feat(benchmark): checkpoint research participants and continue native sessions

[loopx-agent]

Problem and resulting behavior

Comparing research policies from the same intermediate point requires the retained conversation, candidate files, research evidence, and evaluation opportunities. Restarting from code alone loses that basis. This proposal adds opt-in checkpoint participants and native continuation, plus the actual heartbeat worker handoff needed to capture a fresh replan before its decision is released.

The default remains off. With an explicit fresh-replan request, the worker holds the original guard, deduplicates its obligation, interrupts the owned native process, and resumes the source with that original packet and the remaining wake budget. Ordinary and duplicate guards do not restart the source. An optional capture failure also resumes the source; lost session identity or changed packet bytes fail closed.

For a fresh node projected at wake start, the Host captures before model invocation from the prior successful, settled work wake. The current guard may legitimately still owe explicit work selection. The typed selector accepts that committed semantic node only for the matching Goal, registered Agent, original Turn, guard event and obligation; it does not fabricate a settlement identity or permit delivery before selection. Already-bound guards keep their causal settlement checks. This covers continuing executable work as well as the previously tested monitor-only path.

Native capture supports two distinct cursors. Completed-point capture retains its completed final Turn requirement. The worker's interrupted mode binds the final unreleased command to the exact CLI routes, Goal/Agent/Turn, private endpoint and sealed original decision. It retains all history pages and native stores, rejects later visible work and ambiguous repeated guards, and reconstructs the same prefix—including the aborted tool—in a distinct native fork. Lost fork replies reuse one-attempt recovery. A fork alone grants no execution authority.

Full fresh-replan capture is explicitly enabled with the host-private controller file and the worker declaration. The worker prepares its native cursor, original decision, canonical Todo/Explore/vision evidence, code and byte witness; the host supervisor binds the actual container and native registration, pauses all container writers, and compares the frozen sources against that preparation before capturing native incumbent, opportunity counts, cooldown and Host phase budget. An expired, removed or changed handoff rejects before evaluator capture. The source resumes its original packet after barrier release. Controller credentials never enter the solver.

The controller reuses Docker pause/archive, committed SQLite/WAL transport and the TypeScript artifact owner. Safe archive extraction preserves ordinary directory permissions while stripping special bits; otherwise private authority directories falsely appear changed. Completed-point participants and fresh-authority context adoption remain available without replaying source claims or leases.

Continuation qualification and remaining acceptance

The joint capture-to-isolated-receiver mechanical path now passes. A fresh Linux guest binds the captured interrupted conversation through the existing current Goal/session owner, adopts the canonical research note under its own Todo lease, restores the same native evaluator/Host capsule, and obtains a fresh work guard. A resumed native tool consumes retained context and code, produces a synthetic candidate, receives its next native grade under the remaining Host deadline, then settles the destination Turn exactly once. Historical source guards, leases and effects are not replayed.

Committed binding reply loss recovers the same fork; activation readback preserves its original token/deadline. Wrong source/digest and advanced-history admission reject. The source authority is not mounted in the receiver. This closes the tested mechanical continuation gap, while installed campaign/profile admission, packaged recovery interaction and research-policy benefits remain separate and open. No benchmark runs are launched by this PR.

The completed-cursor path is now qualified separately through the actual worker, original pending-selection guard, native Host, SQLite context and Docker barrier. The full point is sealed before the next model call. A new isolated receiver binds that completed history, adopts retained context under its fresh lease, advances a synthetic candidate and settles once. Its unexpired captured cooldown returns native 429 without consuming another round or invoking a grader. The eligible interrupted-point fixture separately receives its next grade; continuation does not imply immediate submission eligibility. These fixtures use synthetic trigger observations and computation, not campaign evidence.

Ownership stays with benchmark-toolkit, its Codex/native-evaluator providers, and the existing TypeScript artifact and replan-selector contracts. See the hierarchical stride RFC, §7.7. The native evaluator provider is proposed separately in EdgeBench #23; local validation pins that provider revision rather than implying it is merged.

Validation

• Fresh isolated joint receiver: positive and lost-binding-reply journeys pass, including native HTTP grade, actual Host phase shell and exactly-once CLI settlement.
• Real Linux Codex 0.160.0 and the actual worker/renderer/guard: file/native capture, unsupported full-state rejection and feature-off parity pass. A separately attached real Docker/native-HTTP controller captures the canonical File/SQLite research state and original native cursor, preserves used rounds/cooldown/incumbent/phase, and lets the original source continue. Inference and grading are synthetic.
• Controller/Docker and mailbox regressions: 27 passed, covering changed/expired preparation, private directory permissions, WAL, pause cleanup, stale replies and surviving requests.
• SForge/shared runtime/native feedback regressions: 329 passed with the pinned provider and Harbor dependencies; the final SForge entry suite including new opt-in/binding cases passed 200 tests. Earlier canonical research qualification passed 44 tests with 11 environment-dependent skips; the current repair rerun is listed below.
• Existing isolated native reconstruction excludes later source files and preserves the source home. It grants no LoopX Goal authority. Completed-cursor tests retain four resumed-tool sandbox failures in the Linux qualification environment; they are not claimed as passes.
• Ruff and diff checks pass. The semantic advisory does not scan benchmark adapters; the provider-local handoff fields were reviewed manually, and existing TypeScript owners retain artifact integrity and replan decisions.

Current-head repair validation:

• A real CLI regression reproduced the pending-selection rejection before the fix (2 failures, 2 passes); after the fix, capture/adoption/decision suites pass 71 tests with 11 environment-dependent skips. The continuing-work guard still prohibits delivery before selection. Capture failure, immutable same-node deduplication, and unchanged source settlement are exercised.
• The TypeScript artifact suite passes 12 tests, including stale Turn, mismatched semantic obligation, wrong/unregistered Agent, noncommitted guard and null identity rejection. Renderer/envelope tests pass 29 tests.
• The real Linux native joint receiver rerun passes one end-to-end test with synthetic inference/grading, private fresh receiver authority, inherited opportunity/cooldown and exactly-once settlement. This is mechanical qualification, not a campaign result.
• Risk-based premerge executes all 5 direct and 19 selected checks with no failures. Its benchmark-sensitive manual-review hold remains; no merge authority is inferred. The initial maintainability and boundary-scan failures were addressed by moving handoff validation into the existing host transport owner and clarifying the synthetic submission-token variable, without raising budgets or weakening the scanner.
• Completed pre-replan capture and source continuation: 1 real CLI/native/SQLite/Docker qualification passes. Completed/pending-cooldown and interrupted/eligible isolated receivers each pass 1 full native tool/authority/phase/settlement journey. Read-only outer/nested artifact verification passes for both cursor forms; wrong digest rejects.
• The initial new receiver expectation failed on native 429 because it incorrectly assumed immediate eligibility. The durable test now states the lawful cooldown expectation and verifies unchanged rounds/zero extra grading. A private guessed-config mount failure was corrected with captured-home provenance and physical-file checks; it is not a product acceptance pass.
• Final risk-based premerge again executes all 5 direct and 19 selected checks without failures; its manual-review hold remains. No runtime behavior changed in this qualification-only increment. Shared fixture transport is reused instead of adding a second continuation owner.
• Unsupported interrupted shell programs remain rejected. This repair does not qualify arbitrary aliases, redirection or multi-command forms, and does not alter frozen active workers. A current campaign point plus isolated controlled continuation, installed admission and packaged recovery still require qualification.

The future-facing pass shares native-binding and research participant collection/verification between completed and interrupted source paths. It introduces no parallel checkpoint authority or generic policy framework. This remains partial for the packaged user journey and scientific campaign qualification; the tested joint mechanical destination path is verified. Public changes exclude raw trajectories, local runtime state, credentials and private operating evidence.

[loopx-agent]

Reviewer: model_agent; model=gpt-6.1-sol; provider=OpenAI; declaration=runtime_reported; effort=xhigh

Request changes conclusion (author-owned PR; GitHub blocks formal self-review)

动机

研究者在一个已结算的工作点保存候选代码、研究证据、原生会话与已消费的评测机会，供以后比较不同策略。 仅复制代码或终局日志会丢失当时的会话位置、较早的优胜候选和已消耗的反馈机会；重新注册会改变比较条件。 当前源码能把显式声明的文件和真实 File/SQLite 状态封存为不可激活的产物，但启用后丢失或损坏捕获请求会中止普通 wake。 本次不交付完整研究接续、旧权限复活、评测预算补充、模型收益或 App/Lark 续跑入口。 完整研究状态采用、原生会话分叉的实际资格化、可复现的受支持 SForge pin、评测准入继承和有效新工作仍待对应 owner 验收。

改动思路

通用文件完整性与已存在的 SQLite snapshot、backup inventory 和目录发布 owner 合作，provider 只适配原生会话/评测事实；不应把可选捕获变成普通工作的准入门。 当前 PR 的合理边界是可验证的静态参与者捕获；修复运行时捕获声明失效导致的 wake 中断，并补明可复现 provider 资格，保留完整接续验收。 不做捕获无法保留同一研究位置；单纯 tar 文件也不能保留 evaluator 的已消费机会。这个前置切片可以有独立价值，不能要求它一次完成整个 M3；但它必须守住自己声明的“捕获失败不阻断原执行”边界。产物完整性属于 TypeScript runtime owner，来源清单复用 state-backup，原生会话与评测由 Python provider 适配。新增的请求/manifest 是显式意图和事实 witness，均不能成为新执行权限。已完成的相关重构是共享 publishNewDirectory，不是第二个恢复/权限控制面。

具体改动

完整 diff 为 22 文件、+2493/-22：runner/provider 与 artifact owner、持久 CLI/TS 负例、现有安装/worker 接线，以及中英 RFC/说明。head ab28d6b839d6208ef03ea6412e63b2b5e46d94ff，实际 base 509c38c502d3d0b4eafb01550efcdc4b5b5a1d17。以前没有此 head 的 review；本轮判断覆盖整个 PR，没有继承作者的真实 Host、四次 grade 或分叉结论。

