From 12e74ab141baf33676552140c820737cb3614f3d Mon Sep 17 00:00:00 2001 From: LoopX Agent <337587101+loopx-agent@users.noreply.github.com> Date: Wed, 28 Oct 2026 23:10:42 +0800 Subject: [PATCH] docs: define delegation fulfillment and backlog recovery acceptance Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com> --- .../capable-manager-semantic-handoff-v0.md | 109 +++++++++++++++++- ...pable-manager-semantic-handoff-v0.zh-CN.md | 74 +++++++++++- .../use-cases/steward/golden-queries.md | 42 +++++++ 3 files changed, 217 insertions(+), 8 deletions(-) diff --git a/docs/architecture/rfcs/capable-manager-semantic-handoff-v0.md b/docs/architecture/rfcs/capable-manager-semantic-handoff-v0.md index 5683e7c604..e5943db6aa 100644 --- a/docs/architecture/rfcs/capable-manager-semantic-handoff-v0.md +++ b/docs/architecture/rfcs/capable-manager-semantic-handoff-v0.md @@ -4,7 +4,7 @@ - **Supersedes / closes:** [Personal Follow-through independent proposal](personal-follow-through-v0.md) - **Delivery maturity:** Partial; private runtime profile, team-plan confirmation and Todo materialization shipped; complete M1–M4 remain unqualified. - **Authors / owners:** LoopX maintainers; manager engineering owner -- **Created / last normative revision:** 2026-09-13 / 2026-10-27 +- **Created / last normative revision:** 2026-09-13 / 2026-10-28 - **Implementation baseline:** `7eb4b7bb1661bd5eff63a8725a33169792d5964b` - **Language mirror:** [中文版](capable-manager-semantic-handoff-v0.zh-CN.md) - **Related contracts:** [Effect interpreter](agent-loop-effect-interpreter-v0.md), [Manager continuity](../../reference/protocols/manager-evidence-and-continuity-v0.md), [Goal Vision/Replan](../../reference/protocols/goal-vision-replan-contract-v0.md), [Desktop frontends](desktop-execution-frontends-v0.md), [Shared authority](shared-goal-authority-state-provider-v0.md), [Shared Goal alignment/amendment](shared-goal-alignment-and-governed-amendment-v0.md), [TS migration](typescript-control-plane-migration-v0.md) @@ -707,7 +707,7 @@ Routing uses §5.5 rather than a static Agent name list. For a product-design re Delivery now prioritizes one complete supported intent→receiver→work→result journey, with the shared report, activity and stop/steer behavior needed by that journey. Do not make routing wait for presentation polish across every channel. Frontend and Lark still need separate real acceptance before an equivalence claim. Characterize and retire duplicated answer-shape prose and message/Turn correlation rules where parity is proven. -The [golden-query pack](../../product/use-cases/steward/golden-queries.md) supplies short user requests and independent outcome/attention oracles. GQ01/GQ02 qualify creation and existing-Agent connection; GQ03/GQ04 qualify responsible dispatch; GQ05/GQ11–GQ13 qualify two-cycle small-team coordination, with GQ07–GQ09 continuity; GQ06/GQ10/GQ14–GQ15 extend materials, attention and replanning. GQ16/GQ17 remain later cross-host/scale qualification. These are scenario tests over existing A1–A24, not new Core protocol states. +The [golden-query pack](../../product/use-cases/steward/golden-queries.md) supplies short user requests and independent outcome/attention oracles. GQ01/GQ02 qualify creation and existing-Agent connection; GQ03/GQ04 qualify responsible dispatch; GQ05/GQ11–GQ13 qualify two-cycle small-team coordination, with GQ07–GQ09 continuity; GQ06/GQ10/GQ14–GQ15 extend materials, attention and replanning. GQ16/GQ17 remain later cross-host/scale qualification. These scenarios map to A1–A28, including the fulfillment journey in §5.15, without adding Core protocol states. GQ06's [material-to-work pilot](../../product/use-cases/steward/golden-queries.md#gq06-material-to-work-pilot--从材料到实际改进) qualifies an ordinary article request through the same