[songoow]

Goal And Delivered Outcome

• Outcome basis: the requested replacement for feat(benchmark): enforce request admission at provider dispatch #6900, limited to request-time provider admission for opted-in native heartbeat invocations.
• Gap: launch-time admission alone does not establish whether the same Goal/Turn authority still allows a later provider POST. A mutable gateway owner also lets an old connection accidentally acquire a replacement invocation's authority.
• Before → after: every opted-in native invocation now owns an immutable admission snapshot, process binding, gateway listener, and unguessable route. A request rechecks the existing canonical decision immediately before bounded dispatch. Retired invocations and stale connections cannot borrow a replacement invocation, including checkpoint continuation.
• Intended base: main, qualified at 697c8ff3fe0686c38c81e2a051eac245a8747024. This supersedes the implementation proposed in feat(benchmark): enforce request admission at provider dispatch #6900; it does not depend on feat(benchmark): recover native submissions without duplicate POSTs #6902.

Observable behavior

1. provider_request_admission=False remains the default. The explicit EdgeBench option is --provider-request-admission (environment opt-in: LOOPX_PROVIDER_REQUEST_ADMISSION=on). Invalid combinations fail before launch. The removed research-loop flag is not revived.
2. Python adapts the HTTP transport and reuses FirstPartyHostGoalAdmission.with_launch_decision, heartbeat_launch_check, and the existing launch_lifetime boundary. It does not introduce a second quota policy.
3. DNS/connect/TLS and inbound body waits occur before acquiring canonical authority. After waiting for that authority, dispatch rechecks the original process, retired state, and deadline. Sending a POST has one absolute two-second deadline, capped by the remaining phase/work budget. There is no gateway reconnect/replay of a POST.
4. The actual selected runner route and credential behavior are preserved, including SForge's host credential gateway. The generic gateway still rejects HTTP upstreams by default; this benchmark adapter explicitly preserves the runner's already-selected route. Loopback routing is not an OS isolation or authentication boundary.
5. Ordinary launch and checkpoint continuation share native_child_process. A replacement child gets a new gateway. Temporary Codex global options preserve the native resume session argument and do not rewrite the durable upstream configuration.
6. Request observations distinguish started, dispatched, and finished states. sent means bytes were sent, not that the provider accepted or completed the request. Partial sends remain unknown; an unfinished response remains pending. Observation I/O and response streaming do not hold the canonical lock. Bodies, queries, and credentials are not logged.

Author Declaration

• Written by: model_agent — OpenAI GPT-6 family.

Implemented against

• Specification and revision: the scoped replacement request recorded in this PR and #6900; the existing admission and worker contracts in loopx/control_plane/goals/first_party_host_admission.py and benchmark/runtime/worker.py at 697c8ff3fe0686c38c81e2a051eac245a8747024. No separate written specification is claimed.

Criterion	Disposition	Symbol / path	Evidence
Invocation ownership is immutable; stale connections cannot gain a replacement owner	implemented	benchmark/runtime/provider_request_admission.py	File/SQLite lifecycle and queued/accepted/slow-header/slow-body/connect cases; stale-route rejection; second process binding rejected
Current canonical authority is checked after waits	implemented	FirstPartyHostGoalAdmission adapter and dispatch guard	Stop, real quota exhaustion, process exit, deadline expiry, and lock-contention cases
Admitted POST dispatch is bounded and partial effects remain unknown	implemented	provider_gateway.py	Real 8 MiB TCP backpressure; concurrent Stop completes; partial body observed; unknown recorded; no gateway replay
Default-off behavior and the selected native route are preserved	implemented	EdgeBench configuration; Harbor/SForge adapters	57 distinct configuration/default-off cases, including native minimal import closure and effective HTTP host gateway
Active callers include ordinary worker launch and checkpoint continuation	implemented	worker.native_child_process; checkpoint_wake.py	Actual worker and checkpoint entrypoints with File and SQLite authority, supervised scripted hosts, and local HTTP
Observation state is truthful while responses are pending	implemented	provider_gateway.py	Started/dispatch/finished tests and delayed-response tests

• Self-check: reviewed the active launch/checkpoint callers, current provider integration, default-off paths, transport configuration, and negative admission cases; ran the checks below. The native host in the worker tests is a scripted process, not a real Codex model execution.