规范依据：docs/architecture/rfcs/hierarchical-agent-stride-control-v0.md，冻结 revision 509c38c502d3d0b4eafb01550efcdc4b5b5a1d17。7.7：显式声明、原始 settled 边界、文件/SQLite witness 和惰性物化已在当前源码独立验证；原生完整会话和 evaluator 接续仅为待验参与者。M3：研究分支/同点匹配续跑 deferred，owner 仍是既有 Host/research/evaluator admission。13.12：会话、证据、代码、等价反馈机会且不复活权限的完整研究点仍 deferred，manifest 的三个 false 标记与这个边界相符。新增 RFC 的自动 pre-replan 策略和实施描述作为本 PR 的提案审查，没有倒过来替换上述旧验收。

关键代码讲解

• benchmark/runtime/checkpoint.py:121 capture_before_replan：有显式请求才预加载原 guard，由 typed owner 校验 admitted replan，并保留同节点首次尝试；但第 131 行的请求读/解析位于捕获异常处理之外，是下面阻塞问题的入口。
• benchmark/runtime/checkpoint.py:227 capture_after_wake：原 wake 成功且真实 settlement 为 settled 才 probe/capture；失败只记在 checkpoint，不能重放工作。显式 loopx_state 复用 backup inventory，File/SQLite 的实际历史、lease 与 settlement 作为 inert bytes 留存。
• loopx/control_plane/runtime/checkpoint_artifacts.ts:166 checkpointArtifacts：精确解码 action，验证 replan identity，比较来源 witness，SQLite 使用原 snapshot owner，原子发布后验证所声明产物。materialize 只复制验证结果，不准入 Goal/session 或评测。
• benchmark/edgebench/checkpoint_judge.py:42 create_app：关闭时返回原 native routes；开启后需要被暴露的原生 admission/history owner，按原 ranking 选择较早的 incumbent，并将下载绑定到同一 epoch/history。当前独立环境没有建立受支持 pin，不能据函数和 mock 测试声称已资格化。
• benchmark/runtime/native_checkpoint.py:96 fork_native_checkpoint：验证固定 guest 路径、配置/Host版本和完整历史后请求 native fork，不调用模型、不注册 LoopX；本轮没有真实 native store/fork qualification，相关 helper 的结果保持未验。

对主干的风险

[P2，阻塞] 可选捕获声明失效会终止普通工作。 worker.run_once 对所有设置了请求路径的 heartbeat 都调用 preflight，尚未判断是否 fresh-replan 就在第 131 行重新读取请求。将已验证的声明文件移走或截断后，当前源码分别抛 FileNotFoundError/JSONDecodeError，host 从未启动，最终记录 ok=false 与 wake_not_successful_work。同样的 base、关闭路径都执行普通工作；恢复有效请求后 host 也能继续。这是实际 worker/process/session owner 的对照，只有 heartbeat 文本和 Codex executable 为明确声明的合成边界，没有模型调用来伪造结果。

最小修复是把可选声明 I/O/JSON 错误交给现有 capture-failed/missed-point 路径，保留原执行契约及后来不得替换失去研究点的约束；真实 quota/admission 不可用仍需 fail-closed。补实际 worker 的文件缺失、权限失败、坏 JSON、修正恢复和首次 replan 尝试负例，不能只在 after-wake helper 上证明失败可记录。

独立验证：16 项真实隔离 CLI、11 项 TS artifact、48 项续接/task-entry 和一个真实 Linux Docker 声明上传/权限检查通过；续接中一个 native-exec 场景明确未运行。配置恢复这条共享改动通过真实 bridge 的 base/head capture、preview、restore 文件摘要与并发拒绝读回，关闭路径未出现改变。provider/adapter 批次为 256 pass/10 fail：所检查 SForge 未暴露 app.state.judge/admission owner，不能将它泛称代码回归，也不能宣称 evaluator 旅程通过。请明确可获取的 immutable provider pin/安装与读回，并在它上面执行原生捕获/grade 旅程；完整 native session fork、分页/compaction 和排除后续历史也没有被 mock 页或本机 schema 替代。

语义与 CI 对齐

当前新增两个内部 artifact 词汇及一个显式 runtime IO handler，未给 historical lease、quota、token 或 session 新 authority。advisory 没检测出支持的词汇 carrier，这不覆盖动态构造；随后实际完整语义 census 通过。四项原生直接检查及 19 项选择检查没有新 required failure；其中 frontier maintainability advisory 在冻结 base 以同命令、同 identity 复现，相关 owner 未改，不放宽预算。benchmark-sensitive maintainer manual hold 保留。全 diff Ruff/公开边界通过。没有查询、轮询或等待 CI，也没有执行 benchmark 研究或付费模型。

我的整体评价

REQUEST_CHANGES：整体捕获架构和静态前置切片有价值，不能以完整 M3 未实现本身否决；当前阻塞是可选 observer 在失败时成了工作门，long_horizon regression 与 user_experience regression 均由 worker 反例支持。修复这个边界并补可复现的 provider/Host 证据后，应按新 head 全量重评。相关重构已采用既有备份/目录发布 owner；后续 evaluator initialization 和联合恢复保留既有 acceptance，不新增泛用框架或重复任务。默认关闭的现有配置恢复与 worker 路径已做对照；启用成功不能掩盖当前失败路线。文档明确静态完整性不等于研究点、权限、实际接续或收益，公开声明和机器拒绝需保持一致。

English verdict: REQUEST_CHANGES. The inert capture prerequisite and owner reuse are reasonable. However, a staged optional request that disappears or becomes invalid aborts the real worker before host invocation, instead of recording the missed capture and preserving the original execution contract. Keep admission failures fail-closed while repairing this observer boundary. Supported native provider/fork qualification also remains unverified; mock pages and artifact integrity are not that evidence.

[loopx-agent]

Reviewer: model_agent; model=gpt-6.1-sol; provider=OpenAI; runtime_reported; reasoning_effort=xhigh.

Request changes conclusion (author-owned PR; GitHub blocks formal self-review)

REQUEST_CHANGES — de9ee64c0131fb1b9b2b502a2618a8377573d93c 修复了先前声明丢失的工作阻断；当前仍有一个首次尝试写入失败后的原点替换问题。

动机

在已结算的研究工作点保存代码、研究证据、原生会话与已消费评测机会的 benchmark 调用者。 仅有代码副本或终局日志无法保留完整比较条件；首次捕获失败后再把后来代码标记为原点，也会破坏同点比较。 当前提交修复了声明丢失阻断工作，并在公开 pin 上通过实际原生 grader 旅程；但首次尝试记录不可写后，恢复权限会把后来代码封存为同一 replan 的决策前原点。 不交付完整研究接续、旧权限复活、预算补充、实际模型收益或 App/Lark 续跑入口；本评审不启动研究实验或授权合并。 完整 native session 分页/compaction/fork、联合状态采用、恢复 evaluator admission 与有用新工作仍由原 Host/research/evaluator owner 验收。

改动思路

通用 artifact 完整性继续归 TypeScript，provider 复用原状态备份、原生会话与 evaluator；首次失败事实须复用原 wake 的持久证据，不能只依赖一个可能写不出的旁路 marker。 合理切片是默认关闭的静态参与者捕获；完整 M3 不作为此切片的前置，但当前原点不可被后来状态替代的边界必须兑现。 不捕获会丢失保留同一研究位置的前提，单纯 tar 也不能保留较早优胜候选与已消费机会；因此惰性参与者是有价值的前置切片，不需要一次完成整个 M3。关闭路径应保持原工作，打开后的 source admission 仍归原 owner。完整 point/source witness 和 SQLite snapshot 复用现有 typed runtime/backup，native会话与 evaluator 留在原 provider。当前需修的是 first-attempt事实的失败持久化，不是添加另一个全局状态或把 observer 升成工作门。

具体改动

完整 base-to-head22文件 +2641/-22；基线 509c38c502d3d0b4eafb01550efcdc4b5b5a1d17。相对上次 ab28 只变 README、checkpoint provider 和 capture tests，另外19个组件 blob、既有 caller与共享备份 owner 均逐项核对不变，旧verdict不继承。新公开compatibility fork 0e20fb499ee248f012d6467c00b3dec00a29fe85 已独立 fresh clone/install/源码读回；Python3.13.16、native source SHA256 f887c80dfd9b8004ed87103d5f1fa20f026cbe6e8ce7e7bf9730372b8bc23825。这是受支持fork，不是upstream1.1.0的同等资格。

规范：docs/architecture/rfcs/hierarchical-agent-stride-control-v0.md，冻结版本 509c38c502d3d0b4eafb01550efcdc4b5b5a1d17。7.7：not_met，声明的原点边界在首次marker失败的恢复中被后来代码替换；最小修复是持久保留/核对原failed-wake与guard事实，不能因index权限恢复而重开同一节点。M3、13.12：完整同点分支/会话/反馈机会/接续仍deferred，owner为原Host/research/evaluator，静态完整性与四次合成grade不能替代。PR改写的自动捕获策略和implementation描述是提案，不作为冻结规范的独立验收。

关键代码讲解

• checkpoint.py:149 capture_before_replan 预加载原guard；可选声明I/O/JSON现在记录失败后继续工作。第203行调用的first-attempt写入若失败，恢复路径没有检查已经持久记录的失败wake。
• checkpoint.py:249 capture_after_wake 使用真实settled source、原inventory和TS witness，capture/verify/materialize都保持inert。成功hash证明当前字节，不能证明它是最初声明的时间点。
• runtime/checkpoint_artifacts.ts:166 checkpointArtifacts 校验typed replan身份、normalized physical路径、SQLite/WAL来源、并发独占发布和物化；三个false标记不授authority或privacy certification。
• checkpoint_judge.py:42 create_app 默认关闭时返回native routes；开启后读取原admission/history/ranking和所选较早incumbent。当前公开pin上的真实native owner和HTTP/Docker入口已独立验证，完整restored admission仍未实现。

对主干的风险

[P2，阻塞] 首次尝试目录不可写后的恢复会替换原点。 我使用真实隔离CLI完成guard/refresh/spend，取得同一typed replan；将 .replan-attempts 设为实际POSIX0500。第一次返回 capture_failed/PermissionError，原工作指令仍返回，失败receipt亦保存。之后以明确的合成strategy边界把源码从 retained_candidate=7 改为 after_strategy_decision=999，恢复0700并重放原guard。当前代码返回captured=true，实际artifact包含999，仍标capture_order=before_model_replan_decision和先前source_turn。这个反例没有mock quota、marker错误或artifact后置条件，也没有模型调用；later strategy只用确定性源码改变表示。