M2/M3 boundary. Source @@ -734,6 +734,91 @@ When routing fails, distinguish unread/unavailable sources, incomplete or stale Ordinary follow-ups retain the responsible owner; direct small reads need no team. One binding retains one execution driver. Existing request/outbox and continuous-monitor owners handle event-driven continuation and delayed return; do not compensate with faster polling. Retain useful constraints through scoped context, distinguishing preference, current fact and action grant; optional memory providers remain optional. GQ03's CI example requires causal evidence and all other review blockers, not a blanket approve policy. +### 5.15 Accepted requests remain accountable through fulfillment + +The product promise is one delegation followed by a usable result in the +original conversation. The sender retains responsibility for integration and +return; the receiver retains responsibility for the accepted work. This section +refines §§5.5–5.6/5.11, not a new request store, scheduler or execution grant. +The [backlog journey](../../product/use-cases/steward/golden-queries.md#delegation-backlog-to-fulfilled-requests--从委派积压到兑现请求) +qualifies these requirements through GQ03/GQ07–GQ09. + +**Assessment must reach execution.** An adoption identifies the accepted delta, +the preserved requirements and its relation to existing work or a supported +request-bound execution. Link existing work where applicable; a pre-created or +hidden Todo is not required. A per-Turn reminder is insufficient unless a safe +continuation actually considers the request in receiver-owned planning. Reuse +the existing Inbox, Turn admission and Host wake: idle and authorized work may +start once; busy work queues; unavailable, paused, stopped, revoked or +budget-limited paths expose their actual condition. A recorded adoption, +registration or wake attempt never proves execution. + +**Corrections retain individual obligations.** The receiver or coordinator may +relate several requests to one artifact/work item using the source, purpose, +destination and accepted revision. Preserve each original request, its delta +and its disposition; text similarity alone cannot merge independent intent. +Before the affected effect, reconcile later corrections and rejected approaches. +Changing the recipient does not retract a delivered misroute: verify the +original/correction receipts and carry any still-needed ownership correction +through the original collaboration path without replaying a delivered correction. + +**Accepted work must not disappear from planning.** At the existing safe +planning boundary, compose incoming, adopted-but-unfulfilled and owed-return +observations with the current runnable frontier. Within existing priority, +dependency, capacity and budget rules, account for waiting age and work already +in progress so repeated new arrivals cannot indefinitely displace an accepted +request. Age is not a priority grant; no preemption, lease transfer or wake of +stopped work follows from this read. Record a material plan delta, actual +continuation or evidenced wait. Do not force progress prose, a new task or a +model wake when nothing changed. Work/result/dependency events and bounded +recovery reuse the existing scheduling and outbox owners. + +**Disposition, fulfillment and delivery are distinct observations.