[loopx-agent]

Global Goal reads can report missing canonical authority, or read unrelated records, when the declared source registry uses another runtime. This change routes Todo list/exact reads, contract diagnostics and Manager details through the existing source-runtime owner. It uses the source registration metadata, retains real CLI runtime overrides and refuses missing, unreadable or mismatched sources.

The source provider and complete records remain authoritative. This adds no migration, activation, provider selection, configuration or UI. Manager owner/group paging and privacy rules remain in their existing typed owner. The bounded cleanup imports registry decoding directly and passes the optional Todo identity directly.

Validation at 2e4ba963dc2ef60c7c2aa93786ccdf0634b420ff:

• 110 current entrypoint/Manager tests passed, including 12 real File/SQLite route cases. The same 12 cases passed on an isolated Python 3.12 wheel, with production code loaded from that installation.
• Cases cover full long UTF-8 exact reads, active/archive records, source registration changes, stale shared registration metadata, explicit overrides, invalid sources despite a valid shared decoy, and Manager owner/group visibility. Existing same-runtime paths remain covered.
• Changed-file Ruff, configured mypy (17 files), public-boundary scan, bilingual diff check and wheel build passed. The semantic advisory found no new supported vocabulary carrier; the new test lies outside its supported product-source root and was reviewed manually.
• Premerge executed six direct checks and eighteen selected checks without command failures. Its overall gate remains held by change-quality qualification.

Required validation is not green: repository-wide Ruff reports three F811 findings in tests/test_chat_conversation_bindings.py; the full pytest invocation stopped at a native-checkpoint guard failure (331 passed, 155 skipped), leaving the remainder unexecuted. Adjacent cohorts also retain four contract-health assertions and one unpromoted-display error-text assertion; all five were reproduced on the unchanged 15803cd7d base. None is waived or relabeled as passing. The exact-scope change-quality receipt is nonpassing for these validation limits.

This is a source and isolated-package proposal. Live installation, persistent recovery, independent review and merge readiness remain separate qualifications.

Remote Python Tests also fail the top-level module budget (146 modules against a pinned 145). The base and this head contain the identical 146 top-level Python paths, and the targeted local test reproduces the failure. See the failed workflow. Required CI remains failed; this evidence does not waive it.

[loopx-agent]

Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; reasoning_effort=max

Reviewed exact head: 2e4ba963dc2ef60c7c2aa93786ccdf0634b420ff. Request changes conclusion (author-owned PR; GitHub blocks formal self-review).

动机

从全局工作区查看多个项目待办、或核对 Goal 详情的用户。

当某个 Goal 的 Todo 存在于自己的来源 runtime 时，原先全局读取可能报找不到权威状态；本次应直接读到来源中的完整待办，并在来源不可用时明确拒绝。

新路由的 12 个 File/SQLite 用例通过，但普通 Todo 读取新增加载 history，导致两个原有隔离用例失败；当前仍不能交付。

本 PR 不迁移 authority、不修改 Todo 写入规则，也不证明性能收益或授予执行权限。

改动思路

复用现有路由与 canonical Todo owner 能修复来源错误；应在同一 resolver 内解开 history 的读取依赖，不需要新增配置或平行路由。

当前 PR 应交付完整的源路由读取与原有读取隔离，并保留显式 runtime override；修复新增 import 回归后再复审。

全局 registry 提供索引，真正的来源 registry 提供当前 repository、state_file、runtime 和已注册 Agent；canonical Todo provider 仍是待办权威。显式 runtime 参数继续覆盖自动来源选择。新代码没有复制 Todo 或引入新的 provider：它把列表、管家详情、契约诊断三个既有入口接到同一个 resolver，再由原来的 snapshot/presentation 分层输出。来源失效必须拒绝，不能拿恰好存在的共享目录冒充有效数据。只改列表会让其他两个入口继续相互矛盾，而新增配置让用户重填已知根路径也没有必要。

具体改动

实际审阅 merge-base 15803cd7dcc2fc517049809bbe58998f04f5acac 至 head 的四条路径，+198/-15；三处生产适配与一组来源路由回归用例。未用目标分支差异扩大 PR 规模，也没有修改作者代码。