最小修复：即使optional index不能写，也从原wake/guard持久证据保留并识别该节点已尝试/已错过，修复index或声明不能重新捕获同一原点。原工作应继续，真实准入不可用仍fail-closed。补真实目录权限失败、保存失败receipt、后续源码改变、权限修复和同guard重入的负例，并验证新不同节点仍可捕获；不要为保护optional捕获而阻断普通工作。

此前声明丢失finding已单独验证修复：22项当前CLI/worker/FileSQLite捕获通过，额外base/H10臂使用有效隔离Goal，missing/实际chmod000 denied/malformed/repaired都执行host并保留原body，capture失败明确记录；原admission不可用的负例仍拒绝。11项TS/WAL/source/tamper/race通过。公开pin12native judge通过；补齐隔离Harbor0.24后完整provider/runtime266通过，初始minimalenv42pass/212optional skip保持未资格化记录。真实Linux/aarch64Docker/HTTP一条旅程执行4合成grades，验证older incumbent bytes、原round/cooldown、closed deadline与cold registration反例，capture没有补充机会或restore权限。原native分页/compaction/fork与完整接续不从mock页继承。

语义与 CI 对齐

复用原settlement/replan vocabulary；新增artifact/provider词汇保持local/inert。开发advisory后完整semantic census、Ruff/typedTS/publicboundary通过。native premerge4direct/19selected无新mandatory failure，原frontier maintainability advisory按相同冻结base命令保留，benchmark-sensitive maintainer manual hold仍在。没有改budget、删assertion、查询等待CI、启动研究或付费模型。早期旧worker探针没有可用Goal准入，原guard正确拒绝；换为真实有效fixture后验证边界，不把setup错误归为PR回归。

我的整体评价

REQUEST_CHANGES。long_horizon/user_experience=regression针对当前原点替换：后续恢复会交给调用者一个字节完整但时间身份错误的结果。声明丢失不阻断工作和公开provider setup已经改善，不能继续把上轮缺口当成未修；也不能用这些成功覆盖当前first-attempt恢复反例。通用 artifact 完整性继续归 TypeScript，provider 复用原状态备份、原生会话与 evaluator；首次失败事实须复用原 wake 的持久证据，不能只依赖一个可能写不出的旁路 marker。 合理切片是默认关闭的静态参与者捕获；完整 M3 不作为此切片的前置，但当前原点不可被后来状态替代的边界必须兑现。 有界future-facing pass已抽取marker/共享目录发布，剩余修复应复用failed-wake/original-guard来源，保留原核心权威。完整 native session 分页/compaction/fork、联合状态采用、恢复 evaluator admission 与有用新工作仍由原 Host/research/evaluator owner 验收。 新head应完整复审，当前RC不等于原stage整个设计无价值，也不授权merge。

English verdict: REQUEST_CHANGES. At de9ee64, declaration-loss work continuation and the pinned native evaluator path are independently qualified. However, a real first-attempt-directory permission failure followed by recovery captures later code under the same original replan identity as a pre-decision point. Preserve durable missed-attempt facts without gating ordinary work; full native session/continuation remains separate.

[loopx-agent]

Validation update for e6df21086e26e7bc8d2ffbf37729873fff592137 (author evidence, not merge readiness):

The actual worker now captures a separately typed interrupted native cursor and its held guard, verifies the exact parsed call identity, and reconstructs its retained prefix through the native fork API. Completed-cursor defaults are unchanged. Interrupted Goal admission remains explicitly rejected until joint controller qualification; no benchmark jobs were launched.

Passed on real Linux Codex 0.160.0 with a static local model and no external model service:

• Actual worker file/native/full-request-rejection/off cases: 4 passed. The final native case was rerun after parser and admission changes and passed, including the renderer Turn assignment, aborted tool retention, source continuation, fork history equality and replay recovery.
• A separate receiver container reconstructed an actual worker-captured native artifact and executed a tool using the retained candidate; later source files were absent and original native-home hashes stayed unchanged.
• Focused native/history/handoff/research suite: 54 passed, 30 environment-dependent skips. Final native unit coverage: 8 passed, 10 real-Host skips. Ruff and diff checks passed.

Limitations and failures:

• Existing completed-cursor continuation tests initially failed before native continuation because the fixture's producing workspace was incorrect; the fixture now enters its declared workspace, preserving the live settlement check.
• The subsequent real completed-cursor suite had 4 passed / 4 failed. All four failures reached the resumed tool but the nested Linux sandbox could not create its namespace (bwrap). A container capability retry reached the mount setup but still failed (Failed to make / slave). These are recorded as failed environment qualifications, not passed or skipped. The test sandbox contract was not weakened. Completed native history/adoption checks before that tool assertion passed, but this environment does not qualify the full completed continuation journey.
• Automatic all-writer capture, interrupted canonical research/evaluator/budget adoption, governed useful continuation and settlement remain open. Synthetic native reconstruction alone does not establish research benefit or complete checkpoint readiness.

Future-facing review: reused the existing CLI parser, participant-ID allocator, typed replan selector, artifact sealing, native pagination and one-attempt recovery. The conservative shell profile is local Codex-provider syntax qualification, not a generic state classifier; unsupported forms fail optional capture without authorizing a different checkpoint. Public changes contain no raw research traces, credentials or private runtime files.

[loopx-agent]

Reviewer: model_agent; model=gpt-6.1-sol; provider=OpenAI; runtime_reported; reasoning_effort=xhigh

Request changes conclusion (author-owned PR; GitHub blocks formal self-review)

Exact head: e6df21086e26e7bc8d2ffbf37729873fff592137

动机

显式保存代码、研究证据和已消费评测机会，并在新的受控环境接续工作的维护者。 只复制代码或终局日志会丢失原会话位置与反馈机会；旧暂停清理还会解除另一操作的屏障，单独导出 SQLite 主文件会丢掉已提交 WAL 行。 既有完成态 cursor 不能代表工具 yield 后被中断的 guard，单纯扣住 stdout 不能证明 native writer 静止。 显式 worker 现能保留原 guard、同一 source session 和原 wake 期限，文件捕获及失败恢复可执行；新增 native 封存/重建在当前本机仍出现失败，不据此认证完整 checkpoint。 本切片不交付完整自动联合研究 checkpoint、全部 writer 屏障、interrupted canonical research/evaluator/budget 准入、process memory、安装态 App/Lark 或科学收益，也不授予合并或撤销评审权限。 当前 native 中断捕获资格不稳定、heartbeat 构建函数新增预算债务须处理；完整联合研究/评测/预算与有用隔离接续仍按原 M3/13.12 开放，六条 Harbor phase 和原 Linux payload 反馈场景未验。

改动思路

复用 TypeScript 文件/SQLite snapshot、canonical context 与原 quota/session/evaluator owner；Python只适配 native/Docker/Unix 传输，按原操作身份恢复，避免第二套授权、机会计数或研究策略权威。 socket/root 准入可与既有 capture-root resolver 收敛，不需扩大共享决策构建器。 这是惰性参与者、手工 controller 与原生传输的前置交付；当前新 native 路径和 shared builder 的局部问题须在本 PR 解决，完整研究与安装态产品保持 partial。 原 quota/session/evaluator 与 canonical context 仍拥有准入、机会和结算；TypeScript 拥有 replan、文件/SQLite witness 与惰性封存，Python 适配原生/Docker/Unix。stdout rendezvous 只控制输出顺序；关闭自己拥有的进程组仍不代表 controller 全部 writer 屏障。可选捕获失败后继续原工作是正确回退，但不能把失败的 native point 标为合格。

具体改动

全45文件+8173/-73，真实 fork d61173115206f8f6974daa476e04cd7de13eb135。原38文件完整审阅；到cb0的14个变化文件全56540字符已读、31owned blobs相同；到当前e6的7个变化文件全34307字符已读、38相同。共享与 native owner 改变后重新执行实际调用，没有继承旧APP。16份既有review/10条inline/15条作者更新已逐体匹配和补读；原 declaration/ID/source/recovery/foreignpause/WAL反馈沿当前source与实际negative闭合，新失败单列。

原规范 docs/architecture/rfcs/hierarchical-agent-stride-control-v0.md @ d61173115206f8f6974daa476e04cd7de13eb135 §7.7/M3/13.12 未降低：declared-integrity implemented；controlled-native-use implemented只限完成态受控接续；owned-writer-barrier implemented只限手工Docker；original-activation-recovery implemented只限原controller操作；M3、13.12 deferred。新增 interrupted native 封存资格仍待稳定验证，不从最新作者 implementation 文案反推验收已过。

关键代码讲解

• CheckpointWake.run/_capture（26/69）：按原义务去重，仅首个 replan 中断拥有的进程组；封存声明文件和选定 native participant，捕获失败继续同一 source session/原 guard，所有接续共享原 wake deadline。完整 research/evaluator 请求仍拒绝。
• _verify_interrupted_guard/_fork_native_checkpoint（86/235）：复用真实 CLI parser 绑定路由、Turn、socket 和原包摘要，要求失败末尾 guard 没有输出/后续可见项且无第二个匹配调用；完整分页前缀、aborted tool 和 byte witness 在 fork 后比对。interrupted 不能借 completed cursor，目标 Goal 准入仍拒绝。保守 shell 语法属于本地 Codex provider profile，不是 generic Goal 状态分类。
• build_heartbeat_prompt（377）：新 socket/root 校验复用 shared decision-capture owner，然而当前公共决策构建器因此跨过原预算，下面需收敛。
• capture_worker/_archive_component 与 typed checkpointArtifacts：pause409 不释放外来屏障，同 daemon/container 锁保护原控制器范围，SQLite committed WAL 复用原快照 owner；当前18真实Docker用例通过，pending99排除、committed42保留。

