feat(coordination): default new Goals to canonical SQLite

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>

Author: loopx-agent

apps/presentation/dashboard/smoke/capability-configuration-smoke.ts

@@ -1,6 +1,6 @@
 import assert from "node:assert/strict";
 
-import { parseEditableCapabilityJson, projectEditableCapabilityConfiguration } from "../src/data/capability-configuration.js";
+import { goalStorageEditorValue, parseEditableCapabilityJson, projectEditableCapabilityConfiguration } from "../src/data/capability-configuration.js";
 
 const periodicReportEditor = {
   fields: [
@@ -12,6 +12,19 @@ const periodicReportEditor = {
   ],
 };
 
+const storageEditor = { fields: [{ key: "new_goal_provider" }, { key: "canonical_creation" }, { key: "new_goal_handoff_mode" }] };
+const storageDefault = { schema_version: "loopx_goal_storage_defaults_v1", new_goal_provider: "sqlite",
+  canonical_creation: true, new_goal_handoff_mode: "hard_lease" };
+assert.deepEqual(projectEditableCapabilityConfiguration(storageEditor,
+  goalStorageEditorValue({ schema_version: "loopx_goal_storage_defaults_v0", new_goal_provider: "file" }), storageDefault),
+  { new_goal_provider: "file", canonical_creation: false, new_goal_handoff_mode: "hard_lease" },
+  "opening a historical selector must not enable canonical creation through today's defaults");
+assert.deepEqual(projectEditableCapabilityConfiguration(storageEditor, goalStorageEditorValue(storageDefault), storageDefault),
+  { new_goal_provider: "sqlite", canonical_creation: true, new_goal_handoff_mode: "hard_lease" },
+  "an unconfigured device editor shows the shared new-Goal default");
+assert.equal((goalStorageEditorValue({ ...storageDefault, canonical_creation: false }) as typeof storageDefault).canonical_creation, false,
+  "an explicit v1 opt-out survives editor mode changes");
+
 assert.deepEqual(
   projectEditableCapabilityConfiguration(periodicReportEditor, {
     schema_version: "periodic_report_machine_defaults_v0",

apps/presentation/dashboard/src/data/capability-configuration.ts

@@ -60,3 +60,11 @@ export function replanCadenceEditorValue(value: unknown): unknown {
   }
   return value;
 }
+
+/** A v0 storage selector did not enable creation; opening Settings must not. */
+export function goalStorageEditorValue(value: unknown): unknown {
+  const record = configurationObject(value);
+  return record.schema_version === "loopx_goal_storage_defaults_v0"
+    ? { ...record, canonical_creation: false }
+    : value;
+}

apps/presentation/dashboard/src/features/personal-workspace/capability-localization.ts

@@ -12,7 +12,7 @@ type FieldCopy = Record<string, Readonly<{ description?: string; label: string;
 
 const capabilityCopy: Record<WorkspaceLocale, Record<string, LocalizedCopy>> = {
   en: {
-    goal_storage: { displayName: "New Goal authority", description: "Opt in to canonical creation and choose the storage and execution policy for future Goals. Existing Goals require a separate backed-up migration." },
+    goal_storage: { displayName: "New Goal authority", description: "New Goals default to canonical SQLite with hard leases. Choose storage and execution policy for future Goals. Existing Goals require a separate backed-up migration." },
     manager_runtime: {
       displayName: "Runtime",
       description: "Selects the persistent host-tool profile used by owner manager conversations.",
@@ -78,7 +78,7 @@ const capabilityCopy: Record<WorkspaceLocale, Record<string, LocalizedCopy>> = {
     },
   },
   "zh-CN": {
-    goal_storage: { displayName: "新 Goal 的权威存储", description: "可启用 canonical 创建，选择之后新 Goal 的存储与执行策略。已有 Goal 仍需单独备份、迁移。" },
+    goal_storage: { displayName: "新 Goal 的权威存储", description: "新 Goal 默认使用 canonical SQLite 与 hard lease；可选择之后新 Goal 的存储与执行策略。已有 Goal 仍需单独备份、迁移。" },
     manager_runtime: {
       displayName: "运行环境",
       description: "选择管家会话持续生效的宿主工具模式。",

apps/presentation/dashboard/src/features/personal-workspace/machine-configuration-settings.tsx