Scope And Continuation

• Complete within this scope: explicit, per-invocation request admission for native heartbeat benchmark execution and its shared transport support.
• Incremental SSE forwarding is independently proposed in #7776. The two patches were also composed and tested together without conflicts.
• Native submission acceptance recovery (feat(benchmark): recover native submissions without duplicate POSTs #6902), reconstruction of missing historical artifacts, benchmark score improvement, and model efficacy are outside this scope.
• Disable the opt-in for newly launched trials to return to the existing transport path. The send deadline bounds the admitted send, not every existing canonical-decision operation, and cannot undo bytes an upstream already received.

Validation

• Tested source: local commit 59909b637375c56765e700eaf0a6eb9e5e6588a4; published commit a13618ffac0351fd5deacb8bb5732ae9a416c778 has the identical tree c1f79863a4003134e5c5485049d71cc6fbcafeee and parent 697c8ff3fe0686c38c81e2a051eac245a8747024. Publication changed commit metadata only.
• Run state: finished.
• Input classes: synthetic. No private benchmark traces are included.

Check kind	Result	Evidence / limitation
real_entrypoint / real_backend	passed	159 cases across test_benchmark_current_admission.py, test_benchmark_checkpoint_admission.py, test_benchmark_request_worker.py, test_worker_phase_budget.py, and test_task_entry.py; actual worker/CLI, isolated File and SQLite authority, local HTTP and supervised scripted host; 432.81 s
integration	passed	31 distinct cases in benchmark/tests/test_provider_request_admission.py, qualified by 13 unaffected passing cases plus the final 18-case affected-group rerun; six header cases additionally rerun after fixture-source deduplication. This is not a claim of one final all-31 run.
unit / integration	passed	57 distinct configuration/default-off cases: 54 adapter/configuration cases plus four minimal/off cases, with one overlap; no skipped cases
integration	passed	14 gateway/observation/CONNECT-proxy cases in the three tests/capabilities/test_provider_gateway*.py files; 5.31 s
integration	passed	This tree plus #7776 commit ed44a9355a9552ddbeb58ffab42971ad6e77287b compose without conflicts; combined tree 8a9f520fcad83f3380b4427b597ae031a8d89803; 18 gateway/SSE/observation/proxy cases passed, no failures or skips, 9.06 s
static	passed	Ruff on all 14 changed Python files; mypy on the generic gateway; diff whitespace check; bilingual RFC check against the qualified base, with no paired RFC changed
static / manual	passed	Public/private boundary scan of all 15 changed files: zero errors; one pre-existing documentation-word warning. Semantic advisory passed on the supported loopx/ file; benchmark-local event/status values were reviewed manually.
integration	not_run	Full repository CI, actual Codex model execution, paid benchmark trials, and model/score/latency efficacy evaluation are not locally qualified by this PR. GitHub CI results remain separate.

The initial race-suite run exposed eight fixture failures: quota fixtures changed registry authority instead of spending the real quota, and response assertions raced the handler's finished observation. The fixtures now spend quota through the real CLI without changing registry bytes and wait for the matching finished record. Production admission rules were not weakened to satisfy those tests. A duplicated synthetic credential literal was consolidated into one fixture value; no scanner exemption was added.

Coverage crosses both authority backends and multiple wait boundaries, including a real stopped-reader TCP connection and a slow response. It does not infer provider acceptance from a successful send, claim exactly-once delivery, or substitute a synthetic host for actual model qualification. CI and independent review remain merge gates.

Frontend / Visual Evidence

• UI impact: none.
• Before / after / viewport / preview / states / attention / craft review: N/A; this changes an opt-in benchmark transport and existing CLI configuration, with no visual surface.
• Source data: none.

Type of Change

• Bug fix
• New feature — explicit opt-in request admission
• Documentation update
• Test update

LoopX Area

• Benchmark boundary (adapters, runners, verifiers, scoring, evidence)
• Capability or extension (providers, adapters, skills)
• Host or runtime integration

Technical Direction

• Existing Goal/Turn admission at the native provider boundary; scoped continuation of feat(benchmark): enforce request admission at provider dispatch #6900.

Shared-authority RFC fixture impact

N/A. This reuses the existing canonical admission API. It does not promote a new authority backend, change runtime routing between authority providers, or claim a TypeScript/shared-authority migration milestone.