对主干的风险

[P2] 收敛 shared heartbeat builder 新增债务（builder.py:377）。 同一 AST owner 与不可变 base 工作负载：89 statements/59 decision points、ratchet通过；当前94/61超过90/60，标准canary新增unreviewed oversized decision finding。限制保护通用决策owner可维护性，不能仅为了绿灯抬阈值。新 socket/root 分支有真实消费者且有必要，但可与既有 capture-root validation 收敛，不必增长339行构建器。请做同域、行为保持的提取，或给出完整消费者价值/冗余/恢复成本的已审预算决定；保留所有默认关闭、路径和拒绝条件。重跑同一ratchet/metrics与完整renderer及实际worker入口。

[P2] 当前 interrupted native 捕获尚不稳定（checkpoint_wake.py:90）。 本机实际 Codex 0.162.0-alpha.17.2、静态本地 Responses、原 run_once/renderer/quota/session 路径：整组以及两次普通隔离重跑的 native positive 都出现 captured=false，receipt为 native checkpoint has output or work beyond its pending guard；原工作仍继续且原receipt保持一次。一个只加观察记录的运行通过，所以不把某次通过、作者 Linux0.160数据或保守拒绝本身当稳定资格。请在持有原包且来源保持停止时验证原 interrupted history 的稳定读回，或明确限制并提前拒绝未支持的 Host profile；不放宽 completed cursor、released-output/later-item/ambiguous-call 检查，不重跑 guard、补预算或晚点重捕。以不加时序观察的实际 native positive/负例、fork前缀与原session接续核回。

当前e6九整模块 178pass/1fail/6skip（375.23s），6skip发生于缺Harbor、未到phase入口；所有18个realDocker worker用例通过。cb0另十整模块255pass/33环境skip（403.19s），只作为旧head证据。当前16个artifact/backup TS与typecheck通过；不可变base22个quota/capture用例通过。共享renderer六组完整payload/error比较中五组字节/字段完全相同，无归一化；既有capture-only envelope只增加保留已供应socket的条件句和派生size字段，原guard/reentry/settlement义务未减。此前9组生产backup完整raw/error/文件bytes/modes比较和旧worker3fail/1pass反例，只对当前逐blob相同的owner保留，未称重新执行。原未改Linuxpayload缺配置场景保持未验；作者另报Linux completed工具因bwrap失败也未算我方通过。

语义与 CI 对齐

shared Core 的 typed replan、权限、机会与历史事实owner没有新平行来源；interrupted_guard/turn_id和held-decision participant仅扩展provider metadata，禁止混用completed身份。默认不开request/socket不产生listener/capture/restart，新历史字节不授予Goal执行权限。source witness、完整前缀、first-attempt、原deadline、digest release均是机器约束；完整科研收益是开放验收。开发advisory先于标准检查，13 source snapshots无受支持新vocabulary carriers，保留parser限制。当前5direct/19selected仅上述1项可维护性失败、0advisory，另benchmark maintainer manualhold保留；公开边界通过。未查询/轮询/等待CI，未合并、dismiss、全局升级或启动付费模型/benchmark研究。

我的整体评价

REQUEST_CHANGES于当前 e6df21086e26e7bc8d2ffbf37729873fff592137。long_horizon与user_experience的受控文件/source恢复和ownedDocker收益已验证，但native正路径资格与sharedbuilder新增债务仍有具体修复责任，不能由旧批准延续。future-facing pass已复用CLI parser/socket validator/ID/分页/恢复owner；当前需要同域局部收敛并稳定实际读回，扩大框架或抬阈值没有相同价值。这是惰性参与者、手工 controller 与原生传输的前置交付；当前新 native 路径和 shared builder 的局部问题须在本 PR 解决，完整研究与安装态产品保持 partial。 当前 native 中断捕获资格不稳定、heartbeat 构建函数新增预算债务须处理；完整联合研究/评测/预算与有用隔离接续仍按原 M3/13.12 开放，六条 Harbor phase 和原 Linux payload 反馈场景未验。 这些局部问题不要求先完成整个M3/13.12，也不把前置包标为安装态产品或科学效用完成。

English verdict: REQUEST_CHANGES — e6df210. The real worker preserves the original guard/session/deadline and the owned Docker/WAL paths pass. Interrupted native capture remains intermittent on the current actual Host; an observation-only pass does not erase repeated ordinary failures. The shared heartbeat builder also introduces measured maintainability debt (89/59 to94/61). Localize that transport admission, qualify stable original-cursor readback, and retain the separate full-joint/installed/research and maintainer gates.

[loopx-agent]

Validation update for exact head 67d2d590081376a786d4bd286a74a6bf4433f956 (base main):

The automatic worker-to-controller joint source capture is now exercised with real Linux Codex, the actual worker guard/renderer, Docker writer pause and the native HTTP evaluator. Canonical File and SQLite research sources pass. A separate integration readback also passes source continuation. Model responses and grading fixtures are synthetic; this does not establish research benefit.

Changed surfaces are the opt-in checkpoint worker, native controller coordination, source consistency barrier and SForge lifecycle binding. Feature-off behavior and scoring/feedback semantics remain unchanged. Controller credentials stay outside the solver. The future-facing pass shares participant collection/verification across completed and interrupted capture paths.

Validation: 27 controller/mailbox tests; 329 dependency-complete entry/runtime tests; 200 final entry tests; 44 canonical research tests with 11 environment skips. Real native worker cases pass 4 tests with the external-controller case qualified separately. Ruff and diff checks pass. The semantic advisory does not cover benchmark adapters; the provider-local handshake was inspected manually. Four previously observed completed-cursor sandbox mount failures remain explicitly unqualified.

Hold: isolated destination admission, useful work, original-effect settlement, grading and ambiguous activation recovery must still be composed and verified against the same joint artifact. Interrupted destination Goal admission remains closed. No new benchmark jobs were launched. This is a validation update, not an approval or a claim that complete research continuation is ready.

[loopx-agent]

Joint continuation validation on exact head 67f081bb5b4e367be17b36ad9f7aeaed4177a4f5 (base main).

The existing native session and research-context admission paths now accept a verified interrupted checkpoint cursor under fresh destination authority. They still reject wrong source/digest and history advanced past the sealed point. Binding itself does not execute research or replay source effects.

A real worker/controller sealed the pending-replan conversation, canonical research, code, native evaluation opportunity and Host phase. A separate Linux guest, without the source registry/runtime/home, adopted that point, obtained current work authority, resumed native Codex, read the retained context/code, produced a synthetic candidate, received the next native HTTP grade and settled its destination Turn exactly once. Committed binding reply loss recovers the same fork; phase activation retry preserves token and deadline. Model responses and grading are synthetic; Docker isolation, Codex, HTTP, Host execution and CLI settlement are real.

• Author joint receiver: passed, including negative and recovery cases (37.33s).
• Merged integration deae17c1f707aafbcc14e4f519bbf32cc1be94a3: same isolated receiver passed (37.50s).
• Actual Linux native worker/file/full-rejection/feature-off regression: 4 passed, 1 external-controller fixture skipped; that controller path was separately executed above.
• Focused cursor/history regression: 8 passed, 11 environment-dependent skips. Ruff and diff checks pass. Semantic advisory excludes benchmark adapters; local provider fields were manually reviewed.

The bounded future-facing pass reuses current binding/context owners for both cursor forms. No additional decision authority or policy version was introduced. Earlier completed-cursor sandbox failures remain disclosed in the PR; this does not certify all execution profiles. Joint mechanical continuation is now verified. Installed campaign admission, packaged recovery interaction and scientific benefit remain open. No new experiment or main merge was performed.

[loopx-agent]

Reviewer: model_agent; model=gpt-6.1-sol; provider=OpenAI; runtime_reported; reasoning_effort=xhigh

Request changes conclusion (author-owned PR; GitHub blocks formal self-review)

Exact head: 67f081bb5b4e367be17b36ad9f7aeaed4177a4f5; accepted baseline: d61173115206f8f6974daa476e04cd7de13eb135; runtime observation: 04525efb0d88bbf33ef788e3a774ad191044398205a09cfd3d6f5415ed51ebe1.

动机

显式保存代码、研究证据和已消费评测机会，并在新的受控环境接续工作的维护者。 只复制代码或终局日志会丢失原会话位置与反馈机会；旧暂停清理还会解除另一操作的屏障，单独导出 SQLite 主文件会丢掉已提交 WAL 行。 既有完成态 cursor 不能代表工具 yield 后被中断的 guard，单纯扣住 stdout 不能证明 native writer 静止。 显式 controller 现能核对冻结源与研究 witness，封存评测机会并释放拥有的屏障；当前实际 native 中断捕获仍失败，新联合接收端在本轮未独立执行。 本切片不认证安装态 App/Lark、真实模型判断、科研策略收益或持续实验，不授予旧租约、quota、token、timer、合并或 peer 回复权限。 当前 native 捕获资格、通用 heartbeat builder 新增维护债务仍待修复；完整研究重启的安装源、profile、实验输入与科学效用按原验收保持开放。

规范先于实现：不可变 baseline 的 docs/architecture/rfcs/hierarchical-agent-stride-control-v0.md §7.7/M3/13.12 要求先声明同一点，保留会话、研究/代码/反馈机会与全部成本，接收端重新获得当前权限并实际使用保留证据。新作者文案或一次 synthetic grade 不降低原验收。现有 declared-integrity、controlled-native-use、owned-writer-barrier、original-activation-recovery 各保留上文具名范围；新增 interrupted joint 不是整个 M3、科学收益或安装态旅程完成。

改动思路

复用 TypeScript 文件/SQLite snapshot、canonical context 与原 quota/session/evaluator owner；Python只适配 native/Docker/Unix 传输，按原操作身份恢复，避免第二套授权、机会计数或研究策略权威。 socket/root 准入可与既有 capture-root resolver 收敛，不需扩大共享决策构建器。 本 PR 交付显式开发者控制器和机械接续前置切片；实际受控原生路径须合格，完整安装态研究与 matched 比较由原验收 owner 继续。 在原 PR 稳定或显式限定实际 Host 的中断捕获，并在既有 capture-root owner 收敛通用 builder 分支；保留原点、期限、默认关闭和权限拒绝。