@@ -17,7 +17,7 @@ import {
   type MachineConfigurationRollbackPlan,
   type MachineConfigurationTransaction,
 } from "../../data/chat";
-import { projectEditableCapabilityConfiguration, replanCadenceEditorValue } from "../../data/capability-configuration";
+import { goalStorageEditorValue, projectEditableCapabilityConfiguration, replanCadenceEditorValue } from "../../data/capability-configuration";
 import { CapabilityConfigurationFields } from "./capability-configuration-fields";
 import { withReportScheduleTimezone } from "./periodic-report-schedule-field";
 import { localizeCapability, localizedCapabilityFieldCopy } from "./capability-localization";
@@ -195,7 +195,8 @@ export function MachineConfigurationSettings({ section, onChanged }: { section:
     const current = currentConfiguration(inspection, selected);
     const editable = projectEditableCapabilityConfiguration(
       selected.configuration_editor,
-      selected.capability_id === "todo_replan_cadence" ? replanCadenceEditorValue(current ?? selected.default) : current ?? selected.default,
+      selected.capability_id === "todo_replan_cadence" ? replanCadenceEditorValue(current ?? selected.default)
+        : selected.capability_id === "goal_storage" ? goalStorageEditorValue(current ?? selected.default) : current ?? selected.default,
       selected.default,
     );
     const complete = completeMachineConfiguration(selected, current, editable);
@@ -227,7 +228,8 @@ export function MachineConfigurationSettings({ section, onChanged }: { section:
     } else if (parsedJsonDraft) {
       setDraft(projectEditableCapabilityConfiguration(
         selected.configuration_editor,
-        selected.capability_id === "todo_replan_cadence" ? replanCadenceEditorValue(parsedJsonDraft) : parsedJsonDraft,
+        selected.capability_id === "todo_replan_cadence" ? replanCadenceEditorValue(parsedJsonDraft)
+          : selected.capability_id === "goal_storage" ? goalStorageEditorValue(parsedJsonDraft) : parsedJsonDraft,
         selected.default,
       ));
     } else {

docs/architecture/rfcs/shared-goal-authority-state-provider-v0.md

@@ -3321,6 +3321,18 @@ new implementation work; changing languages or moving a helper is not an exit.
 | C / L8: Whole-Goal rehearsal and cohort migration | Integrate one exact revision/profile after L2–L7; drain capture, fence old writers, verify canonical readback and projection, then rehearse fenced export/rollback. | D3 evidence packet binds lineage, cursor, source digest, command coverage and profile. Existing Goal migration requires explicit cohort approval; no per-command split authority or stale Markdown revival. |
 | D / L9: New-Goal default and bounded retirement | A dedicated default-change PR makes new-Goal creation/onboarding choose the qualified local profile, including settings/readback, installer and packaged clients. Retire old business writers only as their final callers and migration window close. | L8's integrated product/rollback qualification; distinguish new Goal default from existing Goal migration. Publish compatibility/disable guidance, keep explicit provider choice, permanent rendering and validated import/export. T4 can continue after the default ships. |
 
+**L9 creation-default candidate.** Unconfigured new-Goal CLI/App creation now
+uses the same registered SQLite/hard-lease configuration and existing TS
+initialization owner. Explicit v0 selectors and v1 creation-off remain supported;
+the guided editor preserves v0 opt-out when upgrading its envelope. Existing
+Goals, frozen operations, provider receipts and migration fences retain their
+own route. Namespace removal restores the new default, so disable guidance
+uses an explicit creation-off setting. Candidate implementation and packaged
+interaction evidence remain distinct from L8/D3 integrated recovery, D2
+sustained/platform qualification and release-default activation; none of those
+gates is replaced by this checkpoint. No old writer or historical backup reader
+is retired by this change.
+
 **Earlier 2026-09-24 implementation context.** Display refresh advances
 projection recovery/client closure without claiming every consumer qualified. SQLite #4910 added the larger measurement axes; #4224 records
 failed 1 MiB receipt/scan budgets and still-missing recovery/soak evidence.

docs/reference/images/new-goal-authority/sqlite-default.png

@@ -44,7 +44,7 @@ authenticated service or grant an Agent database access.
 
 The default profile is a routing decision, not a migration. Existing Markdown
 state, writer fences, qualification gates, and explicit File/SQLite promotion
-holds remain unchanged. SQLite stays an opt-in qualified candidate until the
+holds remain unchanged. The released SQLite profile remains opt-in until the
 shared-authority RFC's D2 evidence and owner approval are complete. PostgreSQL
 remains an independent service-provider qualification path.
 