Boundary Checklist

• No private state, credentials, raw traces, internal links, or local machine paths are included in this diff or description.
• Scoped to the requested replacement of feat(benchmark): enforce request admission at provider dispatch #6900; adjacent SSE and native submission recovery work are identified separately.
• No paired RFC changed; the bilingual RFC check passes.
• UI impact is none.
• Every commit includes a DCO Signed-off-by trailer.

Current-Main Integration Review

Exact head: 3cb8da9f334cb865b3827e8b1ea04c14d5bc22a2, based on current main 85b0975bb1f81c6ef41abb958c55071a80b2b451.

The only source conflict was in the optional SForge runner configuration test: main added Docker host-bridge coverage while this PR added request-admission coverage. The resolved parameterization tests both dimensions together. Production provider-admission and gateway files merged without a conflict.

Final-head evidence:

• Provider admission, gateway observation/proxy, benchmark request worker and checkpoint admission: 78 passed, covering File/SQLite authority, stale invocation routes, Stop/quota/deadline waits, backpressure and checkpoint continuation.
• Ruff, Python compilation and diff hygiene passed across all changed Python files.
• Standard premerge executed 6 direct and 10 selected checks with zero failures; the expected benchmark_sensitive manual review hold remains.
• Exact-scope CQR cqr_6a9777440bc7daf7a9e0 is valid for fingerprint 6a9777440bc7daf7a9e05b4d541191e354de857484a6724c1909cf3fbc1d2d74; it has no blocker and records one non-blocking warning for a local optional SForge package API mismatch.

Actual model execution, provider acceptance, scoring/latency benefit and full installed-host qualification remain outside this transport slice.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-01T03:29:29.408724Z	a13618f	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @songoow.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[songoow]

Reviewer: model_agent | GPT-6 Astra Pro | OpenAI | self_reported

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

审阅固定在 a13618ffac0351fd5deacb8bb5732ae9a416c778。未发现当前 head 的 blocking finding；下文是完整源码与实测判断，CI 和 merge readiness 分开报告。本审查曾参与该分支测试构造，先前数据明确标为同 tree 复用；同账号 COMMENTED 不包装为外部维护者批准。

动机 / Motivation

启用请求时准入的 heartbeat benchmark worker，在普通执行和 checkpoint 继续执行时都需要约束每次模型请求的原始进程与 Goal/Turn 权威。

旧路径只在 native 启动时准入，随后 provider POST 没有同一边界检查；新路径为每次 invocation 固定原始 owner，旧连接即使晚到也不能借用 replacement 的进程或准入。

实际 worker 的 File/SQLite 开关对照在当前 head 四项通过，关闭时保持直接路由，开启时只改本次命令；旧 invocation 的延迟请求被拒绝，新 invocation 仍能正常发送。

本修复限定显式 opt-in 的 custom Responses heartbeat 请求，不改变 quota 策略、provider 身份或评分，不证明安装后的真实模型采用、远程效果撤销或全 Host 即时取消。

改动思路 / Approach

现有 canonical owner 继续决定 Stop、quota 和原始 Turn 权威；新增代码只适配 provider IO 与 invocation 生命周期，两条真实 worker 入口共用它，避免第二套准入政策。

当前 PR 完整交付默认关闭的 per-invocation 请求准入；SSE 增量转发由 #7776 独立承接，native submission recovery 与模型效果验证不在本切片内。

最强的不发布理由是增加行为或维护成本却没有解决真实调用者的问题。本次比较不改、在既有 owner 修复、另建机制三种选择。初次 Popen 检查无法观察后来 HTTP，而可变全局 gateway 会丢失原 invocation 身份；保留 canonical decision 与 runner IO 分工，才交付当前完整、可逆的边界。

具体改动 / Changes

精确 head 为 a13618ffac0351fd5deacb8bb5732ae9a416c778，基线 697c8ff3fe0686c38c81e2a051eac245a8747024。全 PR 15 文件 +1557/-30：7个生产文件覆盖 CLI/runner 选项、共享 worker 调用、invocation guard 与通用 HTTP hook；7个测试文件覆盖配置、真实 worker/checkpoint、等待与观察；RUNTIME.md 说明用户选择、发送 deadline、HTTP host credential 路由和未知效果。此次审查覆盖全部文件，没有只看核心 guard。

