[loopx-agent]

Problem and result

Native checkpoint admission constructs a CodexAgentSession while holding the registry binding transaction. Session construction captures current host launch authority through that same non-reentrant registry lock, so both initial admission and an exact retry can time out against the caller’s own lock.

Construct the session before acquiring the binding fence. Keep the current Goal and registered Agent checks, original Goal comparison, source/profile verification, session readback and atomic binding inside their existing owners. No task, lease, model turn or evaluator opportunity is granted by admission.

Validation

• The same four-case fixture fails on the baseline with lock-acquisition timeouts and passes at this head. It exercises initial admission, replay and a destination-configuration change in both paths using the real registry and session owners.
• Standard premerge: diff checks, bilingual check, changed Python compilation and all six selected canaries passed. Overall status remains manual_review_required because the changed checkpoint/test paths are benchmark-sensitive.
• Codex 0.162.1 Linux: seven real native worker-profile variants passed, including resume, configuration/profile rejection and reply-loss recovery. Restricted sandbox runs retain helper-path refusal, VM bwrap EPERM and one fork-timeout observation. A separate joint-provider fixture fails before admission because its result polling omits the current provider token; that experiment-compatibility gap remains open.
• Ruff and diff-scoped semantic advisory passed; the focused public-boundary scan is clean. The global diagnostic additionally reports unrelated legacy Goal authority errors; those are not represented as passed.

Scope and delivery

This is a bounded repair in the existing native checkpoint provider. The regression test excludes inference and native storage so registry-lock behavior is exercised without an optional native binary; the existing native suite supplies end-to-end coverage. No scoring, submission policy, configuration default or stored protocol changes. Main merge remains a maintainer action; experiment adoption requires the remaining native qualification and exact-head review.

Exact-head self-review: #7126 (review) (COMMENTED approval conclusion; no main-merge authority).

Additional composed-source validation: the joint native restore/continued-grading case passes with Codex 0.162.1 and the current external provider after the private synthetic client supplies its own token to the result endpoint. The original public test assertions are retained. This uses the existing isolated benchmark worker execution profile; it does not erase the restricted-sandbox failures or qualify every sandbox.

[loopx-agent]

Reviewer: model_agent; gpt-6-astra; OpenAI; runtime_reported; xhigh

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

本次自评审针对 2d47d037ba6b4722cdcb81309003ce526a7bbc67，未发现阻塞本次锁顺序修复的问题。合成研究继续、当前 provider 的联合评测资格和 main 合并权限分别判断，不能用本结论代替。

动机

使用原生 checkpoint 恢复既有研究的操作者。
恢复已捕获会话时，原实现持有注册表锁后再次申请同一把锁，首次接入与重试都会超时；调整顺序后可以完成接入或按当前权限拒绝。
真实注册表与会话所有者下，首次绑定和重复读取完成；准备过程中 Goal 配置改变时拒绝，保留原绑定。
不改变捕获默认值、模型输入、评分、预算或评测机会，也不新增恢复权限。
新实验的接收端、资源准入和运行中效果仍须另外验收；本改动只修复会话接入。

改动思路

复用现有注册表事务和会话所有者，只调整准备顺序；不把不可重入锁改成可重入，也不取消提交前权限复核。
当前 PR 仅包含原生 checkpoint 接入的锁顺序修复及独立回归测试。

CodexAgentSession 的构造不只是读取会话：它还通过 first-party host admission 获取当前启动权限，因此会访问注册表事务。旧顺序是持锁后构造，构造器再次申请同一把不可重入锁；延长 timeout 无法解决这种等待。修复把准备阶段移出事务，随后仍在锁内重新读取 Goal、确认 Agent 注册、比较最初配置，再读回或写入会话。两处构造保留各自时点：新会话必须先完成原生 fork 和环境重建，不能为了减少重复而统一提前到函数入口。

具体改动

规范基准为 benchmark/README.md，固定版本 74651e3bec46c773f187f7eb2688962761860a12 的原生 checkpoint 接入说明。逐项检查：Registry binding fence 已实现，配置检查和绑定写入仍在注册表事务内；Exact admission retry 已实现，重试复用原会话、原来源和完整历史校验；No inherited execution authority 已实现，绑定不等于新工作准入，后续仍使用新 guard 和 lease。