@@ -62,15 +62,23 @@ See [reviewed promotion and recovery](reviewed-coordination-promotion.md) for th
 ## New Goal authority (machine setting)
 
 **Settings → Capability Center → Device defaults → New Goal authority** selects
-File or SQLite independently of the execution policy. Enable **Create canonical
-authority** to initialize future empty Goals directly with `soft_claim` or
-`hard_lease`. Agents inherit the Goal policy; this grants no tool, repository,
+File or SQLite independently of the execution policy. In the new-Goal default
+candidate, a device without a `goal_storage` namespace creates canonical SQLite
+with `hard_lease`; CLI bootstrap and App creation reuse the same configuration
+and typed initialization owner. **Create canonical authority** can be disabled
+explicitly, or used with File and either `soft_claim` or `hard_lease`. Agents
+inherit the Goal policy; this grants no tool, repository,
 scheduler, account or network permission and does not migrate existing data.
 
-Canonical creation is default-off. An absent namespace, the released v0 shape,
-or v1 with `canonical_creation=false` retains the post-promotion target behavior.
+The candidate changes only unconfigured new creation. Released v0 settings and
+v1 with `canonical_creation=false` retain the post-promotion target behavior.
 Opening v0 in the guided editor previews a v1 envelope upgrade with creation
-still disabled. The CLI continues to accept v0.
+still disabled; switching editor modes cannot enable it through the new default.
+The CLI continues to accept v0. Existing Goals keep their recorded target,
+including its absence, even when device settings change. Invalid configuration
+fails before registry publication rather than being treated as an absent setting.
+Registry-relative runtime paths are compared by their resolved filesystem
+location, so an equivalent spelling cannot masquerade as an authority move.
 
 Save this namespace document as `goal-storage.json`:
 
@@ -116,36 +124,33 @@ cannot adopt it. The original receipt survives later native writes, so replay
 cannot erase Todos or repeat their creation. An unavailable selected provider
 fails visibly without Markdown fallback. Lost completed authority requires full
 backup recovery and cannot be treated as empty creation. Generic forced
-bootstrap cannot rebuild an opted-in Goal.
+bootstrap cannot rebuild a canonically created Goal.
 
 <details>
 <summary>Settings and recovery views / 设置与恢复界面</summary>
 
-Synthetic workspace data; the settings use a real isolated backend. The first
-view is the released v0 editor; the remaining views show the proposed v1 path.
+Synthetic workspace data on the candidate's packaged App and installed wheel;
+model execution is disabled in this isolated creation/configuration rehearsal.
 
-Before: the provider setting only chooses the post-promotion target.
+Released v0 preferences remain target-only when opened in the candidate editor.
 
-![Released target-only editor](images/new-goal-authority/before.png)
+![Existing File preference stays disabled](images/new-goal-authority/v0-retained.png)
 
-After: provider, explicit canonical opt-in and execution policy, with applied
-configuration readback.
+Removing that preference restores canonical SQLite/hard-lease defaults, with
+native removal readback. It does not migrate the existing Goals.
 
-![Canonical creation settings and readback](images/new-goal-authority/after.png)
+![Candidate SQLite defaults after preference removal](images/new-goal-authority/sqlite-default.png)
 
-An unsupported `legacy` policy is rejected before apply; the previous valid
-configuration remains. Correcting the policy allows preview and apply again.
-
-![Invalid policy rejected](images/new-goal-authority/invalid-policy.png)
-
-The same device settings at a narrow viewport:
-
-![Narrow device settings](images/new-goal-authority/mobile.png)
+The existing preview/apply revision gate is unchanged. Unsupported `legacy`
+policy is rejected before apply; correct the policy and preview again. No new
+layout or responsive navigation is introduced.
 
