[loopx-agent]

The raw quota caller and ordinary Host received different execution obligations: the envelope producer truncated five contracts, and the structured Host omitted signed policy/action context. Consumers also handled unsupported wire versions inconsistently: a matching old action digest could let an unknown envelope/signature declaration reach a Host. This PR preserves the existing work contract through the final input and rejects unsupported declared versions before dispatch.

Changes use the existing TypeScript envelope owner and current Turn/Host entrypoints:

• Preserve complete work_lane_contract, execution_obligation, autonomous_replan_scope, agent_scope_frontier, and automation_liveness JSON, including nested data, long clauses, order and empty values.
• Deliver signed decision facts, action flags/choices/capability intent, notification/execution/scheduler/response/orchestration policies, remaining capsule and capture references to ordinary structured Hosts. Keep primary-action precedence, nonbinding alternatives and separate capability versus ordinary-delivery permissions. Work segments return results; the outer Turn executor retains state, quota and scheduler effects.
• Reuse one typed consumer-version check in Turn planning, native Codex prompt construction and structured Host extraction. Explicit unknown/null envelope, action-signature schema or coverage declarations fail before launch. Preserve the owning diagnostic through the existing plan/error transport. This intentionally tightens unsupported-version handling; no new schema, format negotiation, binding configuration or writer switch is introduced.

Compatibility and scope:

• Supported v0 envelopes and registered signature coverage v0–v5 remain readable. Existing v0 planning callers that omit signature metadata retain prior behavior. Version checks do not substitute for digest, lineage, current authority or settlement checks, and do not interpret unknown required nested semantics.
• Frozen historical bytes and original digests still validate. Re-projecting an older raw decision can produce a different signature after complete-contract preservation; tests explicitly distinguish that new projection from unchanged historical evidence.
• Raw quota output and domain decisions remain unchanged. Real disposable File/SQLite quota and direct Turn paths exercise independent original requirements, actual final inputs, capture/recovery and original settlement. No authority-store implementation changes or PostgreSQL qualification claim. Native model processes are synthetic; installed App, model benefit and the future unified schema remain unqualified.

Validation at e6d1a000f3ac9d9d3364177200d72b62394c6856:

• Final source/Host/Turn planning and execution/DSH/native Codex/capture/history suites: 630 passed. TypeScript envelope suite: 44 passed. Includes six real File/SQLite CLI refusal cases and three native process-boundary cases; unsupported declarations cause no Host launch or quota debit.
• Thirteen strengthened cases fail with the previous ceb7bd75a consumer functions substituted into the same checkout; thirteen also fail when the shared version gate is deliberately removed. This is component sensitivity, not a full-tree baseline. The previous direct Turn path already rejected an unknown outer schema, but lost its actionable diagnostic; unknown signature schema/coverage could reach execution. The structured and native prompt consumers also lacked the outer-version gate.
• On one identical valid synthetic input, the plan, structured authority and native prompt are exactly equal to the prior consumer functions. Frozen historical fixtures are unchanged. This version check adds no model-input bytes on that sample; additional bridge validation cost has not been performance-qualified.
• Standard premerge: four direct checks, changed-Python compilation, eight catalog canaries, eight risk smokes and public-boundary check passed. TypeScript typecheck, Ruff, staged/committed bilingual checks and whitespace checks passed. Semantic advisory reports no supported new vocabulary carriers; its coverage is limited. The new internal consumer_version operation reuses existing registered wire constants and adds no persisted vocabulary.
• Earlier broader failures remain disclosed: 28 failure IDs reproduced on base 99921829f (capability/preference fixtures missing canonical authority and two staged-replan finding-status fixtures). A separate historical/live-Turn/replan/capture combination had 107 passes and six failures, reproduced with the prior adapter (four canonical-authority and two finding-status fixtures). The passing suites above do not convert those failures into passes.

Earlier preservation costs remain: one identical ordinary input's envelope grew 22,116 → 22,293 bytes (+177), capsule 1,928 → 2,105; the structured prompt grew 5,199 → 7,030, then 7,394 bytes as omitted policies/actions were restored. Counts overlap across prior runs; bytes are not token cost. No latency, lower-cost or model-effectiveness benefit is claimed.

This is a reversible preservation and consumer-compatibility prerequisite for C1 in #7416. Full composition before both capture entrypoints, one writer/version transition, remaining-reader retirement, differential context and two-session qualification remain open. Existing product entrypoints carry the refusal; no new frontend capability or setting is added. No model/paid run, live installation, release or merge authority is implied.

中文：本 PR 修复完整执行契约在 producer 与普通 Host 输入之间的丢失，并收敛消费者版本检查。Turn 规划、原生 Codex 和结构化 Host 共用 TS 版本门：显式未知/null 版本即使旧摘要匹配也在启动前拒绝；原诊断通过既有错误通道保留。历史捕获/摘要不改写，兼容既有 v0 及已注册覆盖版本；不新增 schema 或切换 writer，不将未知嵌套语义视为已实现。

最终 Python 630 过、TS 44 过；13 个反例在旧消费者函数及移除版本门的 mutation 下分别失败。真实 File/SQLite CLI 与合成原生进程验证拒绝且不启动/扣费。相同合法输入的 plan、authority、prompt 与旧函数一致；额外 bridge 成本未测。premerge/typecheck/Ruff/双语通过。原广测 28 项及另一组合 6 项基线失败仍保留披露。C1 完整组合、统一 writer、差分上下文及双会话资格未完成；未合并、未安装、未证明模型收益。

[loopx-agent]

Reviewer: model_agent | gpt-6.1-sol | OpenAI | reasoning_effort=max | runtime_reported

动机

An ordinary agent can receive an admitted task while losing the restrictions that explain how to execute it. For example, a saved continuation requirement can survive in the decision capture but disappear from the structured Host prompt. The operator then has to recover that context manually, and the Host cannot reliably distinguish notification policy from work authority. This PR preserves those existing obligations through the current producer and consumers. It also rejects explicitly incompatible wire versions before launch. It does not qualify natural model adoption, installed App behavior or the complete controller-unification roadmap.

