const response = await fetchWorkspaceBackend(route, `http://127.0.0.1:${port}`);
+ await route.fulfill({response});
+ });
+ async function openContextSettings() {
+ await page.reload();
+ const settings = page.getByRole("button", {name: "Settings", exact: true});
+ if (await settings.count()) await settings.click();
+ await page.locator(".personal-settings-tabs").getByRole("button", {name: /Capabilit/}).click();
+ await page.getByRole("button", {name: /Differential context/}).click();
+ return page.getByRole("switch", {name: "Use differential context in Codex", exact: true});
+ }
+ let contextSwitch = await openContextSettings();
+ await page.screenshot({path: resolve(outputDir, "context-default-on-desktop.png"), animations: "disabled"});
+ assert.equal(await contextSwitch.isChecked(), true, "Unconfigured Codex must show its effective on default");
+ await page.getByText("On by default for Codex; host readiness and actual use are not verified.", {exact: true}).waitFor();
+ await page.setViewportSize({width: 390, height: 844});
+ assert.equal(await page.evaluate(() => document.documentElement.scrollWidth > window.innerWidth), false);
+ await contextSwitch.scrollIntoViewIfNeeded();
+ await page.screenshot({path: resolve(outputDir, "context-default-on-mobile.png"), animations: "disabled"});
+ await page.setViewportSize({width: 1512, height: 982});
+ await contextSwitch.uncheck();
+ await page.getByText("Off for Codex.", {exact: true}).waitFor();
+ const storedSettings = () => readFile(join(root, "runtime/machine/configuration.json"), "utf8").then(JSON.parse);
+ assert.equal((await storedSettings()).namespaces.context_delivery.mode, "off");
+ contextSwitch = await openContextSettings();
+ assert.equal(await contextSwitch.isChecked(), false, "A saved off must survive reload and the new on default");
+ const applyRoute = "**/api/chat/machine-configuration/apply";
+ await page.route(applyRoute, route => route.fulfill({status: 503, contentType: "application/json", body: JSON.stringify({ok: false, error: "Fixture unavailable"})}));
+ await contextSwitch.check();
+ await page.getByRole("alert").waitFor();
+ assert.equal((await storedSettings()).namespaces.context_delivery.mode, "off", "Failed apply must preserve saved off");
+ await page.unroute(applyRoute);
+ await contextSwitch.check();
+ await page.getByText("Codex preference is on; host readiness and actual use are not verified.", {exact: true}).waitFor();
+ const afterSettings = await storedSettings();
+ assert.equal(afterSettings.namespaces.context_delivery.mode, "on");
+ assert.equal(afterSettings.namespaces.goal_storage.new_goal_provider, "sqlite", "The opt-out/on transaction must preserve sibling settings");
+ return {coverageEntries: context.coverageEntries, errors: context.errors, backend, verified: `Actual settings backend: Codex default on, saved off/reload, failed apply and explicit on; Packaged configuration recovery and full archive inspection; real ${backend.source_provider} head/history after original-source loss, no Goal registration, keyboard, corrupt-input recovery, immutable history reload and narrow viewport`};
} finally {
try {await context?.close();} finally {
if (!closed) {
diff --git a/loopx/capabilities/machine_configuration/context_delivery.py b/loopx/capabilities/machine_configuration/context_delivery.py
index 349f34745b..2888e9c423 100644
--- a/loopx/capabilities/machine_configuration/context_delivery.py
+++ b/loopx/capabilities/machine_configuration/context_delivery.py
@@ -28,11 +28,11 @@ def context_delivery_machine_configuration_namespace() -> MachineConfigurationNa
apply_public_update=lambda _current, update: dict(update),
title="Differential context",
description=(
- "Reuse unchanged context for Codex App heartbeats, SSH Goals and benchmark heartbeats. Off by default; "
+ "Reuse unchanged context for Codex App heartbeats, SSH Goals and benchmark heartbeats. On by default for supported Codex sessions; "
"unsupported declarations fail and known context loss keeps full context. "
"Completed reads use an explicit native-hook continuity assumption. "
"A saved preference does not establish host readiness or actual delta use."
),
documentation={"path": "docs/reference/required-work-context.md#machine-default"},
- default_configuration={"schema_version": CONTEXT_DELIVERY_MACHINE_SCHEMA, "mode": "off"},
+ default_configuration={"schema_version": CONTEXT_DELIVERY_MACHINE_SCHEMA, "mode": "on"},
)
diff --git a/loopx/cli_commands/context_machine.py b/loopx/cli_commands/context_machine.py
index 50d9417f81..3ffb90d862 100644
--- a/loopx/cli_commands/context_machine.py
+++ b/loopx/cli_commands/context_machine.py
@@ -93,18 +93,32 @@ def apply_context_machine_options(
return
from ..paths import effective_runtime_root
runtime_root = effective_runtime_root(registry_path, runtime_root_arg)
+ using_default = False
if explicit is None:
from ..capabilities.machine_configuration.builtins import build_builtin_machine_configuration_registry
from ..capabilities.machine_configuration.store import read_machine_configuration
- configuration = read_machine_configuration(runtime_root, registry=build_builtin_machine_configuration_registry())
+ machine_registry = build_builtin_machine_configuration_registry()
+ configuration = read_machine_configuration(runtime_root, registry=machine_registry)
value = (configuration or {}).get("namespaces", {}).get("context_delivery")
- if value is None or value["mode"] == "off":
+ using_default = value is None
+ if using_default:
+ value = machine_registry.resolve("context_delivery").public_descriptor()["configuration_template"]
+ if value["mode"] == "off" or (using_default and os.name != "posix"):
return
# Recovery does not activate a run mode or create a missing session.
if command != "context-read":
args.context_delivery = "on"
- if not context_delivery_for_arguments(args, codex_machine_preference=explicit is None)["enabled"]:
+ try:
+ enabled = context_delivery_for_arguments(args, codex_machine_preference=explicit is None)["enabled"]
+ except ValueError:
+ if not using_default:
+ raise
+ # An absent preference enables only the supported native hosts.
