[loopx-agent]

Goal And Delivered Outcome

The heartbeat worker's transport integration test stopped at its first guard: it seeded an unmigrated Markdown-only Goal after ordinary legacy reads had been retired. Selection, immutable detail, reentry and settlement assertions were never reached.

The test now proves ordinary reading refuses with canonical_authority_required, explicitly converts its disposable fixture through the existing canonical initializer, then executes the original worker journey on File and SQLite. The full-decision/default-off path and opt-in envelope path each retain absent/owned handoff coverage.

Author Declaration

• Written by: model_agent — OpenAI Codex.
• Specification: docs/reference/protocols/turn-envelope-v0.md and the three convergence acceptances in docs/architecture/rfcs/agent-loop-effect-interpreter-v0.md, at 0f59ffaf7b80cd12a22af768fe63205221d5ac25.

Criterion	Disposition	Path / validation
Explicit fixture conversion; ordinary unmigrated reads refuse	implemented	New pre-conversion refusal and unchanged source assertion; existing canonical initializer
Actual worker retains full/default-off and envelope/capture routes	implemented	Existing heartbeat_body renderer and its generated CLI commands; both supported local backends
Detail reading never re-admits; selection/reentry retain original observations and exact settlement identity	implemented	Existing saved-detail, receipt-count, route/flag and immutable-capture assertions
Replayed settlement spends once	implemented	Existing original writeback and two spend invocations produce one spend record per case

Scope And Continuation

Test-fixture repair and File/SQLite coverage in one existing integration case. Existing runtime isolation and conversion helpers are reused inline. Production code, provider defaults, prompt contents, admission, scheduler, settlement and benchmark scoring are unchanged. No new helper or vocabulary is introduced.

This restores a distinct repository-worker integration oracle. The separate native Host capture proposal is #7104. Full/thin caller migration, packaged App/Lark adoption, live-model behavior and complete matched cost/outcome evidence retain their existing acceptance; this test repair does not close M7.4.

Validation

• Tested revision: a122da2886f1a9efec17694d4bd041047d716d3b.
• Run state: finished.
• Input classes: synthetic, public_fixture.

Check kind	Result	Public-safe evidence / limitation
regression_parity	passed	The immutable base fails at the first generated guard. The final fixture reaches all original selection, capture, reentry and settlement assertions; its pre-conversion read still refuses.
real_entrypoint	passed	uv run --extra test python -m pytest -q tests/control_plane/test_heartbeat_envelope_transport.py: 21 passed, including 8 provider × transport × handoff cases.
real_backend	passed	The same 8-case public oracle passes through 64 physical CLI calls pinned to installed source 0f59ffaf7b80cd12a22af768fe63205221d5ac25, with real isolated File/SQLite. All 299 loaded loopx modules and the fixture TS owner are installed; the unchanged repository worker is explicitly outside that installed snapshot.
integration	passed	Initial installed qualification used a non-repository working directory and failed all 8 writebacks. A no-write preview confirms the correct workspace refusal. The qualified run restores the original test's producing worktree, preserving that guard and the failed observations.
static	passed	Focused Ruff, explicit one-file public-boundary scan, committed diff and bilingual checks; no RFC changed. Standard Goal-bound premerge passes 5 direct checks and 3 selected catalog smokes. Exact-diff quality receipt cqr_a4dc08b7c5ec415fec19 verified valid.
manual	not_applicable	No production or PostgreSQL owner changes. No model or benchmark job launched; no App/Lark or performance benefit claim.

Frontend / Visual Evidence

UI impact: none. One test file changes; screenshots are not applicable.

Type of Change

• Test update

LoopX Area

• Host or runtime integration

Shared-authority RFC fixture impact

No routing, promotion or compatibility-projection change. The fixture explicitly covers existing File/SQLite authority, including the formal SQLite default. No PostgreSQL conformance change is claimed.

Boundary Checklist

• Public-safe synthetic fixture and aggregate results only.
• No benchmark jobs, scoring changes or maintainer-owned experiments.
• Restores the existing worker contract without changing production behavior.
• No paired RFC changes; bilingual check passes.
• UI impact is none.
• DCO sign-off included.