** Derive +them from existing request revisions, assessments, work/artifact versions, +validation and return receipts. These are read-model relations, not a new set +of independently writable lifecycle states. An assessment or a reply can resolve +the communication step while accepted execution remains owed. For each current +requirement, the receiver supplies the result/evidence or a bounded remainder +with its owner and resume condition. A done Todo, hash, plan, PR or a reply named +`conclusion` cannot alone satisfy the original completion question. A requested +analysis needs its full answer; an implementation needs its agreed validation; +an installed-product repair retains adoption/readback when requested. A genuine +deferral/rejection/cancellation remains distinguishable from fulfillment. + +The sender checks returned scope against the current request and corrections, +integrates dependencies and returns the useful result or remaining gap without +requiring the user to relay it or ask again. Reuse existing accepted checks; +ordinary replies do not acquire a mandatory human acknowledgement or a new +independent-verifier requirement. Existing optional acceptance contracts remain +optional. New validation must bind the actual input/output versions; it must +not claim acceptance from delivery or invent checks for an older result. + +**Backlog recovery must preserve truth.** First qualify the original source, +audience, current grant and request lifetime. Reconcile delivered/unassessed, +adopted/unfulfilled, result-ready/undelivered and conflicting-evidence cases +through their existing owners. Reuse verified artifacts and delivered receipts; +do not relaunch finished work, close by age or bulk-wake every recipient. An +old request whose Turn now names another handoff needs an exact conflict and +typed recovery outcome. Never remove the identity guard, overwrite history, +infer cancellation or hide the record merely to make coverage complete. + +**The product reader shows actionable coverage.** Group by responsible Agent, +show the current obstacle/next responsible action and retain full briefs, +corrections, linked work and original conversations on demand. Distinguish +request count, linked work count, filtered matches, loaded rows and unreadable +coverage. Pagination/recovery controls remain reachable with long expanded +content on desktop, narrow view and keyboard. A first page is not the complete +inventory; unavailable records remain locatable without disclosing unverified +private content. App, Lark and CLI consume the same facts within their grants. + +Measure delegation-to-effective-assessment and assessment-to-verified-result +latency, waiting age, duplicate effects, false closeouts, user reminders and +complete IO/model/attention cost. Declare window, denominator, source/version +and unknown coverage. Establish a baseline before numeric targets or savings +claims. Prefer event-driven deltas, request-scoped fresh reads and bounded +backoff over all-history scans on every refresh or per-request model polling; +retain full-source recovery, current authorization and existing output budgets. + ## 6. Alternatives and disposition of #4306 - **Choose normal runtime tools + LoopX semantic state.** It preserves agent flexibility and reuses existing tooling. Its cost is real host-profile qualification and clear private/shared-scope isolation. @@ -806,6 +891,10 @@ The following IDs are durable acceptance anchors for engineering Todos and PRs. | A22 | Tool/progress events, reconnect, SSE replay and delayed final answer | The current phase and only host-emitted public activity are visible; replay deduplicates by event identity, keeps the complete final answer and does not restart the Turn. Failures and absent activity remain truthful | | A23 | Stop and steer an active Turn; stale button, duplicate ingress, completion race and unsupported adapter | Stop affects only the selected Turn and reports the actual outcome. Steering retains its original Turn and ingress identity; stale/unavailable targets are refused. Later queue delivery requires a previously permitted fallback or a new explicit delivery choice, with a distinct truthful receipt. No silent loss, retargeting, duplicate model