+ # Ordinary CLI and unknown declarations retain their original path;
+ # explicit on still rejects an unsupported or conflicting host.
+ enabled = False
+ if not enabled:
args.context_delivery = "off"
return
if command == "should-run" and args.format != "json":
diff --git a/tests/control_plane/test_context_machine_configuration.py b/tests/control_plane/test_context_machine_configuration.py
index 8b85cf0479..7b079dfb64 100644
--- a/tests/control_plane/test_context_machine_configuration.py
+++ b/tests/control_plane/test_context_machine_configuration.py
@@ -75,7 +75,7 @@ def test_machine_catalog_discovers_context_delivery_without_activation(tmp_path)
assert len(contexts) == 1
assert contexts[0]["schema_versions"] == [CONTEXT_DELIVERY_MACHINE_SCHEMA]
assert contexts[0]["configuration_template"] == {
- "schema_version": CONTEXT_DELIVERY_MACHINE_SCHEMA, "mode": "off",
+ "schema_version": CONTEXT_DELIVERY_MACHINE_SCHEMA, "mode": "on",
}
assert not registry.exists() and not (runtime / "machine/configuration.json").exists()
assert not (runtime / "context-delivery").exists()
@@ -193,9 +193,9 @@ def test_inherited_on_rejects_unknown_or_unsupported_before_admission(tmp_path,
@pytest.mark.parametrize("profile", ["codex_app", "benchmark", "codex_app_ssh_goal"])
@pytest.mark.skipif(os.name != "posix", reason="Native continuity uses POSIX private directories and locks")
-def test_native_configuration_inherits_declared_scenarios_and_later_off(tmp_path, monkeypatch, profile):
+def test_native_configuration_defaults_on_and_later_explicit_off(tmp_path, monkeypatch, profile):
registry, runtime = tmp_path / "absent.json", tmp_path / "runtime"
- assert configure(registry, runtime, tmp_path, "on")[0] == 0
+ assert not (runtime / "machine/configuration.json").exists()
if profile == "benchmark":
monkeypatch.setenv("LOOPX_CONTEXT_DELIVERY", "on")
monkeypatch.setenv("LOOPX_EXECUTION_MODE", "heartbeat")
@@ -219,8 +219,9 @@ def test_native_configuration_inherits_declared_scenarios_and_later_off(tmp_path
@pytest.mark.parametrize("provider", ["file", "sqlite"])
+@pytest.mark.parametrize("stored_mode", [None, "on"])
@pytest.mark.skipif(os.name != "posix", reason="Native continuity uses POSIX private directories and locks")
-def test_machine_on_reaches_real_guard_and_same_capture_readback_without_readmission(tmp_path, monkeypatch, provider):
+def test_machine_on_reaches_real_guard_and_same_capture_readback_without_readmission(tmp_path, monkeypatch, provider, stored_mode):
isolate_sqlite_runtime(tmp_path, monkeypatch)
monkeypatch.setenv("CODEX_THREAD_ID", "machine-context-session")
monkeypatch.delenv("CODEX_ROLLOUT_TRACE_ROOT", raising=False)
@@ -228,7 +229,10 @@ def test_machine_on_reaches_real_guard_and_same_capture_readback_without_readmis
_initialize_fixture_authority(project, runtime, provider=provider)
state = project / f".codex/goals/{GOAL_ID}/ACTIVE_GOAL_STATE.md"
original_state = state.read_bytes()
- assert configure(registry, runtime, tmp_path, "on")[0] == 0
+ if stored_mode is not None:
+ assert configure(registry, runtime, tmp_path, stored_mode)[0] == 0
+ else:
+ assert not (runtime / "machine/configuration.json").exists()
code, setup = _run_cli(registry, runtime, "quota", "context-config", "--codex-app",
"--goal-id", GOAL_ID, "--agent-id", AGENT_ID, cwd=project)
assert code == 0, setup
@@ -368,10 +372,10 @@ def test_explicit_on_unknown_host_fails_before_first_use_directory_creation(tmp_
@pytest.mark.skipif(not os.environ.get("LOOPX_NATIVE_CHECKPOINT_BIN"), reason="Explicit native Codex; loopback inference only")
@pytest.mark.skipif(os.name != "posix", reason="Native benchmark worker qualification uses POSIX isolation")
@pytest.mark.parametrize("provider,worker_mode,machine_on", [
- ("file", None, False), ("file", None, True),
- ("sqlite", None, False), ("sqlite", None, True), ("sqlite", "off", True),
+ ("file", "off", False), ("file", "off", True),
+ ("sqlite", "off", False), ("sqlite", "off", True),
])
-def test_native_worker_default_off_isolates_machine_on(tmp_path, monkeypatch, provider, worker_mode, machine_on):
+def test_native_worker_explicit_off_isolates_machine_on(tmp_path, monkeypatch, provider, worker_mode, machine_on):
from benchmark.runtime.worker import run_once
from tests.control_plane.codex_checkpoint_fixture import local_inference_provider
from tests.control_plane.test_codex_context_boundary import _input_text, _native_fixture
From 714a565b925914e4454734be1bcc9ba1f20f1c27 Mon Sep 17 00:00:00 2001
From: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>
Date: Sun, 1 Nov 2026 16:42:25 +0530
Subject: [PATCH 02/18] test(context): cover unset preferences and native
default opt-out
Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>
---
.../machine-configuration-settings.tsx | 4 +-
benchmark/tests/test_shared_codex_runtime.py | 4 ++
.../test_context_machine_configuration.py | 54 +++++++++++++++----
3 files changed, 49 insertions(+), 13 deletions(-)
diff --git a/apps/presentation/dashboard/src/features/personal-workspace/machine-configuration-settings.tsx b/apps/presentation/dashboard/src/features/personal-workspace/machine-configuration-settings.tsx
index cbc8051756..849d5da4e1 100644
--- a/apps/presentation/dashboard/src/features/personal-workspace/machine-configuration-settings.tsx
+++ b/apps/presentation/dashboard/src/features/personal-workspace/machine-configuration-settings.tsx
@@ -529,10 +529,10 @@ export function MachineConfigurationSettings({ section, onChanged }: {
-
{(selectedCurrent?.mode ?? selected.default?.mode) === "on"
? selectedCurrent
? locale === "zh-CN" ? "已为 Codex 保存开启偏好；宿主就绪与实际使用尚未验证。" : "Codex preference is on; host readiness and actual use are not verified."
