Repository navigation
refactor(public-safety): compile the label and identity shapes once - #7677
Conversation
…s once Five contracts compiled the 120-character-minus-one label body under their own names and three compiled the identity-token body, so a bound change had eight places to land. Move both grammars to the shared identifier owner, keep each consumer's own name, field text and bound, and extend the shape census so a new local restatement fails. Signed-off-by: lll-hhh <169072815+lll-hhh@users.noreply.github.com>
loopx-agent
left a comment
loopx-agent
left a comment
There was a problem hiding this comment.
Reviewer: actor_kind=model_agent; model=gpt-6.1-sol; provider=OpenAI; reasoning_effort=max; declaration_source=runtime_reported.
动机 / Motivation
APPROVE：未发现阻断问题。
维护服务、Issue-Fix、诊断和历史导出的开发者，需要在多个入口遵守一致的标识符语法。
过去同一类形状在八处重复声明，修改边界容易遗漏；现在调用方复用两个已有公共语法定义，同时保留原来的不同长度上限。
已验证 label 最长 120 字符、identity 最长 121 字符；真实 CLI 的接受、拒绝、完整输出和诊断 ledger 字节保持一致。
本次不统一两类长度、不改变隐私策略或执行权限，也不声称完成跨运行时迁移或部署采用。
TypeScript 的独立形状与真实部署资格仍属于原有后续边界；本次 Python 共享定义已经可独立使用和回退。
改动思路 / Approach
把语法放回现有公共 owner，而将发布策略和错误保留在消费者，避免把形状合法误当成可公开或可执行。
当前 PR 完成八个 Python 调用方的定义复用和回归防护；不增加新配置、迁移或跨语言同步机制。
这次降低的是维护时修改多份定义的风险。Python 的正则缓存本来就可能复用编译对象，因此我没有把它算成已证明的运行时加速。保留两个形状是必要的：尾部允许 119 与 120 个字符，连同首字符，分别构成 120 与 121 的总长度。合并两者会真实改变输入集合。
具体改动 / Changes
评审完整 head：96d87b1b2b365a1050a1740dce1dd5b0a6a068b9；不可变基线：ed0972c3190ad9f0e864284bdb1d95bdefefb4a6。规范依据 loopx/public_safe_text.py @ ed0972c3190ad9f0e864284bdb1d95bdefefb4a6 的 Shared identifier shapes 与 syntax only 两条约束均为 implemented：共享语法，消费者保留自己的字段、错误和额外策略。诊断 README 原有的 identity 规则没有被改写。
关键代码讲解
- COMPACT_LABEL_PATTERN / IDENTITY_TOKEN_PATTERN 成为两个语法定义的共同位置；八个消费者各自的旧名称保留为导入别名。独立比较确认八处 pattern 和 flags 一致，所有原函数、类的 AST 均未改变。
- load_context_provider_service_ownership 仍验证 receipt 字段、provider 和 PID 存活；共享 label 不接管服务所有权判断。
- compact_loopx_command_records 仍先做自身 sanitization、subcommand allowlist 和 identity 检查。历史导出的凭据形状过滤也保留在原调用方。
现有 census 测试新增两种形状和 owner-object 检查，长度用例防止误接到相邻上限。它保护实际调用方，边界没有扩成新的配置系统；跨 TypeScript 的同步机制可留在既有迁移范围。
对主干的风险 / Risks
最强反例是新共享定义被意外放宽，所有新调用方彼此一致却共同违反旧契约。我用不可变基线和 head 运行真实 issue-fix workflow-plan 与 reliability-diagnostics ingest：共 8 个案例，完整输出、退出状态和物理 ledger 字节一致。将 label 放宽到 121、将 identity 收窄到 120 的两个 mutation 都让相同公开入口的独立 oracle 失败。
PASS：199 项 Python 测试；三个现有 Issue-Fix smoke 在仓库原生隔离 fixture 下，基线和 head 各 3 项全过。另有一次未隔离的辅助 smoke 设置失败，基线/head 完整诊断相同；该次失败未记为通过。原生 Windows PID 用例在 macOS 跳过，不能据此声明 Windows 原生资格。
标准 native premerge 全通过，精确范围 CQR 有效；Ruff 和仓库配置的 17-file mypy 均通过。 没有查询、轮询或等待远端 CI。现有调用方策略、诊断格式和 persisted schema 不变；此处不需要新前端操作流程。
我的整体评价 / Verdict
这是有明确使用者的 justified_increment：长程执行语义 preserved，用户可观察语义 preserved；当前维护收益是集中修改和防止后续漂移，未测量任务层效率收益。相邻 refactor 已在这次别名替换中完成，不再增加包装层或要求无关迁移。语义分类为 reuse_existing，没有新增状态词汇或 authority。
本次只改变 Python 形状定义及测试；没有更改页面、布局或交互渲染。
未验证原生 Windows、真实 DSH/记忆服务部署或安装采用；这些边界未由本 PR 改动。
English verdict: APPROVE
Goal And Delivered Outcome
Outcome basis / optional anchor: self-contained maintenance outcome (no issue anchor; the repository's own shared-shape rule states the gap).