run or unrelated worker cancellation | | A24 | Steward routes a product request to a responsible active Agent amid stopped, registered-only, stale and model-mismatched decoys | Fresh responsibility, authorization, runtime reachability, capacity and profile fit determine the recipient; receiver assessment, work and final evidenced conclusion return once to the original frontend/Lark conversation. Catalog discovery and inbox delivery alone fail | +| A25 | Idle and busy receivers accept a request without a pre-created Todo; crash between persistence and wake, lose the ACK, revoke the grant or stop before execution | Accepted scope reaches the existing plan/request-bound execution and original return. Busy work queues; restart reconciles the same operation without duplicate invocation/debit. Revoked, stopped, unknown-host and budget-denied paths do not execute; delivery/read/adoption/wake alone fail | +| A26 | Multiple requests share one work item; later corrections, independent same-text requests, new arrivals and a delivered misroute coexist | Each obligation/revision remains attributable and adopted corrections affect the actual work. Existing priority/capacity/stop rules hold while an eligible older commitment progresses. No similarity-only merge, automatic priority change or assumed cancellation; delivered corrections are reused | +| A27 | A linked Todo ends or a partial plan is returned as a conclusion; the actual result arrives during sender/transport restart | Completion follows the original current requirement and qualified result version. A bounded remainder retains its owner/continuation; committed results return without replay. Sender integration and delivery remain distinct from fulfillment; no extra routine user confirmation or invented acceptance for historical artifacts | +| A28 | More than 40 requests across recipients, long details, paging/search, changing snapshots and a historical request/Turn receipt conflict; paired denied audiences | Counts distinguish total/matched/loaded/unknown scope, all authorized pages and original details are reachable, and recovery identifies the exact gap. No mixed snapshots, hidden records, private leakage or bypass of source/receipt guards. Validate real File/SQLite and any additional affected supported provider, packaged desktop/narrow/keyboard, and separately advertised Lark/CLI boundaries | Run deterministic transition/compatibility tests, real installed-runtime qualification, then real frontend/Lark roundtrips with synthetic safe tasks and an authorized private canary. Record runtime/source versions and emitted receipts. Include mobile Lark and packaged frontend render/readback; backend tests alone do not pass A10. Provider receipt ambiguity and offline failure cases are required, not optional happy-path add-ons. @@ -998,8 +1087,8 @@ Implement coherent end-to-end slices, not one PR per incidental field. The manag | --- | --- | --- | --- | | M0 — reconcile direction | Manager capability owner inventories current restrictions, grants, sessions and pending exchanges; closes superseded #4306 path and maps surviving fixes | Existing fixtures + public decision link + no orphaned request; no runtime claim | Documentation/proposal only | | M1 — useful host agent | Manager capability + runtime adapter use ordinary tools/skills and persistent owner grant; frontend exposes effective profile/session, supported tool activity and actionable failures | A1–A3, A12 on real installed runtime; qualify shared-resource coordination; portfolio remains reusable; no per-resource wrapper required | Restore restricted profile, preserve requests | -| M2 — semantic continuation | Core collaboration replaces manager-specific request transitions; reuses alignment and selected work authority; supports pre-Todo/cross-Goal