: locale === "zh-CN" ? "Codex 默认开启；宿主就绪与实际使用尚未验证。" : "On by default for Codex; host readiness and actual use are not verified."
diff --git a/benchmark/tests/test_shared_codex_runtime.py b/benchmark/tests/test_shared_codex_runtime.py
index 62ba43c04f..412cd7ad71 100644
--- a/benchmark/tests/test_shared_codex_runtime.py
+++ b/benchmark/tests/test_shared_codex_runtime.py
@@ -152,6 +152,8 @@ def worker_env(tmp_path):
binary.chmod(0o755)
return dict(os.environ) | {
"LOOPX_EXECUTION_MODE": "plain",
+ # This executable models legacy sessions, not native hook discovery.
+ "LOOPX_CONTEXT_DELIVERY": "off",
"LOOPX_PROJECT": str(tmp_path),
"LOOPX_TASK_DOC": str(task),
"LOOPX_CODEX_HOME": str(tmp_path / "home"),
@@ -316,6 +318,8 @@ def test_native_heartbeat_retry_uses_real_session_owner(tmp_path, monkeypatch, c
env, _project, _runtime, _source, _state = _environment(tmp_path, monkeypatch, "sqlite")
env["LOOPX_ITERATION_CONTEXT"] = context
+ # This fake executable models session retries, not native hook discovery.
+ env["LOOPX_CONTEXT_DELIVERY"] = "off"
monkeypatch.setattr(worker, "heartbeat_body", lambda *a, **kw: "synthetic work")
arguments = tmp_path / "native-calls.jsonl"
Path(env["CODEX_BIN"]).write_text(f"#!{sys.executable}\n" + f"""
diff --git a/tests/control_plane/test_context_machine_configuration.py b/tests/control_plane/test_context_machine_configuration.py
index 7b079dfb64..ba22a27e0a 100644
--- a/tests/control_plane/test_context_machine_configuration.py
+++ b/tests/control_plane/test_context_machine_configuration.py
@@ -271,11 +271,17 @@ def complete_reader(view):
code, warm = _run_cli(registry, runtime, *args, cwd=project)
assert code == 0 and warm["mode"] == "delta", warm
complete_reader(warm)
- old_generation = warm["target"]["continuity_generation"]
- old_configuration = (runtime / "machine/configuration.json").read_bytes()
+ old_generation = warm["target"].get("continuity_generation")
+ configuration_file = runtime / "machine/configuration.json"
+ old_configuration = configuration_file.read_bytes() if configuration_file.exists() else None
+ assert (old_generation is None) is (stored_mode is None)
+ assert (old_configuration is None) is (stored_mode is None)
assert configure(registry, runtime, tmp_path, "off")[0] == 0
assert configure(registry, runtime, tmp_path, "on")[0] == 0
- assert (runtime / "machine/configuration.json").read_bytes() == old_configuration
+ if old_configuration is not None:
+ assert configuration_file.read_bytes() == old_configuration
+ else:
+ assert json.loads(configuration_file.read_text())["namespaces"]["context_delivery"]["mode"] == "on"
code, fresh = _run_cli(registry, runtime, *args, cwd=project)
assert code == 0 and fresh["mode"] == "full", fresh
assert fresh["target"]["continuity_generation"] != old_generation
@@ -374,8 +380,9 @@ def test_explicit_on_unknown_host_fails_before_first_use_directory_creation(tmp_
@pytest.mark.parametrize("provider,worker_mode,machine_on", [
("file", "off", False), ("file", "off", True),
("sqlite", "off", False), ("sqlite", "off", True),
+ ("file", None, False), ("sqlite", None, False),
])
-def test_native_worker_explicit_off_isolates_machine_on(tmp_path, monkeypatch, provider, worker_mode, machine_on):
+def test_native_worker_default_on_and_explicit_off_isolation(tmp_path, monkeypatch, provider, worker_mode, machine_on):
from benchmark.runtime.worker import run_once
from tests.control_plane.codex_checkpoint_fixture import local_inference_provider
from tests.control_plane.test_codex_context_boundary import _input_text, _native_fixture
@@ -405,15 +412,36 @@ def response(request, number, message):
try:
if number == 1:
body = _input_text(request)
- assert "context-project" not in body
- command = next(line.strip() for line in body.splitlines() if " quota should-run " in line)
- turn_assignment = next(line.strip() for line in body.splitlines() if line.startswith("LOOPX_TURN="))
- observed.append(shlex.split(turn_assignment)[0].split("=", 1)[1])
+ if worker_mode == "off":
+ assert "context-project" not in body
+ command = next(line.strip() for line in body.splitlines() if " quota should-run " in line)
+ turn_assignment = next(line.strip() for line in body.splitlines() if line.startswith("LOOPX_TURN="))
+ observed.append(shlex.split(turn_assignment)[0].split("=", 1)[1])
+ else:
+ # The actual default worker stages native hooks and presents
+ # the original preflight; no external provider is contacted.
+ command = next(line.strip() for line in body.splitlines() if " quota context-project " in line)
+ words = shlex.split(command)
+ observed.append(words[words.index("--turn-instance-id") + 1])
+ turn_assignment = ""
return {"type": "function_call", "id": "guard-call", "call_id": "guard-call",
"name": "exec_command", "arguments": json.dumps({
"cmd": turn_assignment + "\n" + command + " > " + shlex.quote(str(saved)),
"max_output_tokens": 1000})}
decision = json.loads(saved.read_text())
+ if worker_mode is None:
+ assert decision["mode"] == "full", decision
+ # Independent byte readback checks the current capture. This
+ # is not evidence that the model retained its whole input.
