[hhyykk]

Goal And Delivered Outcome

• Outcome basis / optional anchor: TypeScript control-plane migration RFC: retire bridge surface that no longer has a caller.
• Goal/source and gap: The effect-runtime handler table registered 376 methods. A full-tree audit (Python effect_runtime_result/request call sites, TS dispatch, examples, scripts and tests, including string-built method names) found 19 registrations that nothing dispatches. Each one is extra public RPC surface to keep compatible and review.
• Observable before → after: 376 → 357 registered methods. Every retired method name now gets the dispatcher's standard unsupported_method rejection. Four exports had no production caller except those registrations, so they are deleted too.
• Issue/task and intended base: Self-contained cleanup slice; base loopx-project/loopx:main. No issue closure claimed.

Author Declaration

• Written by: model_agent: Factory Droid (lead, review and commits) with OpenAI Codex CLI (implementation).

Implemented against

Criterion	Disposition	Symbol / path	Check
Remove only registrations with no caller	implemented	19 entries in effect_runtime_handlers.ts (for example todo.field_update.plan, todo.public_update.plan, todo.claim.decide, quota.automation_cadence.schedule, work_item.planning_inventory.*, task_lease.owner_eligibility, coordination.ownership_observation, coordination.local_authority.legacy_writer_fence.engage, scheduler.monitor_successor.plan)	rg across loopx, apps, packages, examples, scripts and tests
Each retired name is rejected	implemented	tests/control_plane_ts/effect_runtime_handlers.test.ts asserts all 19 names are unsupported	169 TS tests passed
Keep implementations that still have production callers	implemented	e.g. planTodoFieldUpdate (public_update.ts), projectCadenceSchedule (scheduler/hint.ts), projectTodoPlanningInventory (action_portfolio.ts), planMonitorSuccessor (monitor_batch.ts)	typecheck
Delete exports that lose their last production caller	implemented	evaluateTaskLeaseOwnerEligibility and its private decoders, governedCapabilitySettlementStatus, delegationTurnPlanDecision, the recordLocalAuthorityShadow tombstone	typecheck; rg
Keep the coverage behind deleted adapters	implemented	lease-owner precedence, user-action and prose-authorization cases now call the live leaseOwnerRejection / leaseOwnerConstraint; the shadow retirement test now proves a stale record call is rejected through the dispatcher without creating storage	task_lease_eligibility.test.ts, local_authority_shadow.test.ts

• Self-check before submission: The first pass removed the registrations only and reported that every backing function was still referenced. A per-symbol check showed four exports with test-only references, so they were removed in the same slice instead of being left as new dead code.
• Behavior difference to note: a caller that still sends the retired coordination.local_authority_shadow.record method now gets unsupported_method instead of the tombstone's local_authority_shadow_retired message. The TypeScript daemon and its Python callers come from the same checkout, and no in-tree caller sends this method.

Migration economics receipt

Field	Result
Registered effect-runtime methods	376 → 357
Product change	+0 / −126
Test change	+42 / −40
Python changes	none
Cross-runtime calls	unchanged on probed paths (canonical Todo update 1 → 1, public-update leaf 0 → 0, scheduler hint 1 → 1)

Scope And Continuation

• Completed scope and remaining work: Complete for registrations with no caller. Bridges that still have Python callers are out of scope and need their own migration slices.
• Merge coordination: sibling migration PRs from the same batch (refactor(presentation): compose global summary and gates in TypeScript #7892, refactor(presentation): own the complete global-risks read in TypeScript #7893, refactor(todos): read completion evidence in one TypeScript todo.read transaction #7894) also edit adjacent lines of effect_runtime_handlers.ts. Whichever merges second needs a trivial rebase.

Validation

• Tested revision: 8f4fed0
• Run state: finished
• Input classes: synthetic

Check kind	Result	Public-safe evidence / limitation
static	passed	npm run typecheck:control-plane; git diff --check. Ruff is not applicable because no Python file changed.
unit	passed	TS delegation, governed capability, lease eligibility, shadow retirement, handler dispatch/loading, lease acquire CLI and canonical renew: 169 passed.
unit	passed	tests/control_plane/test_shadow_observation_retirement.py: 3 passed.
integration	passed	control-plane-integrated-canary-smoke.py: File and SQLite passed (an earlier run under concurrent test load exceeded the unchanged 60 s aggregate budget). Maintainability ratchet and interface-budget smokes passed.
canary	passed	loopx canary premerge --from-git-diff --git-diff-base origin/main: direct checks, 8/8 catalog canaries and risk-profile smokes passed; 0 manual holds.
unit	failed (pre-existing)	Six failures in a wider 67-file TS selection and two in 28 neighboring Python suites reproduce identically on untouched origin/main (867615e).

• Coverage and gaps: Installed-artifact checks were not run. No PostgreSQL store behavior changes.

Frontend / Visual Evidence

• UI impact: none.
• Before / After / First viewport / States / Source data / Attention / Craft: N/A; no UI surface change.