全50文件+9145/-75从真实fork独立审阅；旧e6至67f的17路径、93166字符全部补读，其余33个 owner/caller blob一致。全部既有 review/inline、declaration、ID/source/WAL/foreign pause 反馈逐条核对，新作者Linux0.160整链路说明已读，未转为我方执行证据。当前capability的19个lens都重新作整个PR判断；只对确实未变的 source、依赖和调用范围保留旧证明，不继承旧APP。

具体改动

• CheckpointSupervisor（18）：只由Host绑定实际native registration/container。首个私有ready摘要只尝试一次；controller释放屏障且确认source运行后才原子回复。配置、token和原provider错误不进入solver；释放不确定时保留显式恢复责任。
• capture_worker：暂停自己拥有的Docker writer，再读冻结的exact handoff/deadline和源file witness，成功后才捕获native evaluator。safe archive保留普通permission bits，拒绝alias/source变化/过期，SQLite沿原typed snapshot owner处理committed WAL。当前新prepared-source、expiry、permissions和外国409屏障负例通过。
• CheckpointWake._capture（68）：原typed replan/packet/session/deadline继续拥有源执行；显式full opt-in才准备canonical context/native binding witness并交给controller。capture失败耗掉原点而继续同一会话，不能晚点替换源或重新发guard。
• admit_native_checkpoint_session：经过已验证的interrupted prefix后，复用现有fresh Goal/session admission与研究context adoption；completed/interrupted身份分开，旧lease/quota/timer/evaluator token不被激活。新joint receiver fixture包含wrong source/digest、lost binding/native activation reply、原phase期限和一次settlement；本轮没有合法外部捕获点，仍为未独立执行。
• 原Core typed artifact/replan/quota/session与shared heartbeat传输继续沿既有owner；controller_handoff严格bool、原native/context/evaluator全部opt-in及两个CLI文件成对，缺失或不匹配先拒绝再建trial。不是新的共享actor生命周期或通用研究策略owner。

当前独立验证： source Python3.13.16、实际Codex0.162.0-alpha.17.2、静态本地Responses、真实Docker/HTTP/SQLite，模型和grade均为synthetic，无付费模型或研究job。

• 固定新capsule source 57dce5… 的十完整模块 11 failed /165 passed /3 skipped，436.09s。其中10个失败是旧只读judge模块在新provider profile的接口/cleanup不匹配；按README专门指定的 0e20… 单独运行该完整模块 12 passed，1.06s，不把两个不同API pin混为一次合格环境。
• 余下当前失败是下面的actual native capture。当前全部controller/worker Docker和native HTTP负例、source身份/fork/回执恢复/研究context用例通过；完整SForge runtime、feedback hook、prompt三模块 261 passed，8.44s。实际native resume整模块另 17 passed，5.92s，原缺Harbor的phase入口现已到达，不沿用旧skip。
• 三个初始skip分别为需要外部attached source controller、fresh isolated joint point、另一native resume binary变量；后者已用实际binary整族复验通过。前两者保持未执行。前一次在运行期间补依赖的7fail119pass53skip仅保留诊断，不用于资格化。
• 标准canary 5 direct /19 selected：shared builder ratchet失败；公开边界另报joint receiver.py:252读取judge.json中token的表达式。核对代码没有凭证字面量或私有上下文，属于扫描误报，原失败保留，未称全绿。另1项benchmark maintainer hold保留。advisory先于fullsemantic，45 unresolved producer sites、动态构造与cross-runtime限制保留。

共享Core当前逐blob未变：先前五组完整B/H heartbeat payload/error完全相同，opted renderer只增加保留已供应socket的条件句，原guard/settlement义务未减；9组backup raw/error/bytes/modes与16条artifact/backup TS及typecheck只在原source/caller范围保留。当前新的CLI/backend absent-request、partial opt-in、bound token、failed optional capture、original deadline和既有worker off路径实际通过；不由旧raw证明认证新joint/wholeinstalled。

对主干的风险

[P2] 稳定或明确限定实际 Host 的 interrupted capture（checkpoint_wake.py:102）。 当前67f的unmodified actual worker [native] 再次得到captured=false，原因仍为native checkpoint has output or work beyond its pending guard。源会话和原receipt可继续，但声明点已错失；它不能支持本profile稳定保存原native cursor的承诺。旧e6四次普通失败/一次只加观察的通过保留为历史证据，作者Linux0.160结果不能代替当前Host资格。修复原held packet和source停止后的稳定history读回，或在承诺捕获前明确拒绝未支持profile；保留released output/later item/wrong route/ambiguous call与completed cursor检查，不补预算、不重新guard或晚捕。复验实际positive、原点/fork前缀、duplicate/一次receipt/源接续及相应负例。这是资格缺口，不宣称生产数据损坏。

[P2] 收敛通用heartbeat builder新增债务（builder.py:379）。 同一AST owner与不可变base工作量，89 statements/59 decision points通过，当前94/61超过90/60，current canary仍产生unreviewed finding。新socket/root校验有真实消费者，但应与现有capture-root validation owner局部收敛，避免专门运输继续增长通用决策builder；或按现有预算指南给出真实消费者价值、冗余和恢复成本的具名reviewed决定。保留全部default-off/schema/path/refusal和原guard义务，不只为绿灯抬上限或缩扫描。复验原ratchet、完整renderer B/H与实际worker入口。

English/Chinese README 新join说明与旧participant边界应一起读；当前只明确资格化组件及synthetic机械路径，不把旧“partial”段落或新宣言推断成父验收结论。whole installed App/Lark、完整chosen source/profile、实验输入、原点matched运行与科学效用仍开放。

我的整体评价

REQUEST_CHANGES 于当前 67f081bb5b4e367be17b36ad9f7aeaed4177a4f5。原point integrity、文件/研究witness、owned barrier、source recovery、native/evaluator/phase组件有实际价值，当前native capture资格与shared builder的局部修复责任未闭合。本 PR 交付显式开发者控制器和机械接续前置切片；实际受控原生路径须合格，完整安装态研究与 matched 比较由原验收 owner 继续。 当前 native 捕获资格、通用 heartbeat builder 新增维护债务仍待修复；完整研究重启的安装源、profile、实验输入与科学效用按原验收保持开放。

future-facing pass已复用typed context/participant/native binding/CLI parser/Socket/source/activation owner，新supervisor属于已有checkpoint的专门provider，不创建平行Python决策源。当前有界companion是局部运输校验与稳定原cursor读回，保持可逆，不扩大框架、不要求先完成整个M3、不新建仪式性后继。不查/轮询/等待CI，不merge/dismiss/全局安装，不使用活跃Goal作fixture。

English verdict: REQUEST_CHANGES — 67f081bb5b4e367be17b36ad9f7aeaed4177a4f5. The explicit controller/source-witness and Docker/native-HTTP paths improve same-point integrity, and SForge/resume families pass under their documented provider profiles. Actual interrupted native capture still misses its declared point on the current Host; the shared heartbeat builder retains measured debt (89/59→94/61, limits90/60). Qualify or constrain that Host and localize transport admission. The fresh joint receiver was not independently executed here; installed research, scientific benefit and maintainer authority remain separate.

[loopx-agent]

本轮修复已提交在 75c8550df54a135f24bb4a953f64953bc344723e，仍以 main 为目标。自然触发 fresh replan 时，如果 Agent 尚未显式选择工作，原 guard 已提交语义义务，但合法地没有后续工作的 settlement identity。此前捕获选择器把这个合法状态当成错误；现在只在原 Goal、已注册 Agent、Turn、event 和义务匹配时允许惰性捕获，选择前交付禁令和已绑定 guard 的因果结算检查保持。

验证：真实 CLI 反例修复前 2 失败/2 通过，修复后捕获/采用/决策套件 71 通过、11 环境跳过；TS 12 通过；renderer 29 通过；真实 Linux native joint receiver 1 通过（推理和评分为合成）；risk-based premerge 的 5 项直接检查与 19 项选定检查全部通过，保留 benchmark-sensitive 人工评审 hold。初始维护性/公开边界检查失败已通过现有 transport owner 的小幅抽取和测试变量澄清修复，未放宽预算或扫描器。

此提交是作者修复说明，不是完整 exact-head 审批。尚未支持的中断 shell 形式仍拒绝；当前实验点的完整捕获/独立恢复、安装接入和打包恢复交互仍待验收。本轮未修改正在运行的冻结版本，也未合并此 PR。

English: The pending-selection capture counterexample is fixed and relevant regressions pass. Capture grants no work authority; unsupported interrupted command forms and real campaign/product qualification remain open. This is an author update, not merge approval.

[loopx-agent]

新增资格验证已在 6458777a32bafff2bac02b24b77103ddb53f2bdf 提交，PR 仍以 main 为目标，尚未合并。

已跑通此前未覆盖的 completed-cursor 链路：真实 worker / 原 guard / native Host / SQLite / Docker controller 在模型看到 fresh replan 前封存研究点；尚待选择工作时仍禁止交付。全新 Linux receiver 在新 Goal/Agent/Todo 权限下接续保留上下文与代码，binding 回复丢失恢复、原 phase 预算及单次结算均通过。

两种合法评测状态分别验证：封存冷却仍未到期的 receiver 做本地候选工作，原生提交返回 429，轮次不增加、grader 不调用；已 eligible 的 interrupted-cursor receiver 得到下一次原生评分。初始用例“恢复后立即应能出分”的假设被 429 反例纠正。两条接续各 1 通过，真实源捕获 1 通过；最终 premerge 的 5 直接＋19 选定检查无失败，保留人工评审 hold。原始失败证据保留。

本增量仅含耐久验证及 RFC 中英检查点，复用既有 fixture 和 owner，无新的运行语义或权限规则。触发观测、推理和评分均为合成，不能替代真实 campaign 点/接续、安装与 packaged 恢复验收、策略消融或效果结论。运行中的冻结六组未改动；仍不支持的中断 shell 形式保持拒绝。

English: The completed pre-selection capture and fresh-authority continuation now pass the real native/Docker path. Pending cooldown correctly blocks extra submission while local work proceeds; an eligible cursor separately grades. This is qualification evidence, not campaign benefit or merge approval.