关键代码讲解

1. list_goal_todos 先解析当前来源，再读取 canonical Todo；展示过滤仍发生在读取之后，full/thin/exact 的内容职责不变。不过第12行新增的顶层 import 引入了下述回归。
2. read_manager_goal_details 使用来源 runtime 读取详情，避免管家自身默认根掩盖已声明的来源。该层只读取，不拥有 Todo 转移或任何执行权限。
3. _todo_contract_diagnostics 从来源读取注册 Agent，并按 runtime 与 Goal 共同缓存 canonical snapshot，避免不同来源的同名 Goal 互用诊断内容。

规范依据为 docs/reference/configuration-backup.md，spec_revision 15803cd7dcc2fc517049809bbe58998f04f5acac；判据来自变更前的 canonical source 规则，并由既有 Todo 读写隔离约束补充，而不是用本 PR 测试反向定义需求。

• For global discovery：implemented。12 new source-routing cases pass on File/SQLite; baseline source CLI fails.
• unavailable source：implemented。Source missing/unreadable/wrong Goal/decoy root negative cases in test_todo_source_runtime_route.py pass.

对主干的风险

[P2] 保留轻量 Todo reader 的 import 隔离。 新增 import 指向的既有 runtime_projection_route 在模块顶层导入 history。于是普通的同根 full/thin/exact Todo 读取也会把 loopx.history 放入 sys.modules。真实 CLI 的既有 test_read_entrypoint_does_not_load_mutation_owners 在 File 和 SQLite 两个参数上都失败；相同测试在不可变基线两项均通过。新来源用例12项通过并不能覆盖这条老边界。

最小修复是在现有 resolver 使用 registry_codec 的 registry reader，仅在两个 history 消费路径按需导入 load_index，保留 source route 的公共 owner。请保留原断言并一起重跑：uv run --extra test python -m pytest -q tests/control_plane/test_todo_list_read_transport.py tests/control_plane/test_todo_source_runtime_route.py。本结论没有把 import 本身说成已测出的延迟、数据损坏或实际 mutation。

语义与 CI 对齐

这里复用现有词汇和 route owner，没有新增状态分类或领域专用义务。当前破坏的是已接受的轻量读取边界；触发点、base/head 对照、修复和重跑命令如上。显式来源失效拒绝、runtime override、长 UTF-8、归档/私有 owner 和 manager 读取均包含在本次聚焦覆盖内。独立四模块执行为 87 passed /2 failed；基线同一 import node 为 2 passed。premerge 的6项直接检查与18项选中自动检查通过，但原始总结果仍为 exit1/quality_stale_receipt，不能称为完整通过；当前 change-quality 记录也必须因本阻塞保持 FAIL。公开边界扫描通过。依当前 wait_for_ci=false 策略没有查询、轮询或等待 CI。

我的整体评价

REQUEST_CHANGES。 来源修复是必要且适度的完整读取切片，无需第二套路由、手工同步字段或大规模语言迁移。兼容成本只在保留现有显式 runtime 与 canonical provider 语义，没有理由放宽读写分离检查。long_horizon 为 not_yet_proven：未来持续读取的来源更准确，但原有隔离边界先要恢复；user_experience 的来源内容和拒绝行为改善已通过真实 CLI/manager 验证，不增加用户确认回合。

检查了 list_readback、chat_manager_details、contract 和新增测试四条路径；没有渲染页面或布局变化。 未资格化原生 Windows、已安装 App 或端到端延迟；本次没有宣称这些结果。

本次没有证明性能提升，也没有资格化整个仓库、Windows 或安装态。请修复 import 依赖后在不变 head 上重新给出两组回归证据。正式自评审使用 COMMENTED 承载本拒绝变更结论；此记录不授予 merge 权限。

English verdict: REQUEST_CHANGES — reviewed 2e4ba963dc2ef60c7c2aa93786ccdf0634b420ff. Source routing works, but the new eager resolver import breaks both existing File/SQLite Todo-reader isolation tests; the same tests pass on the base. Decouple registry loading from history and rerun the existing reader plus new routing coverage.

[loopx-agent]

[P2] 保留轻量 Todo reader 的 import 隔离。这里新增的顶层导入会经 runtime_projection_route 的顶层 history import，把 loopx.history 加入普通 full/thin/exact 读取进程。既有 test_read_entrypoint_does_not_load_mutation_owners 在 File/SQLite 两项均失败，而相同不可变基线两项均通过。请在现有 resolver 使用 registry_codec 的 loader，把 load_index 限于 history 消费路径，并保留原隔离断言、同时重跑新来源测试；不需要另建 route owner。