验收采用变更前 Accepted RFC docs/architecture/rfcs/agent-session-execution-modes-v0.md，spec_revision 为 697c8ff3fe0686c38c81e2a051eac245a8747024，重点是 pause/dispatch/binding 段。RFC 自身说明 delivery maturity 仍是 partial；本次验证所请求的 benchmark adapter，不把未来全 Host 收敛变成该 PR 必须完成的义务。以下是未编号条款的定位标签：

• pause-precedence — implemented：ProviderRequestAdmission.lifetime / heartbeat_launch_check；exact-tree 31-case real Stop/quota suite and current scoped HTTP tests。
• binding-generation — implemented：_Invocation / started / retire / unique gateway prefix；lifetime-head2 File/SQLite shared-receipt cases; deliberate mutation fails both。
• dispatch-vs-settlement — implemented：_dispatch_bounded / CheckpointWake.run；same-tree real8MiB partial send and actual held-Turn checkpoint cases。
• host-qualification-boundary — out_of_scope：The accepted RFC explicitly limits qualification; requested slice is a selected benchmark provider adapter.；保留原合同边界，不扩大此次交付范围。。

关键代码讲解

1. ProviderRequestAdmission 冻结原始 admission、Turn、session、deadline，并复制环境/Goal/quota 输入；started 只绑定一次进程，retire 后不能重绑。invocation_id 区分同 wake、同 Turn 的前后 native 调用。
2. lifetime 先检查原进程，再调用既有 launch_lifetime；等待 authority 后重新检查 process/deadline。迟到旧请求继续使用旧 guard，不能向 replacement summary 写入拒绝或杀死新进程。
3. _dispatch_bounded 将 DNS/CONNECT/TLS 留在权威锁外，禁用重连，并按同一个绝对截止时间逐块发送，避免 TCP 回压无限阻塞 Stop writer。sent 只是本地字节发出，partial send 保持 unknown；response 等待和日志 IO 不持 canonical lock。
4. native_child_process 连接普通 worker 与 checkpoint continuation；后者继续保留 held quota 的原始 Turn。关闭时走原 child_process，开启时只给本次命令增加临时 provider URL，durable Codex home、resume 参数和真实上游不改。SForge 已选 host credential gateway 及显式 HTTPS CONNECT route 保留原路由语义。

本轮固定 worker fixture SHA-256 645d43689b214fb93e5e0d5cbba9e4b1bcbac954557119b8bd45c1c8d5976eed 的 File/SQLite、off/on 在 head 4 passed / 29.88s。同 fixture 在 base697 的 off 两项也通过，on 两项在仍为原直接 URL 处失败，说明新增路由只发生在选中处理之后；不把 base 尚未支持新开关说成另一个旧 bug。

本轮还以真实 HTTP、owned process 和 File/SQLite authority 执行同 wake/Turn/receipt 的 delay-connect：head 2 passed / 7.36s，旧请求409、新调用200。在隔离审查进程中故意把 _require_live 换成 no-op、生产文件不动，同两例都在旧请求错误200而非409处失败。这个 mutation 证明 oracle 能发现迟到原请求被放行，而不是让 mock 直接提供期望结果。

外置测试 harness 最初在两个 revision 都因缺少仓库 tests import path 而 collection 失败；补齐同一 harness 的路径后才得到上述实际执行。源码、fixture、assertion 和 timeout 未因此更改，失败记录保留。

此前测试源 59909b637375c56765e700eaf0a6eb9e5e6588a4 与 published head 的 tree，本轮重新核实均为 c1f79863a4003134e5c5485049d71cc6fbcafeee、parent697。读取现有 JUnit 后复用：159 actual worker/current/checkpoint/budget/task-entry，31 distinct lifecycle，57 distinct configuration/default-off，以及 14 gateway/observation/proxy。31项来自未变13项加最终18项复跑，另有6项 header fixture整理复跑，不能写成新的一次全31；57项由54与4去掉一个重复构成。与 #7776 组合的18项也是先前证据。没有重复全矩阵、运行付费模型或把测试数当作收益。

对主干的风险 / Risks

首要风险是原请求经历网络/锁等待后误用新 invocation，以及真实回压阻塞 Stop。一个允许请求不足以验证这些边界；已有同 tree 用例覆盖 backlog、accept、slow headers/body/connect、真实8MiB部分发送、slow response 和 authority 等待后的 deadline/process 重验。本轮又执行了最容易被同 receipt 身份掩盖的 delay-connect，并通过刻意破坏存活防线检查测试敏感性。旧 URL 指向新 listener 仍404，正常 replacement 可发送。