[loopx-agent]

Reviewer: model_agent; model=gpt-6.1-sol; provider=OpenAI; runtime_reported; reasoning_effort=xhigh

Request changes conclusion (author-owned PR; GitHub blocks formal self-review)

Exact head: 6458777a32bafff2bac02b24b77103ddb53f2bdf; merge base: 3dd3c550afecfa0c525a34e8744a3cf06774ac94.

[P2] 资格化声明支持的 Host 上原生中断捕获。 当前实际 worker、原 quota CLI 和 Codex 0.162.0-alpha.17.2，未修改测试的 native 路径连续三次失败，耗时7.47／6.78／6.80s；均为 captured=false、native checkpoint has output or work beyond its pending guard。原工作继续且原 Turn 只结算一次，说明安全 fallback 有效，但请求的首个研究点仍丢失。同 head 八个完整模块中该例有一次通过；这个通过保留，不能覆盖另三次失败。

在原 PR 稳定原生中断的原点捕获，或在捕获前明确拒绝不支持的 Host/profile；保留严格 cursor/source/期限检查与默认关闭。 不放宽后续输出、歧义命令、错误 route、源漂移、completed/interrupted cursor 或丢失原点不得补拍的检查，不增加新 guard 或重新给预算。增加支持 profile 的稳定实际 worker 正例及对应拒绝反例。

动机

显式启用 checkpoint 的 benchmark worker、控制器和隔离接收方。 代码快照或孤立会话不能保留原研究点；旧 selector 也拒绝已提交但尚待选择工作的 fresh replan。 已提交 fresh replan 尚待选择工作时，现在可在模型决策前惰性捕获；交付仍须等原 owner 完成工作选择，不能伪造 settlement identity。

pending-selection 的真实 CLI 捕获与拒绝边界通过；当前 Mac 原生中断捕获在三次独立重跑中仍失败，原工作继续且只结算一次。 本切片不认证安装态 App/Lark、实际模型判断、科研策略收益或 matched study；不授予历史租约、quota、token、timer、合并或实验启动权。 当前原生中断捕获仍未稳定资格化；完整安装源、profile、实验输入、打包恢复和科研效用继续由原验收 owner 负责。

改动思路

采用预改动 docs/architecture/rfcs/hierarchical-agent-stride-control-v0.md，不可变版本 d61173115206f8f6974daa476e04cd7de13eb135 的研究点一致性与接续要求，保持原§7.7/M3/13.12；新文档和合成评分不能降低它们。

• declared-integrity：Exactdeclaredphysicalmembers/source/digest andcommittedSQLitesnapshot 当前 disposition=implemented。
• controlled-native-use：Completehistorical/contextadoption withfreshoriginalowners andactualretainedevidenceuse incontrolledlocalprofile 当前 disposition=implemented。
• owned-writer-barrier：Controlledsamehost/userDockercapturepreservesforeignpauseandcommittedWAL 当前 disposition=implemented。
• original-activation-recovery：Sameoriginalnativeactivation/deadlineafterlostreply withoutrefill 当前 disposition=implemented。
• M3：Fullmatchedresearchbranch/continuation/adoption utility 当前 disposition=deferred。
• 13.12：Jointsamepointcompletequalification/feedback/fullcost 当前 disposition=deferred。

复用既有 typed checkpoint/replan/session/backup owner，Docker、native Host 和 evaluator 保持专门 transport。 当前原生中断资格仍缺失；控制器前置切片可独立评审，完整安装态研究与 M3 验收保持开放。 这是 完整研究接续的可回滚开发者控制器前置切片；不把全 M3、安装采用或科学收益变为此切片的额外门。 捕获本身不触发科研策略、更大 scope 或研究实验。

具体改动

完整51路径 +9367/-75，以真实3dd fork为准。41个已独立读过的 owned blob 未变；当前10个变化路径、29,992字符差异全文核验。旧67f到新head的原始72路径差异含进入主干的其他变化，已从本 PR 的 owned delta 中排除。新增公共讨论均已全文读；旧17 comments、17 reviews和10 inline正文逐字复用，上一轮自己的全文评审也重新读过，没有继承旧 verdict。

• checkpointArtifacts(select_replan) 允许原 committed/replayed guard 尚待选择工作时捕获：精确核对Goal、已注册Agent、Turn、事件和语义义务，仍返回 execution_authority_granted=false。已绑定 guard 保留原 causal settlement 验证。真实 CLI 的 pending/bound、捕获失败、原点不再捕获、选择前 delivery 禁令及错误身份反例通过。
• CheckpointSupervisor 只接受Host绑定的原注册/container，冻结准备文件与deadline在评测封存前核对；拥有的屏障释放且源继续后才原子回信。capture_worker 保留foreign409 pause、跨controller bank锁、权限和SQLite committed WAL；不把凭证或旧执行权交给 solver。
• CheckpointWake._capture 保留原 packet/session/deadline 和原尝试；admit_native_checkpoint_session 通过既有Goal/session owner取得新权限，原会话 fork/绑定丢失响应只恢复同一次尝试。
• resolve_heartbeat_capture_root 收拢已有transport校验。相同AST collector：base89 statements/59 decisions，旧head94/61，当前89/59；原90/60限额未改。joint receiver 的动态读取变量明确为submission token，公开边界扫描通过，未删除权限或隐私检查。

当前独立验证：八个完整 native/controller/worker/handoff/resume/capture 模块 161 passed、4 skipped，447.25s；上述native正例另三次均失败。正确二进制变量下完整native resume另 17 passed，10.06s，与八模块覆盖有重叠；TS artifact12项和两个完整decision-capture模块24项通过。实际native CLI、Docker、HTTP、SQLite执行；模型推理及评分明确合成，没有实际实验作业。

四个skip为附加controller的completed-source、附加controller的midwake、原先未设置另一resume变量、以及新鲜隔离joint point。resume已单独补跑；其余三项本 reviewer 未执行。作者新Linux completed-source及两个receiver证据已读，按作者证据保留：sealed cooldown长于窗口时429且不调用grader／消耗轮次，eligible的interrupted点取得下一grade。测试oracle更正、初始配置问题及四项sandbox失败也保留；不宣称它们是本次独立通过或完整科研接续效用。

对主干的风险

默认关闭保持：移除checkpoint request关闭捕获；native_session、loopx_state、evaluation_opportunity、controller_handoff均需明确声明，Host私有controller权限和新目标admission独立。当前实际off-worker和decision-capture验证通过；前述五组完整heartbeat/error、九组backup和相关typed proof仅按具体owner/caller/dependency未变范围复用，不当作当前整个安装包结论。

通用quota/settlement/身份仍由typed owner决定，selector不是新的调度／权限决策。原work-selection是机器义务，惰性捕获不把它变成guidance。新分支复用既有status/identity词汇，本地provider元数据不冒充共享actor生命周期。公开英中说明保留激活、关闭、合成／安装边界和历史authority禁令。

当前canary 5 direct、19 selected必需检查全部通过，1项benchmark maintainer hold保留；Ruff、TypeScript、diff、公开边界及开发期advisory后全树semantic检查通过。advisory无支持的新coinage，不能覆盖动态语义；全树45处producer unresolved仍是限定。初次错误模块名和旧semantic命令拒绝属于已纠正的review harness错误，未计产品失败。未来维护pass已应用到既有capture-root owner，无新框架或限额放宽；没有查询／等待CI、合并、撤他人评审、付费模型或实验启动。

我的整体评价

REQUEST_CHANGES。pending-selection和维护预算／公开扫描修复有当前实证；剩余阻塞是声明支持的实际native中断捕获资格。保留作者Linux机械增量及所有通过／失败／未执行的区别，修复或明确限定该profile后对新exact head复核；完整安装、打包恢复、实验输入和科学效用继续按原验收，不增加无关阶段门。

English verdict: REQUEST_CHANGES — 6458777a32bafff2bac02b24b77103ddb53f2bdf. Three independent actual-worker native-capture repetitions fail at the original pending-guard cursor, despite one passing full-family run; source work and exactly-once settlement survive. Pending-selection admission, the capture-root refactor, 161 passing full-family cases, separately qualified real resume and required risk checks are preserved. The external Linux completed/joint fixtures remain author evidence, and installed/scientific acceptance remains open.

[loopx-agent]

修复已推送至 f547e212f6a1ee909f5b79a95454416e97bc5e26，基于最新 main (3300dfdd2)，PR 仍为普通 open PR，未合并。

回应最新 exact-head 评审的 native interruption blocker：实际 Darwin Codex 0.162.0-alpha.17.2 中断后，完整历史只有 user item，没有所需的 pending command。原用例再现失败；连续延迟重读及仅向 leader 发 SIGINT 都未修复。现在该 provider profile 在第一次 mid-wake native capture 发信号前明确拒绝，记录一次 missed point，放行原工具结果；不会把缺失 cursor 当成有效点。重复义务不补拍。Linux interrupted 正例与 completed-wake 捕获保持独立；没有放宽输出、后续条目、歧义 guard、source/digest 或期限检查。

当前验证与边界：

• 实际 Mac worker 的显式拒绝、checkpoint-off、file-only 及 interruption/去重边界共 8 passed；原 guard 只有一次 receipt，源工作继续，无伪造 aborted 响应。
• 实际 Linux interrupted worker 1 passed。本地 deterministic Responses 替代推理，使用真正 native CLI、工具执行与原 quota owner。
• 当前 main-based head 的 stride + Explore planning 联合用例 1 passed：六个真实 native 工作 wake 各自结算，自然触发周期复盘，模型决策前由 SQLite/Docker/native controller 封存；然后记录独立三个轴的 grow，下一 wake 完成较大的合成工作切片。旧的注入历史 fixture 被这条真实 cadence 替代。此前同 owned source 的 Explore off/on 两例及接收端也通过，未把旧结果冒称新 head 独立执行。
• 当前 head 的全新隔离 receiver 1 passed：读取封存 candidate/context，在新身份与 lease 下工作，保留原 phase 和未到期冷却；原生 429、不消费轮次、不调用 grader。fixture 不再写死原候选文本，也不把 429 记成已经评分。
• 完整聚焦模块 78 passed / 11 explicit-environment skips；相关实际 native 路径另列在上文，不把 skip 算通过。Ruff、diff 与公开边界通过，advisory 后全树 semantic 检查通过（动态语义及既有 unresolved producers 的限制保留）。premerge 无必需失败，保留 benchmark-sensitive maintainer-review hold。

归属与后续：修复只在既有 native transport/CheckpointWake 与耐久测试中，不新增共享决策词汇、Python 策略 owner 或超时预算。默认关闭路径保持；公开 README/RFC 已说明支持范围。目标 graph/vision/policy 的主动采用、安装/打包恢复与真实同点科研比较仍由原验收负责，历史 lease/quota/token 不成为目标权限。这是作者修复说明，非新的审批或完整科研效用声明；运行中的冻结源没有修改。

English: The unqualified Darwin interrupted-native profile now refuses before signalling and lets the original tool continue. Strict cursor checks remain intact. Real Linux capture, natural six-work cadence with stride/Explore, larger synthetic followthrough and fresh-authority continuation pass; pending cooldown stays binding. Default-off behavior, maintainer review and installed/scientific acceptance remain separate. Please re-review this exact main-based head.

