[loopx-agent]

Summary / 摘要

The accepted subtree-delivery design (#7166) requires intact same-capture recovery before the next model request after compaction. A successful hook callback is insufficient: native Codex can spill its output, skip an untrusted handler, or continue after a recovery handler fails.

This proposal adds an opt-in, paired exec / app-server qualification against a deterministic loopback Responses provider. It inspects actual model input across full first delivery, a literal warm change and automatic compaction. The existing native checkpoint fixture now supplies the shared static provider. The app-server keyed additionalContext alternative is checked independently of hooks. The bilingual RFC records both missing boundaries and keeps phase one open.

#7166 要求在压缩后的下一条模型请求前，从同一 capture 完整恢复。此批以真实原生宿主和隔离本机静态 provider 验证两条路径：首次完整来源、温态变化、自动压缩与恢复；复用 checkpoint 的静态 provider，并更新双语检查点。

No production projection, hook installation, trust policy, default, admission or settlement behavior changes. This is the host-boundary prerequisite, not a shared diff implementation, solver adoption, installed App qualification or model-efficiency claim. The remaining integration must verify candidate completeness after host output processing and substitute full context on failure at the existing input-assembly boundary, without another owner question or disabling compaction.

本批未启用生产增量。后续仍须在宿主最终输入组装处补齐完整性核验与自动全量替换，再接共享 typed owner、benchmark solver 和产品化 Codex App；不新增问询，不禁用压缩，也不把全量 pilot 当成一期完成。

Validation / 验证

Tested native host: codex-cli 0.163.0-alpha.11.1. All inference is deterministic loopback traffic, using disposable homes and synthetic sources. No paid model, benchmark case, real Goal or installed host configuration is used.

• Native context qualification: 6 passed, 6 expected failures. Both hosts deliver the full target after successful compact recovery. Default spilling and untrusted-handler cases demonstrate missing delivery. Both hosts continue without the required source when the recovery handler exits unsuccessfully; those two failures remain explicit. Four additional cases cover both untrusted and application keyed context fragments: small inputs are lost after automatic compaction; large inputs are incomplete before the first request. A stable source key is not an intact/resident baseline.
• Shared checkpoint suites: 12 passed, 48 failed on both base and head, with the same failing test identities. Existing canonical-authority/admission failures remain unqualified; they are not reported as passed or silently skipped.
• Direct base/head native fixture parity: initial source Turn and continuation both pass with the same two Responses calls.
• Compile, diff whitespace and staged bilingual-RFC check passed. Public scan clean for all four files. The combined state checker reports unrelated unmigrated registry Goals; this is not a clean overall state-check claim.
• Semantic advisory has no changed production sources. Manual review: new case labels and literal synthetic payloads remain test-local, with no new shared vocabulary or Python decision owner.

Reproduce the native qualification explicitly:

LOOPX_NATIVE_CHECKPOINT_BIN="$(command -v codex)" uv run --extra test python -m pytest tests/control_plane/test_codex_context_boundary.py -q -ra

Scoped refactoring: extracted only the existing static loopback provider for reuse by both native fixtures. Host behavior, checkpoint source semantics and public defaults remain unchanged. Larger projection/adapter work stays within the existing phase-one acceptance.

[loopx-agent]

Reviewer: model_agent · gpt-6.1-sol · OpenAI · runtime_reported · reasoning_effort=max

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

审查版本：a47073291e73e249ed4b4905774a69c5622248f4。无阻断性发现；批准范围是这项宿主输入边界刻画，生产增量和完整回退仍未资格。

动机

实现上下文增量交付的宿主维护者需要确认：压缩后，完整来源是否真的进入下一次模型输入。此前仅看到 hook 回调或保存文件，仍可能把缺失正文当成可用基线；本批用真实宿主的实际出站请求揭示这一差别。本批交付可重复的输入边界刻画，验证正常恢复原语，并明确记录尚不安全的失败路径。本批不启用生产增量、不安装 hook、不改变信任策略，也不宣称 solver、安装态 App 或模型节省已获资格。

这项刻画的价值是阻止后续接入把“回调成功”误当“模型收到且保留完整要求”。剩余缺口是每个真实消费者最终输入组装处的完整性核验与同 capture 自动全量替换，以及共享 typed 投影、solver 与产品化 App 的实际采用。这是原方案明确要求的接缝验证，能够独立复现和撤回，没有把整期产品化拆成空壳来宣告完成。