+ command = decision["recovery"]["command"]
+ content = ""
+ while command:
+ page = json.loads(subprocess.check_output(shlex.split(command), text=True, cwd=project))
+ content += page["content"]
+ if page["eof"]:
+ break
+ command = page["next_command"]
+ decision = json.loads(content)
assert decision["ok"] and decision["should_run"], decision
assert decision["goal_id"] == GOAL_ID
assert decision["heartbeat_receipt"]["turn_instance_id"] == observed[0]
@@ -431,6 +459,10 @@ def response(request, number, message):
assert not errors and len(requests) == 2, errors
assert env == original, "Resolved worker defaults must not mutate caller/frozen input"
assert _heartbeat_receipt_count(runtime, observed[0]) == 1 and _spend_run_count(runtime) == 0
- assert "context_transport" not in result
- assert not (runtime / "context-delivery").exists() and not (home / "loopx-context").exists()
- assert not (home / "hooks.json").exists()
+ if worker_mode == "off":
+ assert "context_transport" not in result
+ assert not (runtime / "context-delivery").exists() and not (home / "loopx-context").exists()
+ assert not (home / "hooks.json").exists()
+ else:
+ assert result["context_delivery"] == "on" and result["context_transport"]["available"]
+ assert (home / "hooks.json").is_file()
From 8996323443b3698eb7fff9f253b76a7086264aa2 Mon Sep 17 00:00:00 2001
From: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>
Date: Sun, 1 Nov 2026 16:46:03 +0530
Subject: [PATCH 03/18] test(context): exercise native setup failure and async
setting readback
Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>
---
.../configuration-backup.mjs | 8 ++--
.../test_context_machine_configuration.py | 47 +++++++++++--------
2 files changed, 32 insertions(+), 23 deletions(-)
diff --git a/examples/personal-workspace-browser/configuration-backup.mjs b/examples/personal-workspace-browser/configuration-backup.mjs
index 73c3f9163c..66fb4ceece 100644
--- a/examples/personal-workspace-browser/configuration-backup.mjs
+++ b/examples/personal-workspace-browser/configuration-backup.mjs
@@ -222,7 +222,7 @@ export const configurationBackupScenario = {
await contextSwitch.scrollIntoViewIfNeeded();
await page.screenshot({path: resolve(outputDir, "context-default-on-mobile.png"), animations: "disabled"});
await page.setViewportSize({width: 1512, height: 982});
- await contextSwitch.uncheck();
+ await contextSwitch.click();
await page.getByText("Off for Codex.", {exact: true}).waitFor();
const storedSettings = () => readFile(join(root, "runtime/machine/configuration.json"), "utf8").then(JSON.parse);
assert.equal((await storedSettings()).namespaces.context_delivery.mode, "off");
@@ -230,11 +230,11 @@ export const configurationBackupScenario = {
assert.equal(await contextSwitch.isChecked(), false, "A saved off must survive reload and the new on default");
const applyRoute = "**/api/chat/machine-configuration/apply";
await page.route(applyRoute, route => route.fulfill({status: 503, contentType: "application/json", body: JSON.stringify({ok: false, error: "Fixture unavailable"})}));
- await contextSwitch.check();
- await page.getByRole("alert").waitFor();
+ await contextSwitch.click();
+ await page.locator(".personal-capability-detail").getByRole("alert").waitFor();
assert.equal((await storedSettings()).namespaces.context_delivery.mode, "off", "Failed apply must preserve saved off");
await page.unroute(applyRoute);
- await contextSwitch.check();
+ await contextSwitch.click();
await page.getByText("Codex preference is on; host readiness and actual use are not verified.", {exact: true}).waitFor();
const afterSettings = await storedSettings();
assert.equal(afterSettings.namespaces.context_delivery.mode, "on");
diff --git a/tests/control_plane/test_context_machine_configuration.py b/tests/control_plane/test_context_machine_configuration.py
index ba22a27e0a..dfac409258 100644
--- a/tests/control_plane/test_context_machine_configuration.py
+++ b/tests/control_plane/test_context_machine_configuration.py
@@ -377,12 +377,13 @@ def test_explicit_on_unknown_host_fails_before_first_use_directory_creation(tmp_
@pytest.mark.skipif(not os.environ.get("LOOPX_NATIVE_CHECKPOINT_BIN"), reason="Explicit native Codex; loopback inference only")
@pytest.mark.skipif(os.name != "posix", reason="Native benchmark worker qualification uses POSIX isolation")
-@pytest.mark.parametrize("provider,worker_mode,machine_on", [
- ("file", "off", False), ("file", "off", True),
- ("sqlite", "off", False), ("sqlite", "off", True),
- ("file", None, False), ("sqlite", None, False),
+@pytest.mark.parametrize("provider,worker_mode,machine_on,transport_ready", [
+ ("file", "off", False, True), ("file", "off", True, True),
+ ("sqlite", "off", False, True), ("sqlite", "off", True, True),
+ ("file", None, False, True), ("sqlite", None, False, True),
+ ("file", None, False, False), ("sqlite", None, False, False),
])
-def test_native_worker_default_on_and_explicit_off_isolation(tmp_path, monkeypatch, provider, worker_mode, machine_on):
+def test_native_worker_default_on_and_explicit_off_isolation(tmp_path, monkeypatch, provider, worker_mode, machine_on, transport_ready):
from benchmark.runtime.worker import run_once
from tests.control_plane.codex_checkpoint_fixture import local_inference_provider
from tests.control_plane.test_codex_context_boundary import _input_text, _native_fixture
@@ -405,6 +406,10 @@ def test_native_worker_default_on_and_explicit_off_isolation(tmp_path, monkeypat
OPENAI_API_KEY="synthetic-loopback-only", LOOPX_CODEX_TURN_TIMEOUT_SEC="60", LOOPX_USAGE_PING="0")
if worker_mode is not None:
env["LOOPX_CONTEXT_DELIVERY"] = worker_mode
+ if not transport_ready:
+ def unavailable(*_args):
+ raise ValueError("Fixture native hooks unavailable")
+ monkeypatch.setattr("benchmark.runtime.context_delivery.prepare_context_delivery", unavailable)
observed, errors = [], []
saved = workspace / "original-guard.json"
@@ -412,24 +417,25 @@ def response(request, number, message):
try:
if number == 1:
body = _input_text(request)
- if worker_mode == "off":
- assert "context-project" not in body
- command = next(line.strip() for line in body.splitlines() if " quota should-run " in line)
- turn_assignment = next(line.strip() for line in body.splitlines() if line.startswith("LOOPX_TURN="))
- observed.append(shlex.split(turn_assignment)[0].split("=", 1)[1])
- else:
- # The actual default worker stages native hooks and presents
- # the original preflight; no external provider is contacted.