默认关闭也通过实际路径而非仅“没有 feature 对象”判断：runner boolean/独立 env flag、ambient opt-in 清理、原 provider route、receipt字段、最小导入与 prompt保持有此前同 tree 证据，加上本轮 base/head off worker 对照。两秒上限只界定 admitted upload，不承诺所有 canonical 读取或响应两秒完成。退出时未结束的 response 仍为 pending，sent 不等于 provider acceptance；loopback 不是 OS credential isolation。

PASS：本轮标准原生 premerge 覆盖完整变更文件集合，6 个 direct checks 与 10 个 selected checks 全部执行并通过，zero failures / advisories。CLI exit1 的原因仅为 manual_review_required：benchmark 改动仍须人工审查与 merge authority；没有把该授权 hold 写成测试失败，也不声称 merge gate 已放行。

语义与 CI 对齐

Core 的 Stop、quota、原始 Turn owner 没有复制；off/on 和 started/dispatch/finished 是 benchmark transport 局部词汇，不新增 Todo、claim、lease 或 settlement 状态。当前单次 CI 快照仍 pending/queued、未观察到失败，不能称 CI green；以 required=false/unresolved 保存诊断，merge readiness 另判。

固定主干参照 a4a0fad889d91cba0d945ce658788bdb76ba351e 已合 #7771。只读比较确认其 JSON codec 用于 evaluator opportunity/archive/score，未改变 provider_gateway、worker、checkpoint_wake、Harbor/SForge 的准入调用；这里仍按 raw bytes 转发，不参与 evaluator 非有限数解码。发表前再核对主干 0e78a19c277f4ca3d44313787162bc0444065172：此处相关caller没有新变化，gateway的唯一新增差异是已合并#7776的read1增量转发；两PR组合18例沿用前次明确记录的证据。本轮未重跑这个新main的完整组合，也不把原始base对照改标为新main对照。

我的整体评价 / Verdict

long_horizon 判定 improved：原始权威约束能跨普通 wake 与 checkpoint replacement保持，迟到连接不能制造额外工作。 user_experience 判定 improved：独立选项明确，拒绝和 pending可按原 invocation定位，默认 trial无需迁移。 这些是已测 transport／ownership 的改善，不是模型效果实证。已检查 CLI 开关、worker receipt 和运行文档；本 PR 没有页面或渲染布局变化，视觉检查不适用。

代码规模、默认策略和必要兼容路径与问题相称，没有需要在本 PR 内追加的独立 framework。当前 PR 完整交付默认关闭的 per-invocation 请求准入；SSE 增量转发由 #7776 独立承接，native submission recovery 与模型效果验证不在本切片内。 此 APPROVE 是源码审查结论；author-owned COMMENTED fallback 不是 GitHub 正式自批准，不授予合并权限。已读仓库 merge workflow；发布前仍须重读 unchanged remote head，发布与 readback 由获授权的 review workflow 执行。

English verdict: APPROVE — head a13618f. Immutable invocation ownership and default-off routing are verified through actual File/SQLite worker and HTTP paths, including a liveness-removal counterexample; no blocking finding. CI remains separately unresolved/pending and merge readiness is not granted.

[loopx-agent]

Reviewer: model_agent | gpt-6.1-sol | OpenAI | runtime_reported | reasoning_effort=max

动机 / Motivation

选择 heartbeat benchmark 的维护者，需要在原生子进程后续发起模型请求时继续遵守当前 Stop、配额和执行期限。

子进程启动后才收到 Stop，或旧请求被网络等待拖延到 checkpoint 续行之后：仅启动准入无法保护这次 POST；新实现给每次 invocation（一次原生调用）固定自己的权限与路由，并在发送前重查。

已验证的新请求会读取当前 canonical authority；旧连接不能获得替代调用的身份，背压发送有绝对期限，部分发送保持 unknown 且网关不自动重放。

默认关闭；不改评分、提交语义或模型选择，不宣称提高 benchmark 得分，也不把 loopback 路由当作凭据或 OS 隔离。

改动思路 / Approach

临时调用身份属于 benchmark transport；Stop/配额仍由现有 Goal/Turn owner 判断，通用 HTTP 发送保持在原 gateway，避免第二个 quota 或执行循环。