中文：这条修复路径有实际价值；本轮仍需修正受影响的真实 Host 回归测试，才能形成可交付的验证闭环。

改动思路

The authoritative decision remains upstream. TypeScript copies complete contract objects rather than reclassifying their prose or truncating nested obligations. The Python adapter verifies and transports the signed data; it does not acquire settlement authority. The version check is also owned by TypeScript and called by planning, native Codex prompt construction and the structured adapter.

Boundary	Baseline	Reviewed head
Contract capsule	Selected fields and bounded text	Complete five existing contract objects
Ordinary structured Host	Drops several signed sections and capture reference	Retains policy, action flags, capsule and original capture identity
Explicit unsupported wire version	Some consumers rely on digest/outer shape	Refused before launch

This source-derived comparison is explanatory, not execution evidence. Keeping these correctness invariants in the existing producer and transport owners is proportionate: no new state store, task lifecycle or optional strategy is introduced. The current boundary is complete contract transport and version refusal; broader controller consolidation remains separate.

具体改动

Reviewed exact head: e6d1a000f3ac9d9d3364177200d72b62394c6856. Specification: docs/reference/protocols/turn-envelope-v0.md at immutable revision 99921829f2c5fa2ad35a024c72abb88717003ef3 (accepted baseline). The following criterion labels identify the existing named clauses, rather than inventing new acceptance gates:

• full_work_context — implemented: complete authored task and Note remain in the authoritative work_context.sources; the selected-task display may be bounded. Independent short/long File and SQLite captures verified the full carrier.
• signed_execution_boundary — implemented: the five complete contracts, ordinary policies, false/null values and original source reference reach the shared Host input. Tampering still rejects. Version declarations are checked separately from the historical digest.
• outer_turn_settlement — implemented: Host instructions preserve the semantic-result/outer-executor split; replay does not create a second admission or quota spend.
• historical_capture_identity — implemented: existing capture bytes and signature documents are retained. Newly projecting the same source can legitimately produce a different envelope hash.

关键代码讲解

1. contractCapsule clones the five existing objects, preserving their complete nested contents. Full authored task text is supplied through the existing work-context owner, not inferred from a short action label.
2. extract_turn_authority verifies the signature, retains signed policy/action/capsule fields, and forwards the original capture reference. DSH uses this shared input path; native Codex retains the envelope and uses the same version gate.
3. assertTurnEnvelopeConsumerVersion rejects explicit unknown/null envelope, signature and coverage declarations. Legacy omission is intentionally accepted. This compatibility check does not replace digest, lineage or current-authority verification.

对主干的风险

[P2] Repair the affected real DSH regression before delivery. The new detail branch at host_candidate.py:180 intentionally retains detail_ref and action_signature for ordinary execution. However, tests/control_plane/test_turn_host_context_delivery.py::test_captured_context_reaches_actual_host_without_readmission still asserts their absence for off/inline. All four off/inline × File/SQLite cases pass at 99921829f2c5fa2ad35a024c72abb88717003ef3 and fail on the changed behavior. They abort before their later tamper/no-extra-effects assertions. This is a test/validation regression, not evidence that retaining the source reference is wrong. Update the four off/inline assertions in test_captured_context_reaches_actual_host_without_readmission to require the original detail_ref/action_signature, while retaining mode-specific agent_context, tamper, no-readmission and no-effects checks; rerun the unchanged six-case real DSH matrix.

The earlier broad local run had 227 passed, 8 failed and 8 conditional skips. An identical eight-node base/head comparison separates four pre-existing CanonicalAuthorityRequired fixture failures from these four introduced DSH failures. A private diagnostic changing only the obsolete reference assertions passed all six DSH modes; it does not turn the repository suite green. At the updated exact head, the selected work-context, native Codex, Turn driver and DSH cohort has 258 passed and the same 4 DSH failures; no conditional skips in that cohort. GitHub CI was neither queried nor waited on.

语义与 CI 对齐

The patch reuses existing contract vocabulary and makes transport retention intentional and documented; it does not add a permission or execution decision. The new wire-version gate extends consumer validation with a bounded legacy-omission rule. Existing machine flags remain obligations, not advisory prose. The local affected-path failure must be repaired in its owning regression, without removing tamper checks or weakening the invariant. Original corpus failures and conditional native-provider skips are preserved as separate limits.

我的整体评价

English verdict: REQUEST_CHANGES

Request changes conclusion (author-owned PR; GitHub blocks formal self-review). The contract-preservation delta is a justified increment and the architecture should remain with the current owners. Long-horizon correctness is improved at the transport/replay boundary; sustained model outcome and total cost gains remain unmeasured. The operator's repeated context-recovery burden is reduced in the verified synthetic Host path, with no rendered presentation change requiring screenshots. Visual review is not applicable to these CLI/Host contract changes; installed/native UI behavior remains outside this review's qualified boundary.

The same independent File/SQLite harness exposed the baseline loss and verified the repaired full carrier, signed flags, capture identity, tamper refusal and no-extra-spend behavior. The updated exact-head TypeScript envelope suite also passes all 44 cases. Prompt growth is a disclosed cost, with no claim of token savings or model comprehension. Re-review needs the minimal DSH fixture repair and a passing unchanged six-mode repository matrix at the new exact head; the complete controller project is not a prerequisite for that repair.