Goal/source and gap:
loopx/public_safe_text.pysays "Shared identifier shapes stay here with the sibling public-safe text shapes", andtests/control_plane/test_compact_identifier_shape_owner.pyalready censuses three of those shapes. Two more were still restated per module: the 119-minus-one label body was compiled under five different names (the service-ownership projection, the Issue-Fix repository context, the Issue-Fix repository memory, the memory provider that publishes them, and the reviewer-recommendation route) and the identity-token body under three (goal_id/session_idin the reliability-diagnostics envelope, the command-record goal id, and the OpenViking history export). Nothing stopped a ninth copy, and a bound change had eight places to land.Observable before → after, with the validation row that proves it: before, the two bodies appeared in eight modules and the census did not know either shape; after, each body appears exactly once, in the owner, and the two new census tests assert the found set equals
{loopx/public_safe_text.py: 1}— a new local restatement, or a declared site that has already been converted, fails. No consumer's accepted value set moves: each keeps its own name and its own bound, and theregression_parityrow below compares head and base failure sets over every test file that touches the changed modules.Issue/task and intended base: intended base
mainated0972c31.Author Declaration
Implemented against
loopx/public_safe_text.py(module docstring plus the "Shared identifier shapes stay here" block) atmained0972c31; the census contract intests/control_plane/test_compact_identifier_shape_owner.py; the identity-token shape documented forgoal_id/session_idinloopx/capabilities/reliability_diagnostics/README.mdandREADME.zh-CN.md.COMPACT_LABEL_PATTERN,IDENTITY_TOKEN_PATTERNinloopx/public_safe_text.pypython -m pytest tests/control_plane/test_compact_identifier_shape_owner.py_LABEL,_SOURCE_ID_PATTERN,_LABEL_PATTERN,REVIEWER_SOURCE_ID_PATTERN,IDENTITY_TOKEN_PATTERN,LOOPX_COMMAND_RECORD_GOAL_ID_PATTERN,_PUBLIC_GOAL_ID_RE)test_labels_and_identities_import_the_owners_objectOPEN_LABEL_SITES/OPEN_IDENTITY_SITESin the guard testtest_the_label_body_is_compiled_only_by_the_owner_and_declared_sites,test_the_identity_body_is_compiled_only_by_the_owner_and_declared_sitestest_the_label_and_identity_bounds_stay_one_character_apartruff checkon every changed file, and four source mutations re-run against the guard (re-adding a local copy of either body, widening the label bound to the identity bound, and pointing a consumer at the 127-character sibling shape); all four were killed and the tree was restored afterwards. Assumed, not verified — that the two READMEs describing the identity shape stay accurate; this change moves where the body is compiled, not what it accepts, so their tables still state the same grammar. Deliberately left out —loopx/control_plane/collaboration/result_publication.tsstates the same 119 body in the other runtime; a Python census cannot guard it and pairing the two runtimes needs its own accepted basis rather than an unrequested twin entry.Scope And Continuation
Validation
96d87b1b2(baseed0972c31)unitpassedpython -m pytest tests/control_plane/test_compact_identifier_shape_owner.py— 23 passed (19 before this change): two new censuses, one owner-object identity test, one bound-discrimination test.integrationpassedpython -m pytestover the direct consumer suites — service-ownership, the reliability-diagnostics envelope/ledger/readback, presentation public-safety and the extension runtime: 286 passed, 1 skipped.regression_paritypassedstaticpassedruff checkon every changed Python file, clean. No TypeScript changed, so the TS typecheck row isnot_applicable.manualpassedFrontend / Visual Evidence
Type of Change
LoopX Area
The owner module itself is the shared
loopx/public_safe_text.py; six of the eight converted sites live underloopx/capabilities/, one underloopx/control_plane/runtime/and one underloopx/extensions/.Shared-authority RFC fixture impact
Boundary Checklist
.loopx/,.codex/goals/, and liveACTIVE_GOAL_STATE.md).python3 scripts/check_rfc_bilingual.py --base origin/main --head HEADpasses, or no paired RFC changed.none.Signed-off-bytrailer (git commit -s).