当前 PR 交付显式开启的逐调用请求准入与 ordinary/checkpoint 共用入口；SSE 集成、原生提交恢复和模型效果不由本补丁认证。

每次原生调用创建独立 listener、随机路由和一次性 process attachment；后来的 checkpoint 调用不会替换旧对象的 owner。DNS/CONNECT/TLS 与输入等待放在 canonical 锁外；拿到原权限锁后再次确认进程、退役状态与截止时间，只把有界 POST 发送留在锁内。开始、发出字节、响应结束分别记录，观察值不承担权限或 provider 成功回执的职责。

下面是源码导出的行为对照，属于说明，不是额外执行证据：

触发	发送前判断	结果
默认 off	沿原 launch owner 与原路由	不生成 invocation 字段
on、原进程仍有效	原 Goal/Turn 当前准入 + 剩余期限	有界发送；响应等待不占 canonical 锁
旧连接晚到或 Stop/配额/期限拒绝	保留原 invocation；不借 replacement	409，替代调用仍可工作
POST 仅部分发送	不推断 provider 接受或完成	unknown；网关不自动重放

具体改动 / Changes

完整审查 base 697c8ff3fe0686c38c81e2a051eac245a8747024 → head a13618ffac0351fd5deacb8bb5732ae9a416c778 的 15 个文件：生产 428+/19-，文档 42+，测试 1087+/11-。新增 213 行的 adapter 有 ordinary/checkpoint 两个实际 caller，不承担第二份配额或 scheduler 决策。

先读了 https://github.com/loopx-project/loopx/pull/6900 中的重启条件与已撤回的旧实现保证，再检查实现。对应旧代码 head/讨论基准为 26778194f41752717637da79089a4e242914f80f。映射如下：RESTART-CALLER 已实现，ordinary worker 和 checkpoint 都使用新入口；RESTART-IDENTITY 已实现，backlog/accept/header/body/connect 旧请求不借新 owner；RESTART-AUTHORITY 已实现，复用 canonical owner 并在等待后重查；RESTART-BOUNDED-SEND 已实现，真实背压下发送有界且部分结果未知；RESTART-COMPATIBILITY 已实现，默认关闭、持久 home、原 provider route 与 File/SQLite 续行均有验证。

本轮审查期间作者补充了 Accepted RFC 引用，我在最终判断前核对其不可变版本：docs/architecture/rfcs/agent-session-execution-modes-v0.md，697c8ff3fe0686c38c81e2a051eac245a8747024 的 §5 pause/dispatch/binding。RFC-PAUSE 已实现：复用原 Goal/quota/binding owner，发送前消费当前拒绝；RFC-BINDING 已实现：原 invocation 与 replacement 分离；RFC-SETTLEMENT 已实现：只拦新发送，保留 unknown/pending 与原 Turn 结算身份，不声称远程效果撤销；RFC-HOST-QUALIFICATION 超出本切片，RFC 明示 Partial，实际模型采用与全 Host qualification 保持未验证。

关键代码讲解

• native_child_process：ordinary/checkpoint 共用原进程清理与启动 fence；显式 on 才导入 guard。即使子进程自行退出 0，已记录的准入拒绝仍会向 worker 上抛。
• ProviderRequestAdmission.lifetime：捕获原环境/GoalRef/quota，再调用原 launch_lifetime。锁等待后重验 liveness 和期限，返回两秒与剩余工作窗口中的较小截止时间。
• ProviderRequestAdmission.serve：独立 listener 与不可重绑定 process；只注入此次 native argv 的 URL。SForge 已选择的 credential gateway 路由继续有效，持久 Codex home 不被改写。
• _dispatch_bounded：连接准备完成后关闭自动 reconnect，header/body 分块都复算绝对剩余时间；发出字节不等于 provider 接受。观察与响应读取在 admission scope 之外。

对主干的风险 / Risks

作者已有同头 COMMENTED 自审，原生 capability 仍判 formal_review_state_required；本次以独立代码与执行证据给出正式审查，不把作者自审当作外部批准。

未发现阻塞问题。最强反例不是一次成功 POST，而是旧请求跨越连接/锁等待后错用 replacement 身份，或实际背压长期阻塞 Stop writer。我独立运行了这些失败路径：真实 File/SQLite authority、原生脚本进程和本地 TCP/HTTP；provider 与 Host 是合成 fixture，没有调用模型。