requests and receiver planning; both consumers qualify the same contract | A4–A7, A11, A13–A20 at the supported boundary; A19 requires honest disabled/unqualified behavior and does not mandate Obelisk promotion; old/new parity and crash reconciliation; TS migration economics review artifact (§5.12) | Disable new producer, retain compatible readers and pending results; do not switch Goal authority | -| M3 — automatic complete exchange | Receiver conclusion + existing outbox + frontend/Lark visibility, safe rich output and restart recovery | A8–A10 plus A13–A14/A17/A20 return-path qualification; failure injection and live readback; user receives conclusion without querying | Keep result store, switch transport/profile without replay | +| M2 — semantic continuation | Core collaboration replaces manager-specific request transitions; reuses alignment and selected work authority; supports pre-Todo/cross-Goal requests and receiver planning; both consumers qualify the same contract | A4–A7, A11, A13–A20 and A25–A26 at the supported boundary; A19 requires honest disabled/unqualified behavior and does not mandate Obelisk promotion; old/new parity and crash reconciliation; TS migration economics review artifact (§5.12) | Disable new producer, retain compatible readers and pending results; do not switch Goal authority | +| M3 — automatic complete exchange | Receiver conclusion + existing outbox + frontend/Lark visibility, safe rich output and restart recovery | A8–A10 plus A13–A14/A17/A20/A27–A28 return/fulfillment qualification; failure injection and live readback; user receives conclusion without querying | Keep result store, switch transport/profile without replay | | M4 — promotion and retirement | Three heterogeneous active Goals, owner + shared-scope and configured SSH journeys pass; obsolete manager restrictions/compatibility seams removed | All acceptance rows, permission regression and measured SLO/cost; document remaining unqualified hosts | Scoped rollback with schema-aware drain/export | M1 need not wait for a generic handoff refactor. M3's independent format/delivery fixes may ship early using the existing inbox. M2 promotion needs the second consumer; it must not hold a useful manager-only improvement hostage. No milestone creates an extra user confirmation for routine research or normal delegation. @@ -1033,6 +1122,18 @@ At every PR handoff, report: base/head; this RFC's milestone/acceptance IDs; rel Cross-session sequencing inside these milestones is explicit: first qualify same-Agent replacement with history retrieval disabled; then cross-Agent continuation through the existing transfer adapter; then qualify optional gap recall under its own rollout. Each slice includes the affected CLI/managed Turn, packaged frontend and Lark readback/feedback, rather than deferring product entry points to a later backend-only release. Measure time to the first valid continuation step, retained material obligations, avoided repeated failures, duplicate effects and context cost. More restored tokens or a successful `resume` response alone is not improvement. +For §5.15, the product/manager engineering owner integrates three reviewable +vertical slices into M2/M3: (1) original request → safe wake/queue → real work → +original return, with existing Host/Core owners; (2) corrections, retained +commitments, fulfillment checks and their frontend reader; (3) bounded recovery +of the retained backlog using verified prior effects. Each slice carries its +A25–A28 evidence and retains unqualified acceptance. Reuse the existing wake, +per-Turn agenda and presentation tasks; coordinate their owners rather than +creating a parallel ledger or taking another lane's lease. Docs, unit tests, +an author PR or one synthetic transport do not qualify installed