改动思路

复用既有静态 loopback Responses provider，仅把它从 checkpoint fixture 中抽出。原生 Codex 保留实际的信任、工具调用、输出处理和自动压缩行为；provider 只提供确定性的响应及触发压缩的合成 usage。检查对象是实际发往 provider 的输入正文，而非保存文件、hook 日志或首尾标记。

正向顺序为首次完整 BASE、温态 BASE 加字面 DELTA、自动压缩移除原文、首次恢复请求中的完整 TARGET。负向分别覆盖溢写预览、未信任 handler、恢复进程失败，以及无需 hook 的键控 context。它们揭示了这个原语尚不足以承担故障安全 adapter，双语检查点保留最终输入组装处自动替换全量的原要求，也保留原信任政策、准入与结算 owner。

具体改动

规格依据为已接受的 docs/architecture/rfcs/agent-loop-effect-interpreter-v0.md，固定版本 1322536d7f7c4015afe90757b6cbddf9a5303f0c（原文）。新增检查点作为待审结论，不被用来反向定义自身验收。

关键内容讲解

• local_inference_provider 提取原有 HTTP/SSE 服务，并记录实际请求；real_native_source 保留原参数和返回的 env/session/continuation/calls 契约。基线及当前真实来源 Turn 与接续均成功，均产生两次 Responses 调用。
• test_native_hook_context_boundary 在真实 exec 与 app-server 上检查完整的 900 条字面要求、独立 stop 字段和压缩恢复。信任只限定隔离测试自建 handler，没有修改用户配置。
• test_native_additional_context_boundary 分别验证 small/large 和 untrusted/application；不把稳定 key 当成常驻、完整来源，也不把合成 usage 当实际 token 测量。
• 四文件完整差异为测试/fixture +270/-47、双语 RFC +77/-0；无生产代码、生成制品、安装或默认策略变化。

按原规格分项：complete-requirement-body implemented，完整正文以实际出站输入为 oracle；first-consumer-ordering implemented，成对原生宿主原语实测；same-capture-full-fallback deferred，失败恢复尚不能阻止缺源请求，须由既有最终输入组装 owner 接续；both-phase-one-consumers deferred，共享 typed 投影、solver 与产品化 App 仍在原一期验收中；preserve-authority implemented，本切片没有改变生产 capture、拒绝、准入、信任、scheduler 或结算。

对主干的风险

独立执行原生版本 codex-cli 0.163.0-alpha.11.1，得到 6 passed、6 xfailed。后六项是两条失败 compact handler 仍继续请求，以及四个 keyed fragment 首次不完整或压缩后丢失的资格缺口。溢写及未信任案例通过的是“确实识别缺源”的负例，不是恢复成功。不能据此启用生产 delta。

共享 checkpoint 两模块在不可变基线及当前 head 上均为 12 passed、48 failed。逐项失败身份及完整诊断一致，仅规范化源码根、pytest 临时根编号、对象地址和同一 Python 3.14.8 标准库的相对前缀；没有去掉断言、原因或数据。失败位于未改动的 canonical authority、CLI 准入或 fixture setup，早于本次抽出的 helper；另行实际 helper 首次与接续对照均通过。因此这是保留的既有失败，不能宣称整套 checkpoint 或安装态能力通过。

当前 head 的标准 premerge 5 项直接检查、14 项选中检查全部通过，包含提交差异、双语 RFC、编译、全树语义和公共边界检查。没有读取或等待 CI。测试仍须显式给出本机 native binary；这种版本相关资格测试适合按需运行，不宜扩成默认付费模型或安装验证。

我的整体评价

APPROVE。这项内部前置验证有明确的反例价值，复用原 provider 足够，无须另建 runner 或增加人工确认。已把当前消费者、首个有用结果及尚缺的最终输入组装接缝写明；采纳的是恢复评审经验中的这个判断方法，未继承其历史结论，也未宣称记忆产生收益。

长程行为与用户体验在本切片均保持：生产路径未变，测试揭示了会损失要求的原生边界。视觉评审不适用，四文件没有渲染入口；打包和安装态 App 的增量采用仍未验证。后续原一期 owner 必须完成自动完整回退及两个真实消费者的采用和完整成本验证，才能主张能力落地或节省。本次审核没有合并、安装或新增实验权限。

English verdict: APPROVE at a470732 for the bounded native-input characterization. Reproduced 6 passes and 6 explicit expected qualification failures; direct source/continuation parity holds, and all 48 shared-suite failures match the immutable base. The 5 direct and 14 selected premerge checks pass. Production fallback, solver and installed App adoption remain open; no model-efficiency benefit is established.