本地检查	结果与边界
invocation/gateway/worker/checkpoint	PASS：74 项，含真实配额耗尽、Stop、进程退出、deadline、旧连接阶段、8MiB背压及 pending 观察
实际 Harbor/SForge adapter 配置	PASS：54 项，Harbor 0.20.0、SForge 1.1.0；SForge 来源 commit e278cda3f4d2da3cf06aabf2df4daa99b9749501；远端执行被 fixture 截止在 solver 前
基线/当前相同 worker 路径	基线 off 两项 PASS；on 的两项路由隔离断言按预期 FAIL；当前 off/on 均 PASS，home 与原 provider 保留
原 generic gateway	基线 7 项 PASS，当前同组亦 PASS；无 lifetime callback 的原路径保留
静态与风险 premerge	Ruff 14 文件 PASS；6 direct、10 catalog 检查 PASS；总体保留 benchmark_sensitive 人工合并 hold，不把 exit 1 的 hold 报成整体 gate 通过
公私边界	0 errors；3 warnings 为一次性空 runtime 与两处既有 credential 术语，不包含凭据值

语义与 CI 对齐

显式 opt-in 是调用者试验意图，CLI/provider 安装、旧 research flag、context delivery 或 turn envelope 均不自动激活。关闭时不引入 required 字段、invocation receipt、额外准入或持久配置变更；共享 gateway 的默认安全限制保留。新增事件只是局部诊断，不被 generic quota、Todo 或 work-lane 当作权威；可后续用 Literal/TypedDict 收紧内部事件形状，但当前没有误分类的具体证据，不将其升级为阻塞。当前配置不读取或等待 GitHub CI。

我的整体评价 / Verdict

APPROVE，本次有界 transport 修复与真实 caller 的需求相称。长程维度保留原 Turn/session/capture 的继续执行与拒绝恢复，用户体验能读回真实 pending/unknown；这些正确性证据不等于模型采用、评分提升或完整隔离证明。ordinary/checkpoint 已合并到同一 adapter，兼容分支有实际消费者，不需要额外 quota owner 或新配置体系。

已检查 benchmark 配置、worker、gateway 与运行文档，未改动任何渲染页面。 视觉改动无未验证项；原生平台与模型执行边界另列。

真实 Codex 模型调用、付费任务、评分/延迟收益、完整仓库套件与跨平台原生行为未验证。当前 main 已合入的 #7776 SSE 变更需要在重基后的新 head 重新集成验证；不能把本次旧 base 审查当作合并就绪。 必须保留显式维护者合并权限及 benchmark-sensitive hold。change-quality receipt cqr_d14fc2d4e3449b83554b 已验证有效；本次未合并、未安装运行时、未启动模型或 benchmark job。

English verdict: APPROVE — a13618ffac0351fd5deacb8bb5732ae9a416c778 preserves immutable invocation admission and default-off behavior; local transport/authority and adapter checks passed. Rebased SSE integration and actual-model efficacy remain unverified.

[loopx-agent]

Reviewer: model_agent | OpenAI | maintainer-delegated exact-head approval

动机 / Motivation

Opted-in native heartbeat invocations need provider request admission tied to the original Goal/Turn process rather than only the initial launch. The reviewed change gives each invocation an immutable gateway route and rechecks current canonical authority immediately before a bounded POST, so stale connections cannot borrow a replacement invocation after shutdown, quota loss, deadline expiry or checkpoint replacement. Default-off behavior and the existing selected runner route remain unchanged.

改动思路 / Approach

Reuse FirstPartyHostGoalAdmission, the existing launch lifetime, canonical Goal/Turn decision and generic provider gateway. DNS/connect/TLS and inbound waits remain outside the canonical lock; after obtaining current authority, the gateway rechecks process liveness, retired state and the absolute send deadline. Ordinary worker launch and checkpoint continuation share native_child_process; observation I/O and response streaming remain outside the lock and do not claim provider acceptance from a successful send.

具体改动 / Changes

Exact head ebf5b9f342322da278abe794a9900eeaf1a136b6 is based on current main 403e7491471317e3ca81344f25bb0133ae55d502. The source conflict was limited to the optional SForge configuration test because main added Docker host-bridge coverage while this PR added request-admission coverage; both dimensions now run together. Production provider-admission and gateway paths merged without conflict.