adoption. +Rollback stops the new producer/activation, preserves compatible readers, +original effects and pending returns, and never reinterprets newer journals. + ## 12. Open decisions 1. **Trusted-host profile defaults:** maintainers own promotion. Recommend using the effective owner runtime profile with explicit resource/audience binding, not a new manager ACL language. Before M1, qualify actual read/write/network/approval behavior and migration from existing grants. diff --git a/docs/architecture/rfcs/capable-manager-semantic-handoff-v0.zh-CN.md b/docs/architecture/rfcs/capable-manager-semantic-handoff-v0.zh-CN.md index 1c15253fbd..7fea967d74 100644 --- a/docs/architecture/rfcs/capable-manager-semantic-handoff-v0.zh-CN.md +++ b/docs/architecture/rfcs/capable-manager-semantic-handoff-v0.zh-CN.md @@ -4,7 +4,7 @@ - **替代 / 关闭：** [个人事项持续跟进独立提案](personal-follow-through-v0.zh-CN.md) - **交付成熟度：** Partial；私人运行 profile、团队计划确认与 Todo 物化已交付，完整 M1–M4 未验收。 - **作者 / 责任人：** LoopX 维护者、管家工程负责人 -- **创建 / 最近规范修订：** 2026-09-13 / 2026-10-27 +- **创建 / 最近规范修订：** 2026-09-13 / 2026-10-28 - **实现基线：** `7eb4b7bb1661bd5eff63a8725a33169792d5964b` - **语言镜像：** [English](capable-manager-semantic-handoff-v0.md) - **相关契约：** [Effect interpreter](agent-loop-effect-interpreter-v0.zh-CN.md)、[管家连续性](../../reference/protocols/manager-evidence-and-continuity-v0.md)、[Goal Vision/Replan](../../reference/protocols/goal-vision-replan-contract-v0.md)、[桌面入口](desktop-execution-frontends-v0.zh-CN.md)、[共享权威](shared-goal-authority-state-provider-v0.zh-CN.md)、[共享目标对齐/修订](shared-goal-alignment-and-governed-amendment-v0.zh-CN.md)、[TS 迁移](typescript-control-plane-migration-v0.zh-CN.md) @@ -557,7 +557,7 @@ Stage 2 / R3。 交付改为优先跑通一条已支持的意图→接收者→执行→结果旅程，同批带上它需要的共用报告、活动与停止/纠偏能力。路由不再等待所有渠道的展示打磨；宣称前端/飞书等价前，仍分别完成真实验收。等价行为刻画通过后，消除重复的回答格式说明和消息/Turn 归属规则。 -[Golden-query 集](../../product/use-cases/steward/golden-queries.md)提供简短用户请求及独立的结果/注意力验收。GQ01/GQ02 验收创建与接入已有 Agent；GQ03/GQ04 验收找负责人派单；GQ05/GQ11–GQ13 验收两轮小团队协调，GQ07–GQ09 验收连续性；GQ06/GQ10/GQ14–GQ15 扩展材料、注意力和重排。GQ16/GQ17 保留为后续跨主机/规模验收。这些是既有 A1–A24 上的场景，不新增 Core 协议状态。 +[Golden-query 集](../../product/use-cases/steward/golden-queries.md)提供简短用户请求及独立的结果/注意力验收。GQ01/GQ02 验收创建与接入已有 Agent；GQ03/GQ04 验收找负责人派单；GQ05/GQ11–GQ13 验收两轮小团队协调，GQ07–GQ09 验收连续性；GQ06/GQ10/GQ14–GQ15 扩展材料、注意力和重排。GQ16/GQ17 保留为后续跨主机/规模验收。这些场景对应 A1–A28，包含第 5.15 节的兑现旅程，不新增 Core 协议状态。 GQ06 的[材料到实际改进试点](../../product/use-cases/steward/golden-queries.md#gq06-material-to-work-pilot--从材料到实际改进) 沿同一 M2/M3 边界验收普通文章请求。来源身份、对当前工作的适用性与结果是否已经 @@ -578,6 +578,60 @@ GQ06 的[材料到实际改进试点](../../product/use-cases/steward/golden-que 普通追问保留原负责人，简单查询直接处理；同一绑定只保留一个执行驱动。事件续接和延迟回传复用既有 request/outbox 与 continuous-monitor owner，不靠提高轮询频率补偿。通过有作用域的上下文复用约束，分别保存偏好、当前事实和动作授权；可选记忆 provider 不变成前置条件。GQ03 的 CI 例子要求查明因果和其他 review blocker，不是无条件 approve 政策。 +### 5.15 已采纳请求持续负责到要求兑现 + +产品承诺是委派一次后，在原对话收到可用结果。发送方继续负责整合与返回，接收方 +继续负责已接受的工作。本节细化第 5.5–5.6、5.11 节，不新增请求库、调度器或执行授权。 +[积压到兑现旅程](../../product/use-cases/steward/golden-queries.md#delegation-backlog-to-fulfilled-requests--从委派积压到兑现请求) +通过 GQ03/GQ07–GQ09 验收这些要求。 + +**判断必须接上执行。** 采用时说明接受的增量、保留要求，以及与已有工作或受支持的 +request-bound 执行的关系。适用时关联现有工作，不要求预建或隐藏创建 Todo。每轮提醒 +只有接到安全续接点上的接收方规划才有作用。复用既有 Inbox、Turn 准入和 Host 唤醒： +空闲且有权时只启动一次，忙碌时排队；不可用、暂停、停止、撤权、预算不足分别保留 +真实条件。已记录采用、注册或尝试唤醒，均不证明实际执行。 + +**修订保留每项义务。** 接收方或协调者可根据来源、目的、输出位置和接受版本，将 +多条请求关联到同一产物/工作。逐条保留原请求、增量和处置，不凭文本相似合并独立 +意图。受影响效果执行前核对后续纠正与否决路线。换接收者不撤回已送达误派：核验 +原始/纠正回执，通过原协作路径补齐仍欠的归属纠正，不重发已送达纠正。 + +**已接受工作不能从规划中消失。** 在现有安全规划边界，将收件、已采用未兑现和欠 +返回观察与当前可执行 frontier 一起考虑。在现有优先级、依赖、容量和预算规则内， +兼顾等待时间与在制工作，避免新请求不断挤掉已接受承诺。年龄不授予优先级，也不 +授权抢占、转租约或唤醒已停止工作。记录实质计划变化、实际续接或有依据的等待； +无变化时不强制编写进展、新建任务或唤醒模型。工作/结果/依赖事件与有界恢复复用 +现有调度、outbox owner。 + +**处置、兑现和送达分别观察。** 从现有请求修订、判断、工作/产物版本、验证和返回 +回执推导这些读模型关系，不新增一套可独立写入的生命周期状态。判断或回复可以 +完成沟通步骤，但已接受执行仍然欠交付。接收方逐项给出当前要求的结果/证据，或 +有界剩余事项、责任人和恢复条件。