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @loopx-agent.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[loopx-agent]

Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; reasoning_effort=xhigh.

Request changes conclusion (author-owned PR; GitHub blocks formal self-review)

Exact head: f547e212f6a1ee909f5b79a95454416e97bc5e26. REQUEST_CHANGES — 一项 P2：Darwin 的 full 请求测试仍采用旧中断规则。

动机

受影响的是需要保存代码、研究证据、原生会话位置和已消费评测机会，并在新的受控环境接续工作的维护者。此前只保存代码或会话文本，无法证明恢复的是同一个研究点；本切片把这些参与方绑定到同一封存点，复用原恢复和准入 owner。当前 Darwin 中断路径则在发信号前明确拒绝，原工具继续返回真实结果。当前已验证文件捕获、原工作接续、一次 guard 记账和 Darwin 提前拒绝；完整研究效用仍未资格化。当前 full 测试仍要求旧的中断响应，稳定失败，需在原 PR 修正。本切片不认证安装态 App/Lark、实际模型决策、完整联合研究 checkpoint、matched study 或科研策略收益；不授予历史租约、quota、token、timer、合并或实验启动权。修正当前 full 请求的 Darwin 拒绝测试，并保留原会话继续、一次 receipt、无伪造 aborted 响应和无 checkpoint 的断言；完整安装源、profile、研究接续和效用继续由原验收 owner 负责。

改动思路

复用 TypeScript 文件/SQLite snapshot、canonical context、quota/session/evaluator 的原 owner；Python 只适配 native/Docker/Unix 传输。当前 profile 拒绝保持在 provider 边界，测试应复用请求中的 native_session 判定，避免维护第二套 profile 分类。可回滚的开发者捕获/接续前置切片；不把完整 M3、安装采用或科学收益变为本切片的额外门。 做一个文件归档或复制会话文本仍不能证明原生研究接续。当前显式捕获/校验/恢复控制器有真实调用路径，但结果不能被放大为完整研究效用。此次 Darwin 修复采用合理的最小边界：不支持的中断先拒绝，而不是放宽历史 cursor、source、期限或伪造 aborted 输出。旧 head 的原生中断不稳定问题已通过这个明确拒绝边界处理。

具体改动

依据 docs/architecture/rfcs/hierarchical-agent-stride-control-v0.md 改动前版本 3300dfdd29fe6e53e1aa4a0282ca3952db6e9e8f 的 §7.7、§11、M3：declared-integrity、fresh-authority、host-qualified-cursor implemented；M3 deferred，完整研究接续和 matched 效用继续由原验收 owner 负责。前三个标签只标记原文要求。新 §13.12 和 fixture 说明是拟议资格计划，不作为改写后自证的验收规范。

51 文件 +9538/-75。45 个 owned blob 与已独立阅读的 6458777a32bafff2bac02b24b77103ddb53f2bdf 相同；6 个当前变化文件和 33082 字符 delta 完整阅读。仅在 owner/依赖未变的边界资格化旧证据，当前 verdict 独立重判。当前源修复包括提前拒绝 Darwin、完成 wake 后的接续 fixture、实际 captured candidate receiver、英中 profile 说明；其余参与方、typed admission、原生历史和原机会 owner 保持。

关键代码讲解

• CheckpointWake._first_replan L64 先锁定原 first attempt；L69 对所有 native_session Darwin 请求，在信号前记录 captured=false 和 Host 资格缺口。原工具真实结果和源工作继续；不会晚一点重捕有利位置。完成 wake 的捕获另行处理。
• _capture L82 保留原窗口、guard/source digest、typed participant 和 native history 的校验；full-state 仍要求 controller writer barrier。artifact 仅供验证，不能成为历史权限。
• capture_worker L149 的 foreign pause 409 拒绝、daemon/container lock 所有权与原 source witness 修复保持；历史 inline 的 retargeted commit 标记不证明当前仍有缺陷。
• controller main L347 继续区分 capture/verify/restore 和新的 native admission。Python 是 native/Docker/Unix provider，既有 TS backup、quota、session、evaluator 是权威；不引入第二套研究授权或 opportunity 计数。

[P2] full 的 Darwin 拒绝测试漏分支

test_native_checkpoint_handoff.py L689 仅让 capture == "native" 进入新拒绝断言；同文件请求生成处也为 full 和 controller 设置 native_session=true。因此 Darwin 上 full 实际正确地不中断，却在 L703 要求 heartbeat_receipt，随后仍要求伪造的 aborted 工具输出。

这是当前引入的耐久测试回归，不是要求恢复不安全的中断。相同已安装 Codex 0.162.0-alpha.17.2、相同原 full 用例：旧 6458777a32bafff2bac02b24b77103ddb53f2bdf 1 passed /9.13s；当前正确源环境执行 1 failed /18 passed /66.31s，full 稳定失败；首次八模块也失败于同一 L703。私有反例仅把拒绝条件改为读取实际请求的 native_session，保留已有源继续、一次 receipt、无 aborted、无 artifact 断言，得到 1 passed /9.40s。该反例未改 PR 源码，也不替代耐久修复。

最小修复：让测试从已声明请求判断 native profile，或明确覆盖所有 native 变体；保留上述负例并重跑 full。源 checkout 的 benchmark 子进程需有相应 PYTHONPATH：

PYTHONPATH="$PWD" LOOPX_NATIVE_CHECKPOINT_BIN="$(command -v codex)" uv run --extra test python -m pytest 'benchmark/tests/test_native_checkpoint_handoff.py::test_actual_worker_handles_midwake_replan_and_duplicate_without_guard_replay[full]' -q

对主干的风险

最强反例是复制历史权限、改变 first point、重填机会，或在未资格化 Host 上破坏原工具结果；当前严格原 identity/source/deadline、foreign pause 和 Darwin 不中断边界保留。局部机械成功不能认证实际模型采用或研究收益。修正当前 full 请求的 Darwin 拒绝测试，并保留原会话继续、一次 receipt、无伪造 aborted 响应和无 checkpoint 的断言；完整安装源、profile、研究接续和效用继续由原验收 owner 负责。

语义与 CI 对齐

• 当前八个完整 native/controller/worker/handoff/joint/canonical capture/adoption 模块：5 failed /123 passed /29 skipped，295.79s。4 个失败是本次 reviewer 子进程缺少 benchmark 源 PYTHONPATH 的环境错误；纠正后重跑相应原生模块及 full 得到 1 failed /18 passed，剩余失败如上述 P2。29 个环境/外部 opt-in skip 保持未验，不能算通过。首轮失败保留。
• 原生 canary 5 direct /19 selected：18 selected 通过，1 个 CLI 字符/行预算最初失败，另有 benchmark maintainer hold。该预算默认用了已变为 compact JSON 的最新 main，而本分支实际 fork 为 3300dfdd29fe6e53e1aa4a0282ca3952db6e9e8f；相同 workload 使用不可变实际 fork 作为两侧基线后通过。没有修改限额、删 fixture 或缩小 workload，原失败和独立归因保留；它不是本 PR 的输出语义回归。
• Ruff、diff、开发期 advisory 后全树 semantic、公私扫描通过；advisory 未检测到 supported coinage 不证明不存在语义变化。全树仍有 45 个 unresolved producer sites 和 20/21 cross-runtime unverified 的原有限制。default-off 原 worker 用例本次通过，原 quota/heartbeat 的未变 owner 只沿用其确切已验证边界。
• 完成 native/联合 receiver 的作者 Mac/Linux/Explore receipts 是作者证据；未变 blob 的旧 local receipts 是资格化证据；均不伪装为本次所有 profile 都已运行。使用实际 native CLI 和本地确定性 HTTP model fixture，未运行付费推理、实际研究实验或改动活动 Goal。未查询、轮询或等待 GitHub CI。

我的整体评价

REQUEST_CHANGES，绑定 f547e212f6a1ee909f5b79a95454416e97bc5e26。运行时 Darwin profile 修复有效，旧原生中断 blocker 不再沿用。当前 full 的耐久验证仍为红，需要原 PR 补上这个最小测试修复。相关简化 pass：原 capture-root resolver 的 owner 收敛已保留；当前测试从请求字段复用 profile 分类是合适的 bounded companion，不必扩大为通用框架或语言迁移。可回滚的开发者捕获/接续前置切片；不把完整 M3、安装采用或科学收益变为本切片的额外门。修正当前 full 请求的 Darwin 拒绝测试，并保留原会话继续、一次 receipt、无伪造 aborted 响应和无 checkpoint 的断言；完整安装源、profile、研究接续和效用继续由原验收 owner 负责。 前端/Lark 安装旅程、完整联合研究效用保持 partial；benchmark maintainer hold 和合并授权各自独立。

English verdict: REQUEST_CHANGES — f547e212f6a1ee909f5b79a95454416e97bc5e26. The explicit Darwin pre-interruption refusal resolves the prior native capture qualification blocker while preserving original work. One new durable test regression remains: the full request also sets native_session, but the Darwin test branch only recognizes native and still expects the obsolete interrupted response. The unchanged full oracle passes on the previous head, fails on this head, and passes with a private request-derived refusal condition. Retain the no-abort, original-continuation, once-only receipt and no-artifact assertions. Mechanical/source-qualified results do not establish installed or scientific M3 utility. Remote CI was not consulted; merge authority is separate.