- command = next(line.strip() for line in body.splitlines() if " quota context-project " in line)
+ command = next(line.strip() for line in body.splitlines() if " quota should-run " in line)
+ turn_assignment = next(line.strip() for line in body.splitlines() if line.startswith("LOOPX_TURN="))
+ observed.append(shlex.split(turn_assignment)[0].split("=", 1)[1])
+ if worker_mode is None and transport_ready:
+ assert "--context-delivery on" in command
+ if not transport_ready:
+ # An ordinary guard may omit presentation flags. The actual
+ # native tool environment must still retain runtime off.
words = shlex.split(command)
- observed.append(words[words.index("--turn-instance-id") + 1])
- turn_assignment = ""
+ if "--context-delivery" in words:
+ index = words.index("--context-delivery")
+ del words[index:index + 2]
+ command = shlex.join(words)
return {"type": "function_call", "id": "guard-call", "call_id": "guard-call",
"name": "exec_command", "arguments": json.dumps({
"cmd": turn_assignment + "\n" + command + " > " + shlex.quote(str(saved)),
"max_output_tokens": 1000})}
decision = json.loads(saved.read_text())
- if worker_mode is None:
+ if worker_mode is None and transport_ready:
assert decision["mode"] == "full", decision
# Independent byte readback checks the current capture. This
# is not evidence that the model retained its whole input.
@@ -459,8 +465,11 @@ def response(request, number, message):
assert not errors and len(requests) == 2, errors
assert env == original, "Resolved worker defaults must not mutate caller/frozen input"
assert _heartbeat_receipt_count(runtime, observed[0]) == 1 and _spend_run_count(runtime) == 0
- if worker_mode == "off":
- assert "context_transport" not in result
+ if worker_mode == "off" or not transport_ready:
+ if worker_mode == "off":
+ assert "context_transport" not in result
+ else:
+ assert result["context_transport"]["available"] is False
assert not (runtime / "context-delivery").exists() and not (home / "loopx-context").exists()
assert not (home / "hooks.json").exists()
else:
From 937285b40c182b8248d4992e392d871847152b76 Mon Sep 17 00:00:00 2001
From: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>
Date: Sun, 1 Nov 2026 16:48:24 +0530
Subject: [PATCH 04/18] fix(context): retain full delivery after native setup
failure
Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>
---
.../personal-workspace/machine-configuration-settings.tsx | 4 ++--
benchmark/runtime/worker.py | 5 +++++
examples/personal-workspace-browser/configuration-backup.mjs | 4 ++--
3 files changed, 9 insertions(+), 4 deletions(-)
diff --git a/apps/presentation/dashboard/src/features/personal-workspace/machine-configuration-settings.tsx b/apps/presentation/dashboard/src/features/personal-workspace/machine-configuration-settings.tsx
index 849d5da4e1..12b56a7dbb 100644
--- a/apps/presentation/dashboard/src/features/personal-workspace/machine-configuration-settings.tsx
+++ b/apps/presentation/dashboard/src/features/personal-workspace/machine-configuration-settings.tsx
@@ -534,8 +534,8 @@ export function MachineConfigurationSettings({ section, onChanged }: {
{(selectedCurrent?.mode ?? selected.default?.mode) === "on"
? selectedCurrent
- ? locale === "zh-CN" ? "已为 Codex 保存开启偏好；宿主就绪与实际使用尚未验证。" : "Codex preference is on; host readiness and actual use are not verified."
- : locale === "zh-CN" ? "Codex 默认开启；宿主就绪与实际使用尚未验证。" : "On by default for Codex; host readiness and actual use are not verified."
+ ? locale === "zh-CN" ? "已开启；原生初始化与实际使用尚未验证。" : "On; native setup and use unverified."
+ : locale === "zh-CN" ? "默认开启；原生初始化与实际使用尚未验证。" : "Default on; native setup and use unverified."
: locale === "zh-CN" ? "Codex 已关闭。" : "Off for Codex."}
{locale === "zh-CN"
? "目前仅支持 Codex App 心跳和 benchmark 心跳，无法确认或不支持的跑法报错。保存偏好不代表当前会话已采用差分，也不会改变其他应用或显式关闭的实验。宿主准备就绪且旧上下文完整时才使用差分，否则保留完整上下文。私有存储与会话隔离自动管理；每轮回执显示实际传输方式。"
diff --git a/benchmark/runtime/worker.py b/benchmark/runtime/worker.py
index 268bda61f2..27f431c1c1 100644
--- a/benchmark/runtime/worker.py
+++ b/benchmark/runtime/worker.py
@@ -450,6 +450,10 @@ def native_command(env, execution, stage, wake, session_wake):
)
if execution.context_delivery != "off":
command[-1:-1] = json.loads(env.get("LOOPX_CODEX_CONTEXT_TRUST_ARGS", "[]"))
+ if env.get("LOOPX_CONTEXT_DELIVERY") == "off":
+ # Setup failure narrows this wake to full delivery, including the
+ # native shell whose frozen settings still record the requested on.