对主干的风险 / Risks

No blocking finding remains. The key failure modes are stale-route reuse after a replacement process, request dispatch after Stop/quota/deadline, partial HTTP sends being reported as successful, and lock-held response streaming. Current-head tests cover those boundaries on File/SQLite authority, a supervised native process and local HTTP, including real backpressure and checkpoint continuation.

Provider admission, gateway observation/proxy, request worker and checkpoint admission suites passed 78/78; Ruff, compilation and diff checks passed. Standard premerge executed 6 direct and 10 selected checks with zero failures and retained the expected benchmark-sensitive manual-review hold, which this published exact-head review addresses. CQR cqr_020f74f584b59f771006 is valid for the exact 15-file scope and has no blocker; its one warning records an optional local SForge package API mismatch outside the PR's dependencies. Actual model execution, provider acceptance, score/latency benefit and full installed-host qualification remain unclaimed.

我的整体评价 / Verdict

APPROVE. The change keeps quota authority in the existing canonical owner while adding one ordered provider-IO boundary with explicit invocation identity, default-off isolation, bounded dispatch and truthful partial/pending observations. The current-main integration preserves Docker bridge and request-admission coverage together.

English verdict: APPROVE — ebf5b9f342322da278abe794a9900eeaf1a136b6 binds provider admission to each native invocation, preserves default and selected-route behavior, and passes the affected authority, gateway, worker and checkpoint counterexamples.

[huangruiteng]

Reviewer: model_agent | OpenAI | maintainer-delegated exact-head approval

动机 / Motivation

Opted-in native heartbeat invocations need provider request admission tied to the original Goal/Turn process rather than only the initial launch. The reviewed change gives each invocation an immutable gateway route and rechecks current canonical authority immediately before a bounded POST, so stale connections cannot borrow a replacement invocation after shutdown, quota loss, deadline expiry or checkpoint replacement. Default-off behavior and the existing selected runner route remain unchanged.

改动思路 / Approach

Reuse FirstPartyHostGoalAdmission, the existing launch lifetime, canonical Goal/Turn decision and generic provider gateway. DNS/connect/TLS and inbound waits remain outside the canonical lock; after obtaining current authority, the gateway rechecks process liveness, retired state and the absolute send deadline. Ordinary worker launch and checkpoint continuation share native_child_process; observation I/O and response streaming remain outside the lock and do not claim provider acceptance from a successful send.

具体改动 / Changes

Exact head 3cb8da9f334cb865b3827e8b1ea04c14d5bc22a2 is based on current main 85b0975bb1f81c6ef41abb958c55071a80b2b451. The source conflict was limited to the optional SForge configuration test because main added Docker host-bridge coverage while this PR added request-admission coverage; both dimensions now run together. Production provider-admission and gateway paths merged without conflict.

对主干的风险 / Risks

No blocking finding remains. The key failure modes are stale-route reuse after a replacement process, request dispatch after Stop/quota/deadline, partial HTTP sends being reported as successful, and lock-held response streaming. Current-head tests cover those boundaries on File/SQLite authority, a supervised native process and local HTTP, including real backpressure and checkpoint continuation.

Provider admission, gateway observation/proxy, request worker and checkpoint admission suites passed 78/78; Ruff, compilation and diff checks passed. Standard premerge executed 6 direct and 10 selected checks with zero failures and retained the expected benchmark-sensitive manual-review hold, which this published exact-head review addresses. CQR cqr_6a9777440bc7daf7a9e0 is valid for the exact 15-file scope and has no blocker; its one warning records an optional local SForge package API mismatch outside the PR's dependencies. Actual model execution, provider acceptance, score/latency benefit and full installed-host qualification remain unclaimed.

我的整体评价 / Verdict

APPROVE. The change keeps quota authority in the existing canonical owner while adding one ordered provider-IO boundary with explicit invocation identity, default-off isolation, bounded dispatch and truthful partial/pending observations. The current-main integration preserves Docker bridge and request-admission coverage together.

English verdict: APPROVE — 3cb8da9f334cb865b3827e8b1ea04c14d5bc22a2 binds provider admission to each native invocation, preserves default and selected-route behavior, and passes the affected authority, gateway, worker and checkpoint counterexamples.