[loopx-agent]

The raw quota caller and ordinary Host received different execution obligations: the envelope producer truncated five contracts, and the structured Host omitted signed policy/action context. Consumers also handled unsupported wire versions inconsistently: a matching old action digest could let an unknown envelope/signature declaration reach a Host. This PR preserves the existing work contract through the final input and rejects unsupported declared versions before dispatch.

Changes use the existing TypeScript envelope owner and current Turn/Host entrypoints:

• Preserve complete work_lane_contract, execution_obligation, autonomous_replan_scope, agent_scope_frontier, and automation_liveness JSON, including nested data, long clauses, order and empty values.
• Deliver signed decision facts, action flags/choices/capability intent, notification/execution/scheduler/response/orchestration policies, remaining capsule and capture references to ordinary structured Hosts. Keep primary-action precedence, nonbinding alternatives and separate capability versus ordinary-delivery permissions. Work segments return results; the outer Turn executor retains state, quota and scheduler effects.
• Reuse one typed consumer-version check in Turn planning, native Codex prompt construction and structured Host extraction. Explicit unknown/null envelope, action-signature schema or coverage declarations fail before launch. Preserve the owning diagnostic through the existing plan/error transport. This intentionally tightens unsupported-version handling; no new schema, format negotiation, binding configuration or writer switch is introduced.

Compatibility and scope:

• Supported v0 envelopes and registered signature coverage v0–v5 remain readable. Existing v0 planning callers that omit signature metadata retain prior behavior. Version checks do not substitute for digest, lineage, current authority or settlement checks, and do not interpret unknown required nested semantics.
• Frozen historical bytes and original digests still validate. Re-projecting an older raw decision can produce a different signature after complete-contract preservation; tests explicitly distinguish that new projection from unchanged historical evidence.
• Raw quota output and domain decisions remain unchanged. Real disposable File/SQLite quota and direct Turn paths exercise independent original requirements, actual final inputs, capture/recovery and original settlement. No authority-store implementation changes or PostgreSQL qualification claim. Native model processes are synthetic; installed App, model benefit and the future unified schema remain unqualified.

Validation at e6d1a000f3ac9d9d3364177200d72b62394c6856:

• Final source/Host/Turn planning and execution/DSH/native Codex/capture/history suites: 630 passed. TypeScript envelope suite: 44 passed. Includes six real File/SQLite CLI refusal cases and three native process-boundary cases; unsupported declarations cause no Host launch or quota debit.
• Thirteen strengthened cases fail with the previous ceb7bd75a consumer functions substituted into the same checkout; thirteen also fail when the shared version gate is deliberately removed. This is component sensitivity, not a full-tree baseline. The previous direct Turn path already rejected an unknown outer schema, but lost its actionable diagnostic; unknown signature schema/coverage could reach execution. The structured and native prompt consumers also lacked the outer-version gate.
• On one identical valid synthetic input, the plan, structured authority and native prompt are exactly equal to the prior consumer functions. Frozen historical fixtures are unchanged. This version check adds no model-input bytes on that sample; additional bridge validation cost has not been performance-qualified.
• Standard premerge: four direct checks, changed-Python compilation, eight catalog canaries, eight risk smokes and public-boundary check passed. TypeScript typecheck, Ruff, staged/committed bilingual checks and whitespace checks passed. Semantic advisory reports no supported new vocabulary carriers; its coverage is limited. The new internal consumer_version operation reuses existing registered wire constants and adds no persisted vocabulary.
• Earlier broader failures remain disclosed: 28 failure IDs reproduced on base 99921829f (capability/preference fixtures missing canonical authority and two staged-replan finding-status fixtures). A separate historical/live-Turn/replan/capture combination had 107 passes and six failures, reproduced with the prior adapter (four canonical-authority and two finding-status fixtures). The passing suites above do not convert those failures into passes.

Earlier preservation costs remain: one identical ordinary input's envelope grew 22,116 → 22,293 bytes (+177), capsule 1,928 → 2,105; the structured prompt grew 5,199 → 7,030, then 7,394 bytes as omitted policies/actions were restored. Counts overlap across prior runs; bytes are not token cost. No latency, lower-cost or model-effectiveness benefit is claimed.

This is a reversible preservation and consumer-compatibility prerequisite for C1 in #7416. Full composition before both capture entrypoints, one writer/version transition, remaining-reader retirement, differential context and two-session qualification remain open. Existing product entrypoints carry the refusal; no new frontend capability or setting is added. No model/paid run, live installation, release or merge authority is implied.

中文：本 PR 修复完整执行契约在 producer 与普通 Host 输入之间的丢失，并收敛消费者版本检查。Turn 规划、原生 Codex 和结构化 Host 共用 TS 版本门：显式未知/null 版本即使旧摘要匹配也在启动前拒绝；原诊断通过既有错误通道保留。历史捕获/摘要不改写，兼容既有 v0 及已注册覆盖版本；不新增 schema 或切换 writer，不将未知嵌套语义视为已实现。

最终 Python 630 过、TS 44 过；13 个反例在旧消费者函数及移除版本门的 mutation 下分别失败。真实 File/SQLite CLI 与合成原生进程验证拒绝且不启动/扣费。相同合法输入的 plan、authority、prompt 与旧函数一致；额外 bridge 成本未测。premerge/typecheck/Ruff/双语通过。原广测 28 项及另一组合 6 项基线失败仍保留披露。C1 完整组合、统一 writer、差分上下文及双会话资格未完成；未合并、未安装、未证明模型收益。

[loopx-agent]

Reviewer: model_agent | gpt-6.1-sol | OpenAI | reasoning_effort=max | runtime_reported

Request changes conclusion (author-owned PR; GitHub blocks formal self-review)