 </details>
 
 To disable future canonical creation, preview and apply the same v1 document
-with `canonical_creation=false`. To remove the whole preference:
+with `canonical_creation=false`. Removing the preference restores the candidate
+SQLite/hard-lease default for future new Goals; removal is **not** opt-out.
+To remove the whole preference:
 
 ```sh
 loopx machine-config remove --namespace goal_storage
@@ -162,15 +167,18 @@ already-canonical Goals use the [reviewed File/SQLite cutover](file-authority-st
 Retain verified backups, stop writers, settle leases and preserve newer writes
 on reverse migration. Supported historical backup/format/receipt readers remain.
 
-This opt-in path does not close full existing-Goal upgrade, D2 sustained
-qualification or the release-default decision. Trial admission and release
+This implementation candidate does not close full existing-Goal upgrade, D2
+sustained qualification or authorize release-default activation. Trial admission and release
 default admission remain separate; the existing RFC acceptance is unchanged.
 
 ### 新 Goal 的权威存储
 
 在“设置 → 能力中心 → 此设备默认 → 新 Goal 的权威存储”中，分别选择 File/SQLite
-和 `soft_claim`/`hard_lease`，并显式启用 canonical 创建。默认关闭；旧 v0 或关闭
-状态仍只固定晋升后的目标。表单以关闭状态预览 v1 升级，CLI 继续接受旧格式。
+和 `soft_claim`/`hard_lease`。候选实现让未配置此命名空间的新 Goal 默认建立
+canonical SQLite、使用 `hard_lease`，CLI 与 App 共用配置和类型化创建归属。
+旧 v0 或显式关闭状态仍只固定晋升后的目标；表单以关闭状态预览 v1 升级，
+切换编辑模式也不会自动启用。CLI 继续接受旧格式，已有 Goal 保留原路径。
+Registry 中的相对 runtime 路径按实际文件位置比较；等价路径不会误触发权威迁移检查。
 Agent 继承 Goal 策略；此设置不授予工具、仓库、账户或网络权限。
 
 CLI 使用上面的完整 JSON 和 preview/apply/inspect/bootstrap 命令；App 用现有
@@ -184,10 +192,11 @@ CLI 使用上面的完整 JSON 和 preview/apply/inspect/bootstrap 命令；App
 后的存储丢失须恢复完整备份，不能重新创建空库；通用 force 不能重建。原回执在
 后续写入后仍可读回，重试不得丢失或重复 Todo。
 
-关闭或按上面的 remove 预览/执行命令删除偏好，只影响之后新建；不会迁回已有数据、
+显式设置 `canonical_creation=false` 才关闭之后的新建；remove 删除偏好会恢复候选
+SQLite/hard-lease 默认，不能用于关闭。两者均不会迁回已有数据、
 删除 fence 或重新开放旧 writer。既有 Goal 升级仍需备份、停止写入、结算租约和
 审核计划；反向迁移须保留新增写入。受支持的旧备份、格式和原回执恢复能力保留。
-此路径不代表完整升级、D2 长期资格或发布默认已通过。
+配置损坏明确失败，不视为未配置；候选实现不代表完整升级、D2 长期资格或发布默认已通过。
 
 Prose-only source maintenance compares the exact canonical JSON bytes of the
 existing stable partition view. Only the resume evaluation clock is excluded;

docs/reference/images/new-goal-authority/v0-retained.png

@@ -113,6 +113,14 @@ Before changing release defaults, the existing owners must close these gaps:
    including installed runtime admission, settings/readback and packaged entry
    points. Keep explicit provider selection and reviewed backup/rollback.
 
+The L9 implementation candidate now resolves an absent `goal_storage` namespace
+to canonical SQLite/hard-lease creation through the existing configuration and
+TS initialization owners. Explicit v0 selectors, v1 opt-out and existing Goals
+keep their recorded route. Settings preserves v0 opt-out during guided/JSON
+conversion; removing a setting restores the new default. See [new-Goal creation
+and compatibility](local-authority-provider-selection.md#new-goal-authority-machine-setting).
+This candidate does not certify the gates above or activate an installed release.
+
 Both current local providers require Node >=22.22.3. SQLite uses built-in
 `node:sqlite`: it adds no database service or external SQLite package. Its
 actual embedded SQLite/finalization probe remains required, and a pre-existing

docs/reference/local-authority-provider-selection.md

@@ -350,7 +350,7 @@ def bootstrap_project(
     if not state_file.is_absolute():
         state_file = project / state_file
     goal_doc = resolve_project_path(project, goal_doc)
-    runtime_root = resolve_runtime_root(read_json_if_exists(registry_path), str(runtime_root) if runtime_root else None, registry_path=registry_path)
+    runtime_root = resolve_runtime_root(read_json_if_exists(registry_path), str(runtime_root) if runtime_root else None, registry_path=registry_path).resolve()
     updated_at = now_iso()
     execution_profile = build_execution_profile(
         minimum_scale=execution_minimum_scale,
@@ -568,7 +568,7 @@ def bootstrap_project(
             # A first explicit bootstrap has no previous Goal authority to fence.
             # Existing Goals still resolve and authorize their original route.
             if current_registry.get("goals"):
-                previous_root = resolve_runtime_root(current_registry, None, registry_path=registry_path)
+                previous_root = resolve_runtime_root(current_registry, None, registry_path=registry_path).resolve()
                 if previous_root != runtime_root:
                     for previous_goal in current_registry["goals"]:
                         if isinstance(previous_goal, dict) and previous_goal.get("id"):