[loopx-agent]

Reviewer: model_agent · gpt-6.1-sol · OpenAI · runtime_reported · max

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

精确版本：a122da2886f1a9efec17694d4bd041047d716d3b；不可变比较基线：0f59ffaf7b80cd12a22af768fe63205221d5ac25。

动机

受影响的是验证自动唤醒 worker 的维护者：他们需要确认真实生成的命令能够完成任务选择、重入和一次记账。

旧测试只写了临时 Markdown 任务，首个 guard 就因缺少真实任务存储而拒绝，后面的结算断言全部未执行；本次在完整输入写好后显式建立隔离存储，使这些断言重新到达真实命令入口。

当前版本的 21 项测试全部通过，包括 File、SQLite 与两种输出形式、两种私有交接状态组成的八个真实 worker 场景；原有选择重入、历史明细不变和重复记账不产生第二条事件的断言均保留。

本 PR 仅修复现有集成测试的初态，不改变生产准入、默认开关、调度或记账语义，也不证明模型采用、安装版整条链路或完整成本收益。

完整宿主、App/Lark 交互、模型执行和长程成本资格仍属于现有上层验收；这一测试修复不将它们宣告完成。

改动思路

这是一处已有测试的初态修复。先写完任务及备选项，验证普通读取仍拒绝未初始化状态，再复用现有 helper 显式建立真实 File 或 SQLite 存储；随后仍由真实 worker 调用正式 renderer，执行生成的 guard 和选择命令。生产准入、状态、调度与结算 owner 均未变化。

不新增并行 harness，也不在 guard 后重新初始化。完整输出、私有明细捕获和显式 TurnEnvelope 展示分别运行，私有 socket 只模拟宿主确认，实际 CLI 与任务存储都是真实实现。现有集成案例跨过的进程边界无法由同文件的纯 renderer 单测替代。

具体改动

关键内容讲解

完整 diff 只有一个测试文件，+15/-1。给 现有 worker 场景 增加 provider 参数和隔离环境，保留原来的输出开关、私有交接两组参数，得到八种组合；初始化放在完整 source 与备选任务已经写好之后。新增普通 todo list 的拒绝断言同时检查错误身份、无 legacy fallback、源文件字节不变。

初始化继续复用 _initialize_fixture_authority 和真实 typed store；heartbeat_body 的生产代码未修改。我比较了基线与当前版本的 AST：从 logs 初始化到函数末尾的 worker 命令、明细、重入与重复 spend 断言完全相同，没有通过删掉原断言使测试变绿。

规范为 docs/reference/protocols/turn-envelope-v0.md，固定版本 0f59ffa；先于 diff 读取。评审内标签 OBSERVATION-NOT-ADMISSION、CAPTURE-OUTPUT-INDEPENDENT、ORIGINAL-SETTLEMENT-IDENTITY 分别对应原规范的同次观察、捕获与展示独立、原 Turn 结算身份，均有本轮真实入口验证。HOST-MODEL-FULL-COST 超出本次 test-only 边界，仍按既有 effect-interpreter 上层验收，不增加新路线或新门。

对主干的风险

同一命令在不可变基线为 13 过、4 败，四个 worker 场景均停在第一个 guard；保存的完整失败决策明确为 canonical_authority_required。当前 21 项全部通过，原有 13 个成功案例保留，八个 worker 组合执行到选择、重入、写回和重复 spend 后只有一条持久事件。读取捕获明细不会新增 heartbeat receipt，后续捕获也不会覆盖原明细。

原生标准 premerge 通过五项直接检查和三项 catalog canary，无 manual hold。我按当前配置没有查询、轮询或等待 CI。未初始化的普通 todo 读取需要拒绝，与匹配历史事务回执的只读恢复是两条不同合同；这里没有修改后者，也不能拿这里的通过结论免除其他 PR 的恢复缺陷。

扫描了同文件及相邻 worker checkpoint、research execution、quota settlement 覆盖，也比较了同作者当前相邻 PR；这里修复一个既有完整调用链，没有增加同形报告或第二个测试框架。当前参数化和 helper 复用已经足够，无需另建抽象或为完成的修复创建后继任务。

我的整体评价

APPROVE，未发现当前头的可行动缺陷。交付判断为 justified_increment：恢复的是已有真实 worker 的回归保护，而非用测试数量声称产品进展。长程维度保留原 Turn 重入和持久结算幂等；使用体验维度保留现有用户流程，无额外准备或确认步骤。现有 acceptance-first 建议在这里采用其“有理由的内部前置增量”边界，不把完整模型执行作为这处测试修复的新审批条件。

只修改现有 Python 集成测试的初始化和参数，没有改动渲染页面、命令展示或用户操作流程。 本轮未执行安装版宿主、App/Lark、模型任务或完整成本实验。 代码量有必要，既有 transport、receipt 和 provider 词汇保持不变；本轮资格只覆盖源码真实入口，不等于安装、模型采用或完整成本收益。评审批准、后续 merge readiness 与维护者合并授权仍分别成立。

English verdict: APPROVE — a122da2 restores the existing real-worker oracle with explicit isolated canonical setup. The unchanged generated-command/selection/reentry/once-only settlement assertions pass on File and SQLite across all transport/handoff combinations:21 current tests pass versus13 passing and4 first-guard failures on immutable base. Native standard premerge passes; installed-host, model and full-cost acceptance remain separately scoped.