Todo done、hash、方案、PR 或名为 `conclusion` 的 +回复，单独都不能回答原完成问题。分析请求需完整答案，实现需约定验证，要求修好 +已安装产品时还需采用/读回。真正的暂缓、拒绝、取消与要求兑现保持区别。 + +发送方对照当前请求和纠正核对返回范围、整合依赖，将可用结果或剩余缺口送回， +不要求用户搬运或再问一次。复用已有合格检查；普通答复不新增强制人工确认或独立 +verifier。既有可选验收合同仍可选。新验证绑定实际输入/输出版本，不能从送达推断 +验收，也不倒造历史产物的检查。 + +**积压恢复保留事实。** 先核原始来源、受众、当前授权和请求 lifetime，再通过既有 +owner 对账已送达未判断、已采用未兑现、结果就绪未送达和证据冲突。复用已核产物 +与送达回执，不重跑已完成工作、不按年龄关闭、不批量唤醒全部接收者。旧请求对应 +Turn 当前指向另一委派时，给出精确冲突和 typed 恢复结果；不能去掉身份门、覆盖 +历史、推定取消或隐藏记录来凑齐覆盖。 + +**阅读界面给出可行动的覆盖。** 按责任 Agent 分组，显示当前阻点、下一动作及 +责任方，完整 brief、纠正、工作与原对话按需展开。区分请求数、关联工作数、筛选 +匹配数、已加载行数和不可读覆盖。桌面、窄屏和键盘下，长内容展开后分页/恢复入口 +仍可达。首页不冒充全量；不可用记录可定位，但不泄漏未经核验的私人内容。 +App、飞书、CLI 在各自授权内消费同一事实。 + +衡量委派到有效接收、接收到已验证结果的耗时、等待年龄、重复效果、错误收口、 +用户催问及完整 IO/模型/注意力成本，声明窗口、分母、来源/版本和未知覆盖。先测 +基线再定数值目标或节省结论。优先采用事件增量、请求范围内的新鲜读取和有界退避， +避免每次刷新扫描全历史或逐请求模型轮询；保留完整来源恢复、当前授权与既有输出预算。 + ## 6. 备选与 #4306 裁决 - **选择普通 runtime 工具 + LoopX 语义状态。** 保留 Agent 的灵活性，复用成熟工具；代价是要真实验收主机 profile 和私人/共享受众隔离。 @@ -650,6 +704,10 @@ M0 盘点真实字段和 producer；以下是迁移验收底线，不代表已 | A22 | 工具/进度事件、重连、SSE 重放与延迟的最终答复 | 当前阶段和宿主真实公开活动可见；按事件身份去重，保留完整最终答复，不重启 Turn；失败与没有可显示活动均如实呈现 | | A23 | 中断和纠偏活跃 Turn；旧按钮、重复入口、完成竞态及不支持的 adapter | 停止只影响指定 Turn 并回报实际结果。纠偏保留原 Turn 和 ingress 身份，过期/不可用目标须拒绝。后续 queue 投递必须已有允许的 fallback 或新的显式选择，并保留真实且有区别的回执；不得无声丢失、改投、重复启动模型或取消无关 worker | | A24 | 管家在已停止、仅注册、过期、模型不适配的干扰候选中，将产品请求路由到负责的活跃 Agent | 依据新鲜的职责、授权、运行时可达性、容量和 profile 适配选定接收者；其评估、工作和有证据的最终结论恰好一次回到原前端/飞书对话；只有候选发现或收件箱送达不能通过 | +| A25 | 空闲/忙碌接收者采用无预建 Todo 请求；保存与唤醒间崩溃、ACK 丢失、执行前撤权或停止 | 接受范围进入现有计划/request-bound 执行并原路返回；忙碌排队，重启恢复同一 operation 不重复调用/扣额。撤权、停止、未知 Host 和预算拒绝均不执行；只有送达/已读/采用/唤醒不能通过 | +| A26 | 多请求共享一项工作，同时存在后续纠正、独立同文请求、新请求和已送达误派 | 每项义务/修订可归属，已采用纠正影响实际工作；保留优先级/容量/停止规则，合格旧承诺持续推进。不按相似度合并、不自动改优先级、不推定取消；复用已送达纠正 | +| A27 | 关联 Todo 终结或部分方案被作为结论回传；真正结果到来时发送方/传输重启 | 完成取决于原始当前要求与合格结果版本；有界剩余保留责任人/续接，已提交结果不重放而返回。发送方整合、送达与兑现分开；不额外要求日常用户确认或倒造历史产物验收 | +| A28 | 超过 40 条跨接收者请求、长详情、分页/搜索、快照变化和历史请求/Turn 回执冲突；配对拒绝受众 | 数量区分总量/匹配/加载/未知，全部获准页与原文可达，恢复定位准确缺口。不混快照、不藏记录、不泄漏私人内容、不绕来源/回执门。验真实 File/SQLite 及其他受影响的受支持 provider、打包桌面/窄屏/键盘，飞书/CLI 宣传边界另验 | 先跑确定性转移/兼容测试，再真实安装 runtime 验证，再用无副作用合成任务和已授权私人 canary 做前端/飞书回环。记录源码/runtime 版本和回执。包含移动端飞书、打包前端渲染/读回；后端单测不等于 A10。provider 送达不确定、离线失败必须验，不只有成功路径。 @@ -754,8 +812,8 @@ skills，不再附带管家的 Goal 发现、草稿或 context delegation 指令 | --- | --- | --- | --- | | M0：统一方向 | manager capability owner 盘点限制、授权、session、待结交互；关闭过时 #4306 路线并关联保留修复 | 基线 fixture、公开裁决链接、不丢请求；不宣称 runtime 变化 | 仅文档/提案 | | M1：真正能干活的本机 Agent | manager capability + runtime adapter 使用普通工具/skill、持续授权；前端显示有效 profile/session、受支持的工具活动和可处理失败 | 真实 runtime A1–A3、A12；核验共享资源协调；复用 portfolio，不新建逐资源包装 | 回受限 profile，保留请求 | -| M2：语义续接 | Core collaboration 替换管家专用请求转移；复用 alignment 与所选工作 authority；支持先于 Todo/跨 Goal 请求和接收方规划；两种消费者验证同一契约 | 受支持边界上的 A4–A7、A11、A13–A20；A19 要求如实处理关闭/未验收状态，不强制 Obelisk 晋级；旧/新等价、崩溃对账、TS migration economics 审阅工件（§5.12） | 关新 producer，保兼容 reader、pending 结果；不切换 Goal authority | -| M3：一次完整交互 | 接收方结论、已有 outbox、前端/飞书可见、富文本与重启恢复 | A8–A10 与 A13–A14/A17/A20 回传验收；故障注入和真实读回；不用再追问便收到结论 | 保结果存储，换传输/profile 不重放 | +| M2：语义续接 | Core collaboration 替换管家专用请求转移；复用 alignment 与所选工作 authority；支持先于 Todo/跨 Goal 请求和接收方规划；两种消费者验证同一契约 | 受支持边界上的 A4–A7、A11、A13–A20 与 A25–A26；A19 要求如实处理关闭/未验收状态，不强制 Obelisk 晋级；旧/新等价、崩溃对账、TS migration economics 审阅工件（§5.12） | 关新 producer，保兼容 reader、pending 结果；不切换 Goal authority | +| M3：一次完整交互 | 接收方结论、已有 outbox、前端/飞书可见、富文本与重启恢复 | A8–A10 与 A13–A14/A17/A20/A27–A28 回传/兑现验收；故障注入和真实读回；不用再追问便收到结论 | 保结果存储，换传输/profile 不重放 | | M4：晋级并退役旧路径 | 三个异构活跃 Goal、主人/共享受众、配置 SSH 旅程通过；删旧限制和过渡兼容层 | 全验收、权限回归、实测 SLO/成本；列出未验证宿主 | 按 scope 回滚、schema-aware drain/export | M1 不必等通用 handoff 重构。M3 独立的格式/投递修复可先用已有 inbox 上线。M2 的通用晋级需要第二消费者，但不能因此拖住已经有用的管家局部改善。各里程碑不新增常规研究或普通委托的人工确认。 @@ -789,6 +847,14 @@ M1 不必等通用 handoff 重构。M3 独立的格式/投递修复可先用已 里程碑内明确跨 session 顺序：先在历史检索关闭时验收同 Agent 替换，再经既有 transfer adapter 验跨 Agent 续接，最后按独立 rollout 验收可选缺口召回。