[loopx-agent]

Ordinary quota admission and native Turn currently expose different projections of the same decision. This unfinished C1 implementation for #7416 composes one complete decision in the existing TypeScript owner before capture and sends it to the actual model-input boundary. The controller/executor architecture and full consumer cutover remain unfinished; this PR is Draft for remaining author work.

Candidate behavior

• Both quota and native Turn compose a flat loopx_turn_envelope_v1 with the complete original facts/instructions, actual scheduler binding and integrity hashes. The old envelope is temporarily internal to effect interpretation and recorded-history decoding, not a permanent alternative model input.
• Codex stdin and the shared structured-host renderer receive the same complete contract, with original hash-bound review/writeback readers. Native launch derives causal binding from the recorded settlement identity; an observed replan obligation cannot replace an existing Todo identity.
• Markdown ordinary/former-envelope entrypoints render the complete source. The context-surface transition forces full delivery once, then reuses exact delta/recovery. Historical captures cannot inherit a fresh admission's contract.
• Original-Turn successor binding and settle-before-ending instructions are composed before hashing/capture by the same owner used for historical staged reads. Modern reads do not append duplicate flags. Creating a successor does not authorize executing it.
• Complete-contract composition and later readers reject unknown, empty or mistyped root execution actions using the registered decision/frontier vocabularies. Valid hashes cannot substitute for supported execution semantics. Unknown optional evidence remains intact; historical unversioned routing is unchanged. This qualifies the root action boundary, not every required semantic field.
• Inactive capability configuration/diagnostics remain source facts, while recall activation and reflection result fields retain their existing boundaries. DSH still requires Todo-scoped sessions and refuses obligation-only replans before dispatch.

Current validation

Runtime head: 2a662fbd2ef40c8ae2f341b7129301224c4b73b0; actual PR target: main (inspected e20e4b684d04e4faed8ca3437880c9bbd70070a0).

• Final complete-contract, selected-work, historical action classification and replan-host suite: 72 passed. The real isolated File/SQLite native CLI receives an injected unknown producer action and rejects it before capture, dispatch or spend. Normal synthetic Codex execution, failed-attempt recovery and once-only settlement still pass. A separate final host-input matrix has 4 passed and overlaps this suite.
• Regression sensitivity: five composition/reader cases failed before the action fix. The same native fault through the preceding candidate reached a later goal_launch_not_allowed refusal instead of rejecting the complete input. This does not establish earlier unguarded execution. A validly hashed unknown contract is also rejected by final Codex/structured/DSH input paths before runner loading.
• Selected-work migration: 10 passed through actual App bootstrap/quota and native turn plan, preserving full canonical task text/notes, scoped user gates, changing requirements, missing-source recovery and original observations. The prior 4 passed / 6 failed run stopped on obsolete root-layout assertions. Those checks now use the complete interaction context and reach their downstream semantics without rebinding App input to a native host.
• Control-plane TypeScript typecheck, focused Ruff, diff hygiene, public/private scan and diff-scoped semantic advisory pass. The action check reuses registered vocabularies; the advisory's lack of supported new carriers is not proof of full semantic coverage. A small shared source validator keeps composition and recovered reads consistent without a second Python rule owner.

Previously qualified boundaries retained

Actual isolated File/SQLite CLI plus synthetic host checks cover original-source stdin delivery, changed/missing-capture refusal, failed-attempt recovery, historical isolation, both replan binding forms and once-only settlement/replay. The inline successor lifecycle uses the complete contract to create work, reject premature spend, settle the original identity once and leave the successor open, without a second guard or staged reader dependency. Its earlier 68-pass selection and 4-pass matrix overlap and are not additive.

Benchmark checkpoint preflight covers File/SQLite, replan/non-replan and context delivery on/off: model-input file and optional full recovery retain the exact source, one admission and read-only recovery. Optional native session capture is disabled in that synthetic test. External-worker recovery/continuity previously passed 70 checks, but an opaque shell wake does not establish delivery to an executor model.

The host-memory suite previously passed 105 checks and four historical modes retained exact prompt equality. This establishes transport/activation boundaries, not model behavior. Markdown source equality, JSON types and arbitrary instruction text are qualified at the CLI; prior renderer, native dual-binding and release-fixture import failures were repaired and remain historical evidence.

Open failures and delivery limits

• The broader staged-reader/action/replan selection is 40 passed / 6 failed. All six failures reproduce with the preceding production source: four require the removed compact writeback layout; two expect unavailable pure-replan Explore authoring to be suppressed. Their downstream checks remain unqualified. Complete-source preservation alone does not resolve that capability-guidance question.
• Earlier broader consumer characterization was 101 passed / 46 failed / 19 skipped, versus 121 passed / 26 failed / 19 skipped on its preceding candidate. New signature-diagnostic and DSH fixture mismatches were corrected; older presentation/reader migrations remain. The separate 24 passed / 6 failed preferences run reproduced all six failures on its prior head. SDK skips are unqualified.
• Earlier quota/replan checks were 168 passed / 3 failed: two capability-reentry aliases were migrated and passed; the cache case passed alone without changes, leaving suite consistency unresolved. Earlier capture checks stopped at 5 passed / 5 failed on old layout expectations. Release cold-import checks were 95 passed / 2 failed before fixture repair. None of these historical results is relabeled as a complete pass.
• Unrestricted mypy failed across dependencies; two focused files passed, while the renderer check has one assignment error reproduced on prior source. Whole-tree typing and full risk-based delivery qualification are not claimed.

Before cutover, finish remaining quota/staged/external/optional consumers, resolve the open guidance/cache failures, retire historical effect adapters on their stated compatibility boundary, and qualify native session/full-delta-resume plus packaged App journeys. Preserve independent instruction obligations, supported versions and original settlement identities throughout. No model/benchmark job, installed-host adoption, performance/quality benefit, installation or merge is claimed. C1 remains open; this candidate is not ready for adoption or merge.