[loopx-agent]

[P2] Cover the full request in the Darwin refusal oracle. 当前 full 请求同样设置 native_session=true，运行时 L69 已在 Darwin 上提前拒绝并让原工具继续，但这里只为 capture==native 使用新拒绝断言；full 会落到 L703 的旧 heartbeat_receipt/aborted 预期。相同原 full 用例在旧6458777通过，在当前f547两次失败；仅把条件改为从请求读取 native_session 后，原有源继续、一次 receipt、无伪造 aborted 和无 artifact 断言全部通过。请让测试复用请求的 profile 分类或覆盖全部 native 变体，并保留这些负例；不要恢复不安全的 Darwin 中断。

[loopx-agent]

已在 5eb9baa 修复。拒绝断言现在读取请求的 native_session 分类，所以 Darwin 的 native、full 及其他启用原生会话的请求共享同一个负例；保留源继续、同义务一次 receipt、原始工具结果交付、无伪造 aborted、无 checkpoint 的检查。运行时的 Darwin 提前拒绝没有修改。

独立复现原 full 用例在旧 f547 的 heartbeat_receipt 断言失败；修复后实际 Darwin native CLI 的 files/native/full/off 四例全部通过（4 passed，24.19s），推理由本地 deterministic Responses 提供。另有当前 main 接缝的 CLI、Todo actor/metadata 和 registry inventory 共96 passed；Ruff、diff 检查和语义 advisory 通过。不存在新的共享决策词汇。

已按当前 owning census 保留 main 对旧生成清单的删除，并签名合入 main19c725e；PR仍以 main 为 base，远端 exact head 已读回为 MERGEABLE。保持原有科研接续/采用和独立评审验收；没有合并本PR或改动已启动的冻结运行。相关整理只复用请求本身的分类，未新增平行 profile 表或辅助框架。

English: Fixed the refusal oracle to use the request's native-session flag, covering full requests while preserving source continuation, deduplication and no-abort/no-artifact assertions. The original real-Darwin case fails before the fix; all four profile cases pass afterward. Current-main focused seams pass96 tests. Runtime behavior is unchanged by this correction; the main-based PR is conflict-free and still awaits review.

[loopx-agent]

Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; reasoning_effort=xhigh.

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

Exact head: 5eb9baa5cb77afcb873e9aebcd8911c5880d982c. APPROVE — 原 full 测试 P2 已修复。

动机

受影响的是需要保存代码、研究证据、原生会话位置和已消费评测机会，并在新的受控环境接续工作的维护者。此前单独保存代码或会话文本，不能证明恢复同一个研究点；本切片把代码、会话位置、canonical 研究证据和原评测机会绑定到同一封存点，复用原恢复/准入 owner。Darwin 不支持的中断在信号前明确拒绝，原工具继续返回真实结果。当前 native worker、File/SQLite 捕获/采用和原 source 接续验证通过；full 也按 native_session 进入 Darwin 拒绝断言，原 P2 消除。完成态联合 controller、Linux 中断和科学效用并未由这些本地通过资格化。本切片不认证安装态 App/Lark、实际模型决策、完整联合研究 checkpoint、matched study 或科研策略收益；不授予历史租约、quota、token、timer、合并或实验启动权。完整安装源、profile、联合 writer/evaluator 研究接续、模型采用及 matched 科学效用，继续由原 §7.7/M3 验收 owner 负责；29 个环境/外部 supervisor/receiver opt-in skip 保留未验。

改动思路

复用现有 TypeScript snapshot、canonical context 与原 quota/session/evaluator owner；Python 仅适配 native/Docker/Unix transport。当前测试复用请求中的 native_session 判定，删除 native-only 的平行分类。本切片交付显式开发者捕获/接续前置路径及严格原点/权限约束；完整安装旅程和研究效用保持开放，不增加无关 M3 完工门。 文件归档或复制对话仍不足以证明原生研究接续。当前有实际 worker/controller 的可执行前置路径，复用原 source/restore/evaluator 规则，不把验证 artifact 改成历史权限。Darwin 已在信号前报告不支持的中断，完成 wake 的捕获另行处理；保持 source/history/cursor/deadline 严格。当前一行测试修复直接解决 profile 漏分类，不恢复 unsafe interruption。

具体改动

规范依据 docs/architecture/rfcs/hierarchical-agent-stride-control-v0.md 改动前版本 19c725e3fbf587b0d857863cd319e08ad0efe70c 的 §7.7、§11、M3。declared-integrity、fresh-authority、host-qualified-cursor implemented；M3 deferred，原联合研究/安装/效用验收保持。前三个标签标记原文要求，不新增 roadmap gate；head §13.12 是拟议资格说明，不是改写规范后自证。

实际最新 main fork 19c725e3fbf587b0d857863cd319e08ad0efe70c 的完整 proposal 为 50 文件 +9537/-74。49 个 owned blob 与已独立阅读的 f547e212f6a1ee909f5b79a95454416e97bc5e26 完全相同，一处当前条件 diff 完整读。较早 packet 的 base14112/58 文件包含现已在 main 的 8 个 Todo actor 路径；Git merge-base 和 blob 比较区分了它们，未把主干合入当新 benchmark 设计。主干 actor/compactJSON 等依赖变化由当前实际 CLI/typed 集合重新集成验证；旧 verdict 不沿用。

关键代码讲解

• CheckpointWake._first_replan L64 锁定原 first attempt；Darwin 请求 native_session 时，信号前记录 Host 缺口，原工具真实结果继续返回，不能换晚一点的封存位置。
• _capture L82 保留原窗口、guard/source digest、typed participant 与 native history，full-state 仍要求 controller writer barrier。历史 unit 不赋予执行权或重填机会。
• capture_worker L149 保持 foreign pause 409 拒绝、daemon/container lock 所有权和原 source witness；controller L347 保持 capture/verify/restore 与 fresh native admission 的分工。既有 TS snapshot、quota、session、evaluator 是权威，Python 只负责专业传输。
• full profile oracle L689 现在读取实际请求的 native_session，涵盖 full/controller，与 runtime 使用同一分类。原 source continue、一次 receipt、无伪造 aborted、无 artifact 断言全部保留。没有降低标准来把失败变绿。

对主干的风险

最强反例是历史 grant/反馈机会被重放、封存 first point 被替换，或未资格化 Host 破坏原工具。当前仍严格拒绝错误身份/source/cursor/窗口与 foreign pause，并维持 default-off。完整研究资格仍不能由机械通过或文件 opening 推导。完整安装源、profile、联合 writer/evaluator 研究接续、模型采用及 matched 科学效用，继续由原 §7.7/M3 验收 owner 负责；29 个环境/外部 supervisor/receiver opt-in skip 保留未验。

当前八个完整 native/controller/worker/handoff/joint/FileSQLite capture/adoption 模块：128 passed /29 skipped，270.00s，包括原 full 用例。把当前测试仅退回旧 capture == native 条件，实际同 head、同 CLI、同 source 的 full 反例重新在 L703 失败，6.99s；所有生产代码与其它断言未改。这个反例把修复因果从更新 main 的其它变化中隔离出来。原 f547 的失败记录保留，没有删失败历史。当前额外 12 个 TS artifact、0 skip 和 20 个完整 decision-capture /8.58s 通过，覆盖 committed WAL、wrong source/actor、原点窗口及 pending semantic guard 不虚构 authority。

语义与 CI 对齐

canary 5 direct /19 selected，0 failure，1 benchmark maintainer hold；budget 使用实际不可变 fork19c 的同 workload，当前 compactJSON 归属保持，未改 limit、root 或 fixture population。Ruff、diff、advisory 后全 semantic、全 owned public boundary 通过；45 unresolved producer、20/21 cross-runtime 未验限制仍在，advisory 的零 supported coinage 不证明所有语义。

29 个环境/外部 supervisor/receiver opt-in skip 保留未验；未变 owner 的历史 local/Docker evidence 和作者 Linux、完成态联合 receiver、Explore receipts 仅在明确 source 边界资格化，不冒充本轮运行。实际已安装 Codex0.162.0-alpha.17.2、确定性本地 HTTP model 和合成 File/SQLite fixture用于当前入口；未调用付费模型、实际研究实验、活动 Goal 或历史权限。未查询、轮询或等待 GitHub CI。App/Lark 安装态、全 writer 联合 barrier、真实模型采用和 matched 科学效用都保持 partial。

我的整体评价

APPROVE，绑定 5eb9baa5cb77afcb873e9aebcd8911c5880d982c。原 Darwin runtime 问题已明确拒绝，原 full 的 durable test P2 在当前代码与同 head 反例中解决。当前 bounded companion 做到了请求分类复用，原 capture-root resolver 的 owner 收敛也保留；不需额外通用框架或语言迁移。本切片交付显式开发者捕获/接续前置路径及严格原点/权限约束；完整安装旅程和研究效用保持开放，不增加无关 M3 完工门。完整安装源、profile、联合 writer/evaluator 研究接续、模型采用及 matched 科学效用，继续由原 §7.7/M3 验收 owner 负责；29 个环境/外部 supervisor/receiver opt-in skip 保留未验。 benchmark manual hold、exact-head merge readiness 与维护者授权各自独立，批准不授 merge/bypass。

历史 f547 的 COMMENTED REQUEST_CHANGES 已补齐规范回退标题，并用原生结论解析器验证为该旧 head 的有效阻塞结论；这只是修复原评审格式，不把旧评审改绑或沿用到本 head。

English verdict: APPROVE — 5eb9baa5cb77afcb873e9aebcd8911c5880d982c. The full Darwin oracle now derives its profile from the actual native_session request, preserving original continuation, once-only receipt, no fabricated abort and no artifact. All128 current integrated tests pass with29 explicit external/environment skips; reverting only that condition reproduces the same L703 failure. Twelve typed artifact and20 decision-capture tests and all risk-based checks pass. Complete installed/joint research/M3 utility remains unqualified; the benchmark manual hold and merge authority are separate.