+ command[-1:-1] = ["-c", 'shell_environment_policy.set.LOOPX_CONTEXT_DELIVERY="off"']
if stage == "plan":
command[-1:-1] = ["-c", "features.goals=false"]
return command
@@ -602,6 +606,7 @@ def run_once(env: dict[str, str]) -> dict:
# trial. Unavailable native hooks keep ordinary full IO.
env.pop("LOOPX_CODEX_CONTEXT_DIR", None)
env.pop("LOOPX_CODEX_CONTEXT_TRUST_ARGS", None)
+ env["LOOPX_CONTEXT_DELIVERY"] = "off"
receipt["context_transport"] = {"available": False, **_error_tail(exc)}
body = "Finish the task."
if stage == "plan":
diff --git a/examples/personal-workspace-browser/configuration-backup.mjs b/examples/personal-workspace-browser/configuration-backup.mjs
index 66fb4ceece..b2cb98c71c 100644
--- a/examples/personal-workspace-browser/configuration-backup.mjs
+++ b/examples/personal-workspace-browser/configuration-backup.mjs
@@ -216,7 +216,7 @@ export const configurationBackupScenario = {
let contextSwitch = await openContextSettings();
await page.screenshot({path: resolve(outputDir, "context-default-on-desktop.png"), animations: "disabled"});
assert.equal(await contextSwitch.isChecked(), true, "Unconfigured Codex must show its effective on default");
- await page.getByText("On by default for Codex; host readiness and actual use are not verified.", {exact: true}).waitFor();
+ await page.getByText("Default on; native setup and use unverified.", {exact: true}).waitFor();
await page.setViewportSize({width: 390, height: 844});
assert.equal(await page.evaluate(() => document.documentElement.scrollWidth > window.innerWidth), false);
await contextSwitch.scrollIntoViewIfNeeded();
@@ -235,7 +235,7 @@ export const configurationBackupScenario = {
assert.equal((await storedSettings()).namespaces.context_delivery.mode, "off", "Failed apply must preserve saved off");
await page.unroute(applyRoute);
await contextSwitch.click();
- await page.getByText("Codex preference is on; host readiness and actual use are not verified.", {exact: true}).waitFor();
+ await page.getByText("On; native setup and use unverified.", {exact: true}).waitFor();
const afterSettings = await storedSettings();
assert.equal(afterSettings.namespaces.context_delivery.mode, "on");
assert.equal(afterSettings.namespaces.goal_storage.new_goal_provider, "sqlite", "The opt-out/on transaction must preserve sibling settings");
From b3a21af2fd642a6dea4101576140f36257b438fe Mon Sep 17 00:00:00 2001
From: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>
Date: Sun, 1 Nov 2026 16:50:11 +0530
Subject: [PATCH 05/18] test(context): retain original Turn expansion in
fallback oracle
Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>
---
loopx/capabilities/machine_configuration/context_delivery.py | 2 +-
tests/control_plane/test_context_machine_configuration.py | 5 +++--
2 files changed, 4 insertions(+), 3 deletions(-)
diff --git a/loopx/capabilities/machine_configuration/context_delivery.py b/loopx/capabilities/machine_configuration/context_delivery.py
index 2888e9c423..2812556e5c 100644
--- a/loopx/capabilities/machine_configuration/context_delivery.py
+++ b/loopx/capabilities/machine_configuration/context_delivery.py
@@ -29,7 +29,7 @@ def context_delivery_machine_configuration_namespace() -> MachineConfigurationNa
title="Differential context",
description=(
"Reuse unchanged context for Codex App heartbeats, SSH Goals and benchmark heartbeats. On by default for supported Codex sessions; "
- "unsupported declarations fail and known context loss keeps full context. "
+ "explicit unsupported activation fails and known context loss keeps full context. "
"Completed reads use an explicit native-hook continuity assumption. "
"A saved preference does not establish host readiness or actual delta use."
),
diff --git a/tests/control_plane/test_context_machine_configuration.py b/tests/control_plane/test_context_machine_configuration.py
index dfac409258..a1f24bfb42 100644
--- a/tests/control_plane/test_context_machine_configuration.py
+++ b/tests/control_plane/test_context_machine_configuration.py
@@ -428,8 +428,9 @@ def response(request, number, message):
words = shlex.split(command)
if "--context-delivery" in words:
index = words.index("--context-delivery")
- del words[index:index + 2]
- command = shlex.join(words)
+ # Keep the original shell quoting and $LOOPX_TURN
+ # expansion while omitting only this presentation flag.
+ command = command.replace("--context-delivery " + words[index + 1], "", 1)
return {"type": "function_call", "id": "guard-call", "call_id": "guard-call",
"name": "exec_command", "arguments": json.dumps({
"cmd": turn_assignment + "\n" + command + " > " + shlex.quote(str(saved)),
From 614d9fe1f924ccc6f87527dbae2d1b6fc3275490 Mon Sep 17 00:00:00 2001
From: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>
Date: Sun, 1 Nov 2026 16:51:47 +0530
Subject: [PATCH 06/18] docs(context): clarify supported defaults and preserve
diagnostic errors
Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>
---
.../personal-workspace/machine-configuration-settings.tsx | 4 ++--
tests/control_plane/test_context_machine_configuration.py | 4 +++-
2 files changed, 5 insertions(+), 3 deletions(-)
diff --git a/apps/presentation/dashboard/src/features/personal-workspace/machine-configuration-settings.tsx b/apps/presentation/dashboard/src/features/personal-workspace/machine-configuration-settings.tsx
index 12b56a7dbb..8189af30ad 100644
--- a/apps/presentation/dashboard/src/features/personal-workspace/machine-configuration-settings.tsx
+++ b/apps/presentation/dashboard/src/features/personal-workspace/machine-configuration-settings.tsx
@@ -538,8 +538,8 @@ export function MachineConfigurationSettings({ section, onChanged }: {
: locale === "zh-CN" ? "默认开启；原生初始化与实际使用尚未验证。" : "Default on; native setup and use unverified."