关键代码讲解

1. admit_native_checkpoint_session（loopx/hosts/codex_checkpoint.py:446）：已有绑定分支先构造 session，再进入原事务校验当前 Goal 和 Agent，之后验证来源 digest、profile 和原生历史。无绑定分支先 fork、构造 session，再进入相同事务完成最终检查及 _bind_verified_fork。没有修改异常文本、返回结构、模型提示或评测接口。
2. test_checkpoint_binding_and_readback_recheck_destination（benchmark/tests/test_checkpoint_binding_lock.py:12）：四种组合覆盖首次接入/重复读取，以及准备期间 Goal 是否改变。注册表、CLI 配置和 session 构造均使用生产实现；只替换该锁回归之外的原生归档、fork 与历史读取。断言独立检查绑定内容、fork 次数和配置变化后没有覆盖原绑定，不以函数返回成功代替状态读回。

同一份测试在 integration baseline 4bba5f8e1c2a50daac5cd4103de592fd9c7d019c 四项均因锁超时失败；其 checkpoint provider blob 与 PR target base 完全一致。精确 head 用同一份外置 fixture 四项全通过。差异明确属于预期修复，没有把错误路径的变化标成字节等价。

对主干的风险

最大的反例是构造器移出事务后，目标权限已改变却仍允许绑定。四项中的两个配置竞争用例通过实际 CLI 将目标改为 monitor-only，最终均拒绝且保持原绑定；真实原生 suite 另外覆盖 Goal/profile 改变、绑定回复丢失、fork 回复丢失和缺失/歧义原生结果。没有扩大 actor 生命周期或 checkpoint 权限，没有引入新的配置、状态词汇或默认启用行为。

定向测试为 113 passed、22 optional-native/provider skipped；显式 Codex 0.162.1 Linux 实验执行配置验证为 7 passed。标准 premerge 的全部直接检查、编译、双语检查及六项 canary 通过，整体仍是 manual_review_required。CI 按当前 Goal 策略未查询。public-boundary 文件扫描通过；全局诊断另有既存 Goal authority 错误，不声称全局检查通过。

保留的限制：默认原生测试在临时目录遇到 helper alias 拒绝；移至 home 后，受限沙盒又出现 VM bwrap 网络命名空间权限失败，并有一次 fork timeout。实际 benchmark worker 使用的隔离容器执行配置下，相关七种会话路径已通过，不能据此宣称所有受限沙盒已资格化。联合 evaluator 用例在接入前的首次 submit 轮询失败：当前外部 provider 的 result 端点要求 token，而旧 fixture 使用匿名 GET。这一独立兼容缺口保留给实验集成资格核验，不属于本次锁顺序引入的失败。

语义与 CI 对齐

本改动复用既有会话、注册表和权限所有者，diff-scoped advisory 未发现新语义载体。没有改动默认 capture 开关、renderer、调度器、配额、持久格式或 provider 评分。构造器本身仍执行相同检查；变化仅是获取锁的先后顺序，以及从必然超时恢复到既有协议要求的结果。

我的整体评价

长程能力判断为 improved：原生会话恢复与精确重试能够进入后续工作，仍保留来源和拒绝路径。使用体验判断为 improved：已有接入命令恢复可用，无需额外配置或确认轮次；这不证明研究分数提升。检查了 checkpoint CLI、warm-start 接收端和会话绑定路径；没有渲染界面变化。
真实模型研究收益和非本次环境的原生沙盒资格未由此 PR 证明。

范围和代码成本相称：生产变化只是移动两处已有构造器，未把局部锁顺序问题扩张成全局锁机制改造。当前测试已保护真正的失败边界，保留一次正常恢复、精确重试、权限竞争和错误恢复的可逆验证。main 合并仍需要独立授权及 readiness；新实验还须完成联合 provider、实际接收端和资源准入。

English verdict: APPROVE — 2d47d037ba6b4722cdcb81309003ce526a7bbc67 fixes deterministic nested registry acquisition in initial checkpoint admission and replay while retaining fenced destination checks. The unchanged fixture fails on the baseline and passes at head; 113 focused tests and seven real native worker-profile variants passed. Restricted-sandbox environment failures and the separate native provider fixture authentication gap remain disclosed. This author-owned review grants no main-merge authority or experiment outcome claim.