本次只修订语言表述；评审仍绑定原 head e6d1a000f3ac9d9d3364177200d72b62394c6856，结论、发现与验证范围不变。

动机

普通 Agent 即使已获得任务准入，仍可能丢失说明该如何执行的限制条件。

例如，已保存的接续要求仍在 decision capture 中，却从 structured Host prompt 消失，运行者只能手工补回上下文，Host 也难以准确区分通知策略和工作权限。

本 PR 让这些既有义务通过当前 producer 和 consumer 完整传递，并在启动前拒绝显式不兼容的 wire version。

这不代表自然模型采用、安装态 App 行为或整个 controller 统一路线已经验收。

本轮仍需修正受影响的真实 Host 回归测试，才能形成可交付的验证闭环。

改动思路

权威决策仍在上游。TypeScript 复制完整 contract object，不按文案重新分类，也不截断嵌套义务；Python adapter 负责验签与传输，不取得 settlement 权限。版本检查也归 TypeScript，由 planning、原生 Codex prompt 和 structured adapter 共用。

边界	Base	原评审 head
Contract capsule	部分字段和有界文本	五个既有 contract object 的完整内容
普通 structured Host	丢失部分签名 section 和 capture 引用	保留 policy、action flag、capsule 及原 capture 身份
显式不支持的 wire version	部分 consumer 只依赖 digest／外层形状	启动前拒绝

表格说明源码路径，不增加执行证据。把这些正确性约束留在既有 producer 和 transport owner 中是合比例的，不需要新状态存储、任务生命周期或可选策略。

本 PR 的边界是完整 contract 传输与版本拒绝；更广的 controller 整合仍独立验收。

具体改动

原评审 head 为 e6d1a000f3ac9d9d3364177200d72b62394c6856。独立规格是 docs/reference/protocols/turn-envelope-v0.md，不可变 revision 为 99921829f2c5fa2ad35a024c72abb88717003ef3（已接受的 base 原文）。以下名称对应既有条款，没有另设验收门：

• full_work_context：implemented。完整任务与 Note 留在权威 work_context.sources，selected-task 展示仍可有界；独立的长／短 File 和 SQLite capture 验证了完整载体。
• signed_execution_boundary：implemented。五个完整 contract、普通 policy、false/null 和原 source 引用进入共享 Host input；篡改仍拒绝，版本声明独立于历史 digest 校验。
• outer_turn_settlement：implemented。Host 指令保留 semantic result／outer executor 分工，replay 不新增 admission 或 quota spend。
• historical_capture_identity：implemented。原 capture 字节和签名文档保留；同一 source 的新投影可以合法地产生不同 envelope hash。

关键代码讲解

1. contractCapsule clone 五个既有对象并保留全部嵌套内容。完整任务文本来自既有 work-context owner，不从短 action label 推测。
2. extract_turn_authority 验签、保留已签名的 policy/action/capsule，并转交原 capture 引用。DSH 复用该路径；原生 Codex 保留 envelope，使用同一版本门禁。
3. assertTurnEnvelopeConsumerVersion 拒绝 envelope、signature、coverage 中显式 unknown/null 声明，按既定兼容规则接受 legacy omission。它不替代 digest、lineage 或当前权威校验。

对主干的风险

[P2] Repair the affected real DSH regression before delivery. host_candidate.py:180 的新 detail 分支有意为普通执行保留 detail_ref、action_signature，但 test_captured_context_reaches_actual_host_without_readmission 仍对 off/inline 断言二者不存在。

off/inline × File/SQLite 的四项用例在 99921829f2c5fa2ad35a024c72abb88717003ef3 全通过，在此 head 因该行为变化失败，且停在后续 tamper／无额外 effect 检查之前。这是测试和验证回归，不说明保留 source 引用有错。最小修复是将这四项断言改为核验原 detail_ref／action_signature，同时保留各 mode 的 agent_context、tamper、no-readmission 和 no-effects 检查，再跑原六模式真实 DSH 矩阵。

早先 broad local run 为 227 通过、8 失败、8 条件跳过。相同八个 node 的 base/head 比较区分出四个既有 CanonicalAuthorityRequired fixture 失败和四个本次引入的 DSH 失败。私有诊断只改旧引用断言后，六个 DSH mode 都通过；这不能把仓库 suite 宣告全绿。更新 exact head 的 work-context、native Codex、Turn driver、DSH cohort 为 258 通过、同四个 DSH 失败，无条件跳过；TypeScript envelope suite 的 44 项也通过。未查询或等待 GitHub CI。

语义与 CI 对齐

复用现有 contract 词汇，完整保留是有意且已有说明的变化，不新增权限或执行决策。wire-version gate 扩展 consumer 校验，legacy omission 兼容范围有界。现有机器 flag 仍是义务，不是建议。必须在所属回归中修复当前受影响路径，保留 tamper 检查与原不变量；原 corpus 失败、条件 native-provider 跳过分别保留。

我的整体评价

REQUEST_CHANGES。完整 contract 传递是合理的增量，架构应继续留在原 owner；但当前真实 DSH 回归必须修好。

长程正确性在 transport/replay 边界有所 improved，已验证的合成 Host 路径也减少运行者手工恢复上下文的负担；持续模型成果和总成本收益仍未测。原 PR 是 CLI/Host contract 改动，无需渲染页面截图，安装态／native UI 不在资格范围。

独立 File/SQLite harness 同时暴露了 base 丢失，并验证修复后的完整载体、签名 flag、capture 身份、tamper 拒绝和无额外 spend。prompt 变大是已披露成本，未宣称 token 节省或模型理解。

复评需要在新 exact head 修正最小 DSH fixture，并跑通不变的六模式仓库矩阵；无需等待整个 controller 项目。

English verdict: REQUEST_CHANGES