: locale === "zh-CN" ? "Codex 已关闭。" : "Off for Codex."}
{locale === "zh-CN"
- ? "目前仅支持 Codex App 心跳和 benchmark 心跳，无法确认或不支持的跑法报错。保存偏好不代表当前会话已采用差分，也不会改变其他应用或显式关闭的实验。宿主准备就绪且旧上下文完整时才使用差分，否则保留完整上下文。私有存储与会话隔离自动管理；每轮回执显示实际传输方式。"
- : "Currently supports only Codex App and benchmark heartbeats; unknown or unsupported declarations return an error. Saving a preference does not establish use in the current session or change other applications or explicitly disabled runs. Delta requires a ready host and complete retained context; otherwise full context is preserved. Private storage and session isolation are automatic; each delivery reports its actual mode."}
+ ? "受支持的 POSIX Codex App／SSH 和 benchmark 心跳默认开启；已保存的关闭继续生效，benchmark trial 可单独显式关闭。其他应用和平台保留完整交付；显式开启遇到未知或冲突跑法会报错。保存偏好不代表当前会话已采用差分。宿主就绪且旧上下文完整时才使用差分，否则完整恢复；私有存储与会话隔离自动管理。"
+ : "Defaults on for supported POSIX Codex App/SSH and benchmark heartbeats. Saved off is preserved; benchmark trials can explicitly disable it independently. Other applications and platforms retain full delivery. Explicit on rejects unknown or conflicting modes. Saving a preference does not establish current-session adoption. Delta needs a ready host and complete retained context; otherwise full context is restored. Private storage and session isolation are automatic."}
: null}
{editorAvailable && selected.capability_id !== "context_delivery" ? <>{editorMode === "json" || !selected.configuration_editor.fields.some((field) => field.key === "enabled" && field.input_kind === "boolean") ?
{(selectedCurrent?.mode ?? selected.default?.mode) === "on"
? selectedCurrent
- ? locale === "zh-CN" ? "已为 Codex 保存开启偏好；宿主就绪与实际使用尚未验证。" : "Codex preference is on; host readiness and actual use are not verified."
- : locale === "zh-CN" ? "Codex 默认开启；宿主就绪与实际使用尚未验证。" : "On by default for Codex; host readiness and actual use are not verified."
+ ? locale === "zh-CN" ? "已开启；原生初始化与实际使用尚未验证。" : "On; native setup and use unverified."
+ : locale === "zh-CN" ? "默认开启；原生初始化与实际使用尚未验证。" : "Default on; native setup and use unverified."
: locale === "zh-CN" ? "Codex 已关闭。" : "Off for Codex."}
{locale === "zh-CN"
? "目前仅支持 Codex App 心跳和 benchmark 心跳，无法确认或不支持的跑法报错。保存偏好不代表当前会话已采用差分，也不会改变其他应用或显式关闭的实验。宿主准备就绪且旧上下文完整时才使用差分，否则保留完整上下文。私有存储与会话隔离自动管理；每轮回执显示实际传输方式。"
diff --git a/benchmark/runtime/worker.py b/benchmark/runtime/worker.py
index 268bda61f2..27f431c1c1 100644
--- a/benchmark/runtime/worker.py
+++ b/benchmark/runtime/worker.py
@@ -450,6 +450,10 @@ def native_command(env, execution, stage, wake, session_wake):
)
if execution.context_delivery != "off":
command[-1:-1] = json.loads(env.get("LOOPX_CODEX_CONTEXT_TRUST_ARGS", "[]"))
+ if env.get("LOOPX_CONTEXT_DELIVERY") == "off":
+ # Setup failure narrows this wake to full delivery, including the
+ # native shell whose frozen settings still record the requested on.
+ command[-1:-1] = ["-c", 'shell_environment_policy.set.LOOPX_CONTEXT_DELIVERY="off"']
if stage == "plan":
command[-1:-1] = ["-c", "features.goals=false"]
return command
@@ -602,6 +606,7 @@ def run_once(env: dict[str, str]) -> dict:
# trial. Unavailable native hooks keep ordinary full IO.
env.pop("LOOPX_CODEX_CONTEXT_DIR", None)
env.pop("LOOPX_CODEX_CONTEXT_TRUST_ARGS", None)
+ env["LOOPX_CONTEXT_DELIVERY"] = "off"
receipt["context_transport"] = {"available": False, **_error_tail(exc)}
body = "Finish the task."
