[loopx-agent]

Goal And Delivered Outcome

A frozen periodic-report source and a self-consistent editorial request could disagree: changing a fact's URL or summary and recomputing the request digest was accepted. This fix binds newly prepared private and managed-Session editorial facts to their unchanged frozen source at cache reuse, generation and independent validation.

• Outcome basis: reproduced defect in the existing report-generation path; no new roadmap item.
• Before → after: 24 negative cases against the parent revision lacked the expected rejection; the fix checks the complete ordered fact list and source revision.
• Intended base: main.

Author Declaration

• Written by: model_agent, OpenAI GPT-6 Codex.
• Specification and revision: this PR's reproduced-defect scope, implemented against docs/product/periodic-reports.md at parent d60b1f9ef1e8eb529aec7a85ba5e132555774ae6.

Criterion	Disposition	Symbol / path	Validation
Derive the complete editorial facts from the frozen source	implemented	_source_facts, _verify_source_facts	Source-bound preparation, substitution and independent-validator cases
Reject substitutions before generation or model effects	implemented	Both prepare paths and freeze_private_report	Private/managed cases; original managed-Session entrypoint with File and SQLite
Preserve historical windows	implemented	Markerless compatibility path	Existing legacy fixtures and read-only validation of four original historical windows
Keep source access and disclosure authority unchanged	implemented	Existing source and destination owners	No added reader, access grant, network effect or renderer inference

Scope And Continuation

Complete for source-to-fact consistency in newly prepared requests. The local artifact marker is retained in the frozen source and generation receipt, so removing it from the request cannot select legacy behavior; historical windows keep their original contract and bytes. This does not establish truth, disclosure permission or URL reachability, and does not manufacture accessible citations for opaque evidence. Supplying permitted public provenance remains with the existing source owner and report work; no duplicate follow-up is created.

Validation

• Tested revision: 5b02696defcd6225eb3c8bb95669e2f394898ace.
• Run state: finished.
• Input classes: synthetic, public_fixture, authorized_private_read_only.

Check kind	Result	Evidence / limitation
regression_parity	passed	Same final private-generation test file against the exact parent production module: 24 expected rejection failures and 18 passes; all failures were missing rejection.
unit	passed	Private-generation, source-collection and HTML suites: 104 passed.
integration	passed	19 original managed-Session/steward cases with File/SQLite: preparation, original worker generation, historical recovery, cancellation and next-window/new-Goal continuation.
regression_parity	passed	Read-only independent validation of four original historical windows; all original bytes preserved. Private contents and identifiers are not published.
static	passed	Ruff on changed Python paths; repository-configured mypy (17 files); Python compile, diff hygiene, committed RFC bilingual check and semantic vocabulary advisory.
integration	passed	Standard diff-selected premerge: 11 selected checks, zero failures or manual holds, including public boundary scan.
static	failed	An extra strict mypy invocation targeting the unconfigured report module expanded into imported modules and reported 5,448 errors in 615 files. It is not a passing type check; the repository-configured command passed.
static	failed	A separate check using the existing local registry reported an unavailable canonical Todo contract for an unrelated registered Goal; its scan of the four changed files was clean. Isolated premerge public-boundary validation passed.

The first in-progress broader run was interrupted after a review found an input-marker-removal bypass; its partial results are not final-head evidence. The final cases include marker removal with otherwise consistent request/receipt digests.

Coverage includes cache reuse, freeze-before-write rejection, post-generation independent validation, markerless historical compatibility and original managed-Session behavior with File/SQLite. The full repository test suite and live report generation/delivery are not run; no model calls, business messages or original service restart were used for this qualification. Current Goal policy disables change-quality qualification; no quality receipt is claimed.

Frontend / Visual Evidence

• UI impact: none. Existing rendering is unchanged; screenshots are not applicable.
• Source data: none for visual evidence.

Type of Change

• Bug fix
• Documentation update
• Test update

LoopX Area

• Capability or extension
• Host or runtime integration

Shared-authority RFC fixture impact

N/A: no authority routing, promotion, provider contract or RFC pair changes.

Boundary Checklist

• Public diff and text exclude private state, credentials, raw traces, private links and machine paths.
• No maintainer-owned benchmark execution.
• Scope limited to the reproduced report-source defect.
• No paired RFC changed; committed bilingual check passed.
• UI impact is none.
• DCO sign-off included.

[loopx-agent]

Reviewer: model_agent | GPT-6 Codex | OpenAI | self_reported（宿主执行记录 unavailable/session_not_found）

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

未发现阻塞性问题。审查对象为完整 head 5b02696defcd6225eb3c8bb95669e2f394898ace，包括首次实现后发现并修复的“删除输入标记绕回旧格式”反例。这里批准的是来源一致性修复，公开出处和原服务采用仍须独立验收。

动机 / Motivation

生成个人私聊或原 Session 日报的用户会遇到这条来源链。以前可把事实的链接换成冻结来源里没有的地址，重算摘要后仍生成报告；现在在缓存复用、冻结生成和独立验收时拒绝该输入。这里的“冻结来源”是这一期已保存的原始证据；输入自身的摘要只能证明文件自洽，无法证明它仍忠于那份证据。来源文件保持不变时，不支持的链接、事实摘要、事实遗漏、来源版本替换及删除输入标记均被拦截。本 PR 不证明事实为真、公开授权或网址可访问，也不替原来源补写可点击出处。不处理会让一份所有摘要都正确的报告带上未由来源提供的引用。