每个切片都包含受影响的 CLI/managed Turn、打包前端、飞书读回/反馈，不推迟到后续 backend-only 版本。衡量首次有效续接动作耗时、重要义务保留、避免的重复失败、重复效果和上下文成本。恢复更多 token 或 `resume` 返回成功，本身不是改进。 +第 5.15 节由产品/管家工程负责人将三个可独立评审的完整切片接入 M2/M3： +（1）与现有 Host/Core owner 一起完成原请求→安全唤醒/排队→实际工作→原路返回； +（2）纠正、承诺保留、兑现检查与前端阅读界面；（3）用已核旧效果有界恢复存量积压。 +每片携带 A25–A28 证据并保留未验收项。复用已有唤醒、每轮 agenda 与展示任务， +协调原负责人，不另建账本或接管他人租约。文档、单测、作者 PR 或单个合成传输 +不证明安装采用。回滚停止新 producer/激活，保留兼容 reader、原效果与待返回结果， +不重新解释新版本 journal。 + ## 12. 待定决策 1. **可信主机默认 profile：** 维护者负责晋级。推荐复用主人 runtime 的实际 profile，绑定资源/受众，不发明管家 ACL 语言。M1 前核验读/写/网络/approval 行为与旧授权迁移。 diff --git a/docs/product/use-cases/steward/golden-queries.md b/docs/product/use-cases/steward/golden-queries.md index 8776db9f87..e0c06c7bb2 100644 --- a/docs/product/use-cases/steward/golden-queries.md +++ b/docs/product/use-cases/steward/golden-queries.md @@ -109,6 +109,48 @@ new work is needed. Shared CLI/MCP regression tests qualify these seams only; release-only live evaluation must still prove receiver adoption and the original App/channel result without human reminders or manual relay. +### Delegation backlog to fulfilled requests / 从委派积压到兑现请求 + +“这些已经交办的事，落实后把结果带回来。” / “Finish the requests I delegated +and bring the results back.” This is a GQ03/GQ07–GQ09 journey under +[handoff RFC §5.15](../../../architecture/rfcs/capable-manager-semantic-handoff-v0.md#515-accepted-requests-remain-accountable-through-fulfillment), +with A25–A28 acceptance. It does not authorize bulk execution, cancellation, +priority changes or creation of another task authority. + +Freeze a disposable source with more than 40 requests, several qualified +receivers, mixed dispositions and long original content. Include two requests +linked to one work item, an adopted later correction, an independent same-text +request, an old eligible commitment amid new arrivals, a completed Todo without +a usable result, an already-verified artifact awaiting return, and a historical +Turn whose current handoff receipt conflicts with an older request. Preserve +source/revision, current grants, output budgets and declared capacity limits. + +Observe the original entry → actual receiver assessment/planning → authorized +work → checked result → original-conversation return. Check idle/busy behavior, +persistence-before-wake crash, lost ACK, revoked grant, stopped/unknown Host, +sender restart and uncertain delivery. These failures must not create duplicate +effects, hidden Todos or false fulfillment. A short response needs no invented +work item. An implementation plan or delivered conclusion cannot pass a request +for an actual repair; a genuine remainder keeps its owner and continuation. +The sender checks all current requirements and integrates results without a +user reminder, manual relay or an extra routine acknowledgement. + +The reader must distinguish request/work counts, matches, loaded pages and +unreadable coverage. Reach every authorized page and full detail through the +packaged desktop/narrow/keyboard journey, including refresh/search and changing +snapshots. Locate evidence conflicts and read back their supported typed +recovery; never repair a counter by deleting history or weakening identity and +audience checks. Repeat denied-source/privacy cases; qualify Lark/CLI separately +where advertised. Record source/build/installed boundaries and waiting age, +false closeouts, duplicate effects, reminders and complete IO/model/attention +cost. This defines qualification, not a claim that the backlog has been cleared. + +中文验收：多条补充逐项保留并影响实际工作；已采用请求持续进入原负责人的规划； +已完成产物优先补返回，不重跑；阶段回复与要求兑现分开；长列表、原文和冲突恢复 +均可达。保留暂停/停止、撤权、预算、租约及受众边界，不批量关闭或唤醒旧工作。 +用真实后端和打包界面读回，区分确定性测试、安装采用和实际模型表现；不能只凭 +任务 done、回执、截图或列表变短判定成功。 + ### Direct group conversation / 群里直接说话 For the Lark variant of P0 reliable entry, configure the steward connection to