if stage == "plan":
diff --git a/examples/personal-workspace-browser/configuration-backup.mjs b/examples/personal-workspace-browser/configuration-backup.mjs
index 66fb4ceece..b2cb98c71c 100644
--- a/examples/personal-workspace-browser/configuration-backup.mjs
+++ b/examples/personal-workspace-browser/configuration-backup.mjs
@@ -216,7 +216,7 @@ export const configurationBackupScenario = {
let contextSwitch = await openContextSettings();
await page.screenshot({path: resolve(outputDir, "context-default-on-desktop.png"), animations: "disabled"});
assert.equal(await contextSwitch.isChecked(), true, "Unconfigured Codex must show its effective on default");
- await page.getByText("On by default for Codex; host readiness and actual use are not verified.", {exact: true}).waitFor();
+ await page.getByText("Default on; native setup and use unverified.", {exact: true}).waitFor();
await page.setViewportSize({width: 390, height: 844});
assert.equal(await page.evaluate(() => document.documentElement.scrollWidth > window.innerWidth), false);
await contextSwitch.scrollIntoViewIfNeeded();
@@ -235,7 +235,7 @@ export const configurationBackupScenario = {
assert.equal((await storedSettings()).namespaces.context_delivery.mode, "off", "Failed apply must preserve saved off");
await page.unroute(applyRoute);
await contextSwitch.click();
- await page.getByText("Codex preference is on; host readiness and actual use are not verified.", {exact: true}).waitFor();
+ await page.getByText("On; native setup and use unverified.", {exact: true}).waitFor();
const afterSettings = await storedSettings();
assert.equal(afterSettings.namespaces.context_delivery.mode, "on");
assert.equal(afterSettings.namespaces.goal_storage.new_goal_provider, "sqlite", "The opt-out/on transaction must preserve sibling settings");
From 42a3b073a8bb865b3822a90a736b749a17d73252 Mon Sep 17 00:00:00 2001
From: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>
Date: Sun, 1 Nov 2026 16:50:11 +0530
Subject: [PATCH 12/18] test(context): retain original Turn expansion in
fallback oracle
Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>
---
loopx/capabilities/machine_configuration/context_delivery.py | 2 +-
tests/control_plane/test_context_machine_configuration.py | 5 +++--
2 files changed, 4 insertions(+), 3 deletions(-)
diff --git a/loopx/capabilities/machine_configuration/context_delivery.py b/loopx/capabilities/machine_configuration/context_delivery.py
index 2888e9c423..2812556e5c 100644
--- a/loopx/capabilities/machine_configuration/context_delivery.py
+++ b/loopx/capabilities/machine_configuration/context_delivery.py
@@ -29,7 +29,7 @@ def context_delivery_machine_configuration_namespace() -> MachineConfigurationNa
title="Differential context",
description=(
"Reuse unchanged context for Codex App heartbeats, SSH Goals and benchmark heartbeats. On by default for supported Codex sessions; "
- "unsupported declarations fail and known context loss keeps full context. "
+ "explicit unsupported activation fails and known context loss keeps full context. "
"Completed reads use an explicit native-hook continuity assumption. "
"A saved preference does not establish host readiness or actual delta use."
),
diff --git a/tests/control_plane/test_context_machine_configuration.py b/tests/control_plane/test_context_machine_configuration.py
index 47faf116b7..a5e1b0848e 100644
--- a/tests/control_plane/test_context_machine_configuration.py
+++ b/tests/control_plane/test_context_machine_configuration.py
@@ -432,8 +432,9 @@ def response(request, number, message):
words = shlex.split(command)
if "--context-delivery" in words:
index = words.index("--context-delivery")
- del words[index:index + 2]
- command = shlex.join(words)
+ # Keep the original shell quoting and $LOOPX_TURN
+ # expansion while omitting only this presentation flag.
+ command = command.replace("--context-delivery " + words[index + 1], "", 1)
return {"type": "function_call", "id": "guard-call", "call_id": "guard-call",
"name": "exec_command", "arguments": json.dumps({
"cmd": turn_assignment + "\n" + command + " > " + shlex.quote(str(saved)),
From 628ce2ebbd2a55b2de26ad080e035edc65b61177 Mon Sep 17 00:00:00 2001
From: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>
Date: Sun, 1 Nov 2026 16:51:47 +0530
Subject: [PATCH 13/18] docs(context): clarify supported defaults and preserve
diagnostic errors
Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>
---
.../personal-workspace/machine-configuration-settings.tsx | 4 ++--
tests/control_plane/test_context_machine_configuration.py | 4 +++-
2 files changed, 5 insertions(+), 3 deletions(-)
diff --git a/apps/presentation/dashboard/src/features/personal-workspace/machine-configuration-settings.tsx b/apps/presentation/dashboard/src/features/personal-workspace/machine-configuration-settings.tsx
index 12b56a7dbb..8189af30ad 100644
--- a/apps/presentation/dashboard/src/features/personal-workspace/machine-configuration-settings.tsx
+++ b/apps/presentation/dashboard/src/features/personal-workspace/machine-configuration-settings.tsx
@@ -538,8 +538,8 @@ export function MachineConfigurationSettings({ section, onChanged }: {
: locale === "zh-CN" ? "默认开启；原生初始化与实际使用尚未验证。" : "Default on; native setup and use unverified."
: locale === "zh-CN" ? "Codex 已关闭。" : "Off for Codex."}
{locale === "zh-CN"
- ? "目前仅支持 Codex App 心跳和 benchmark 心跳，无法确认或不支持的跑法报错。保存偏好不代表当前会话已采用差分，也不会改变其他应用或显式关闭的实验。宿主准备就绪且旧上下文完整时才使用差分，否则保留完整上下文。私有存储与会话隔离自动管理；每轮回执显示实际传输方式。"
- : "Currently supports only Codex App and benchmark heartbeats; unknown or unsupported declarations return an error. Saving a preference does not establish use in the current session or change other applications or explicitly disabled runs. Delta requires a ready host and complete retained context; otherwise full context is preserved. Private storage and session isolation are automatic; each delivery reports its actual mode."}
+ ? "受支持的 POSIX Codex App／SSH 和 benchmark 心跳默认开启；已保存的关闭继续生效，benchmark trial 可单独显式关闭。其他应用和平台保留完整交付；显式开启遇到未知或冲突跑法会报错。保存偏好不代表当前会话已采用差分。宿主就绪且旧上下文完整时才使用差分，否则完整恢复；私有存储与会话隔离自动管理。"
+ : "Defaults on for supported POSIX Codex App/SSH and benchmark heartbeats. Saved off is preserved; benchmark trials can explicitly disable it independently. Other applications and platforms retain full delivery. Explicit on rejects unknown or conflicting modes. Saving a preference does not establish current-session adoption. Delta needs a ready host and complete retained context; otherwise full context is restored. Private storage and session isolation are automatic."}
: null}
{editorAvailable && selected.capability_id !== "context_delivery" ? <>{editorMode === "json" || !selected.configuration_editor.fields.some((field) => field.key === "enabled" && field.input_kind === "boolean") ?