改动思路 / Approach

同一冻结 IO owner 重算事实，比在 renderer 或业务 Agent 增设平行检查更小；两条现有准备入口共享派生规则。本次仅关闭新日报的来源到事实一致性缺口，保留历史窗口和现有业务、受众、调度与授权边界。事实列表从原始来源按完整顺序重新构造，比较发生在缓存交还给原 worker 前、任何生成写入前，以及原 Turn 独立 validator 内。既有文件锁、原 Session 资格与原受众返回仍归原 owner。

最强反例是删除请求里的新标记，再重算摘要。首次提交确实仍会接受，因此没有沿用首次结论。最终实现把格式标记同时放在新冻结来源中；删除输入或输入和回执里的标记均不能把这个新窗口伪装成旧窗口。没有标记的真实历史窗口继续走原合同，避免修改或重发已送达的历史报告。这是默认 IO 不变量，不增加启用开关、授权名单或新消费者。

具体改动 / Changes

没有单独书面规格规定这次新增的跨文件事实比较，验收以本 PR 已复现的来源替换问题为边界；原产品文档 d60b1f9ef1e8eb529aec7a85ba5e132555774ae6 的冻结、授权和生成/送达区分作为上下文，不能用本次文档改写反向证明实现。

关键代码讲解

1. _source_facts 汇合原私聊与 Session 两套事实构造，保留原标题、摘要截断、coverage 类型及 source_ref 规则，没有让 renderer 推断出处。
2. _verify_source_facts 同时检查冻结来源/输入格式、来源摘要、source_revision 和完整有序 facts。旧窗口仅在两侧均无标记时保留旧合同；因此删除单侧标记会失败。
3. freeze_private_report 在写 authored response、报告正文和 generation receipt 前执行比较；负例保留 source 原字节且没有这些生成副作用。
4. validate_private_generation 沿用原正文、bundle、candidate 和回执的独立复算，再加来源到事实比较。即使请求、响应、candidate 与回执摘要都被一致重算，仍不能跳过独立来源。

两个现有准备入口自动写入新格式，原 ManagedSessionReports.prepare 与 StewardReports 继续调用它们；没有新增外部 reader、CLI、状态 authority 或第二条业务执行链。测试覆盖 URL、摘要、遗漏、版本、标记移除及生成后的自洽替换；文档明确一致性和真实性/公开权限的区别。

对主干的风险 / Risks

主要风险是冻结历史格式和原 worker 的继续执行。最终版本中来源/生成/HTML 三组共 104 项 PASS；原 managed Session/管家路径 File、SQLite 的生成、恢复、取消、下一期及新增授权 Goal 继续共 19 项 PASS。相同最终私有生成测试在不可变父版本上有 24 项缺少预期拒绝、18 项正常通过，在本 head 全部通过，证明负例可识别旧缺陷。4 个真实历史窗口只读验证 PASS，原字节均未改变。

标准 premerge 的 11 项选择、Ruff、仓库配置的 mypy 17 文件、编译与 committed RFC 检查均 PASS。没有查询或等待 CI。额外直接对未配置的 report 模块做 strict mypy 会扩展到导入树，5448 项错误不记为通过，也不声明这一更大范围已无类型问题。另一次带现有 registry 的检查在无关 Goal 的 canonical contract 上失败；相同四个文件扫描干净，隔离 premerge 扫描通过。两者保留在 PR 验证记录中，没有改 gate 或扫描文件范围消掉失败。

首次更广测试因评审后实现变化而中断，128 项部分通过不作为最终 head 证据。测试使用合成来源、真实临时 File/SQLite 和原执行入口，模型响应由 fixture 提供；没有以它证明生产模型、真实新报告质量或业务消息已送达。拥有本机写权限的一方若同时改写整个来源及全部产物，不在本次一致性保证内；此处没有认证签名或防篡改 authority 的承诺。

语义与 CI 对齐

source_fact_binding=frozen_source_v1 是已有私有产物内的局部格式见证，producer 为这两个真实准备入口，重放 owner 为同一冻结模块，不是全局状态词表或权限。无新增 scheduler/quota/settlement 规则。缺省启用新格式、旧历史保持原样的改变已在产品文档披露；语义 advisory 未发现受支持的新词表载体，但这不替代本次对实际字段与消费者的人工核验。

我的整体评价 / Verdict

该具体修复达到 goal_achieved；更大的日报内容/公开来源工作仍未完成。long_horizon 为 improved：正常新窗口仍由原 worker 继续，坏缓存不能靠反复重算摘要进入生成；user_experience 为 improved：不增加用户确认或复制工作，提前拒绝未由来源提供的引用。private_generation 的 IO 校验与文档说明变化，renderer 和页面布局均未改动，无渲染视觉变化。视觉改动不适用；真实新日报的生成、外部投递和公开出处仍未在本次验收。

同一冻结 IO owner 重算事实，比在 renderer 或业务 Agent 增设平行检查更小；两条现有准备入口共享派生规则。本次仅关闭新日报的来源到事实一致性缺口，保留历史窗口和现有业务、受众、调度与授权边界。兼容分支仅服务已经持久化的历史窗口，不能据此增加第二套决策。最终 head 的反证和正常路径足够支持这一局部改动，合并资格和安装采用另外核验，不把评审批准当原消息闭环或父 Goal 完成。

English verdict: APPROVE — head 5b02696; no blocking findings. Source/fact substitution and marker removal are rejected; 123 focused checks and the standard premerge passed. Live report delivery and public provenance remain outside this fix.