Type of Change

• Bug fix
• New feature
• Breaking change
• Refactoring (no functional changes)
• Documentation update
• Test update

LoopX Area

• Control plane (goals, todos, quota, scheduler, registry, runtime)
• Benchmark boundary (adapters, runners, verifiers, scoring, evidence)
• Capability or extension (providers, adapters, skills)
• Public docs or presentation surface (README, protocols, dashboard)
• Build, packaging, installer, or CI
• Host or runtime integration

Technical Direction

• Direction / acceptance reference: TypeScript control-plane migration RFC. Unused bridge entry points are surface to delete, not to keep.

Shared-authority RFC fixture impact

• Production-scale fixture schema / semantic dimensions / conformance arms / three-arm rehearsal: N/A; no authority store or persisted format change.

Boundary Checklist

• Reviewed diff and body for private state, credentials, raw traces, internal links and local machine paths; none included.
• No maintainer-owned benchmark work duplicated.
• Change remains scoped to the request described above.
• No RFC pair changed.
• UI impact marked none.
• Every branch commit includes a DCO Signed-off-by trailer (git commit -s).

Merge requires explicit maintainer authorization (effect-runtime RPC surface under loopx/**).

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-02T11:18:01.664368Z	8f4fed0	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[loopx-agent]

Reviewer: model_agent | model=gpt-6.1-sol | provider=OpenAI | reasoning_effort=max | source=runtime_reported

动机 / Motivation

维护同一发布物内 Python 与 TypeScript 控制面调用链的开发者。此前注册表还暴露 19 个已无仓库调用方的叶子 RPC，四个专用导出也只被这些注册或测试使用。本次删除这些入口，让实际调用继续沿用已有完整事务。已验证的变化是注册项从 376 减至 357，当前调用链和租约资格规则保持一致，已删除入口统一拒绝。本次不移动事务权限、不改变租约、调度或审批规则，也不增加新能力和用户操作。已检查范围内没有待补实现；外部未承诺的直连 RPC 使用、其他平台安装及长程净收益不在本次结论中。

改动思路 / Approach

删除无调用入口和专用适配器，保留有进程内消费者的领域函数；统一 dispatcher 继续负责未知方法的拒绝，无需新增状态或兼容路由。本 PR 的边界是同一 source fingerprint 发布物内的无调用 RPC 清理；现有领域规则、provider IO 和用户旅程继续由原 owner 负责。实际仍被使用的领域函数不随入口一起删除，尤其是租约资格的优先级、cadence、planning inventory 与 monitor successor 规则。反向检查覆盖动态方法拼接：authority_core.py 的 todo.{operation}.decide 只生成保留的 terminal / mutation，不生成被删的 claim。旧发布物的 Python 通过包含源码、物理发布路径和解释器的 fingerprint 选择旧 daemon，不应把新发布物的注册表当作跨版本公用 RPC 服务。

具体改动 / Changes

本次按迁移前规范 docs/architecture/rfcs/typescript-control-plane-migration-v0.md，固定 revision 867615e2c3aa2a32516a71d46f11a20d6fcb3289 判断；PR 自己新增的 ledger 是待验证的实现说明。五个生产文件净删除 126 行，五个测试文件把规则断言留在仍被使用的 owner，并增加退役方法的真实 dispatcher 拒绝覆盖。

关键代码讲解

• createEffectRuntimeHandlers：删除 19 个无调用叶子和四个专用适配器；其余仍被进程内使用的函数和 native 注册继续存在。
• dispatchEffectRuntimeMethod：未改变的公共拒绝 owner；查不到精确方法名就返回 unsupported_method，任何 handler 都不会执行。
• leaseOwnerRejection / leaseOwnerConstraint：保留 user_action、unknown owner、excluded agent 等资格优先级；测试改为直接验证真实领域入口，release 仍是受栅栏约束的清理。

RPC-OWNER：implemented。完整调用方扫描包含动态拼接，保留有调用者的 domain 函数；

RPC-FAILCLOSED：implemented。19 个名称经真实 managed transport 均拒绝，shadow 不创建存储；

RPC-DEPLOY：implemented。既有 fingerprint 以源码、物理发布物和解释器隔离版本。

对主干的风险 / Risks

最大风险是把“没有精确字符串”误当作“没有调用方”。本轮对所有 tracked 文件扫描完整名称和被删导出，再用 Python AST 收集变量、常量及 f-string 方法，并逐一检查相关生成范围。当前调用不依赖被删入口；没有据此承诺任意外部 socket 调用者不存在。现有 source fingerprint 的隔离边界也已读取，当前规则没有跨版本共用 daemon。

独立执行 90 个 TypeScript 用例、类型检查与标准 premerge，均为 PASS。公共 Python→managed daemon 路径验证全部 19 个名称为 unsupported_method，现有 fields 完整输出与 base 完全一致；恢复一个被删 handler 的临时突变被独立断言检出。shadow 测试通过真实 dispatcher 验证拒绝后存储为空。测试探针最初漏传既有 observed_at 必填字段，修正后双方同测通过；这是探针修正，没有当作产品缺陷。

兼容性上，shadow 专用退役诊断从 local_authority_shadow_retired 改为 unsupported_method，已明确披露；没有改变仍支持的 CLI 输入、领域状态、默认设置或用户确认步骤。作者披露的更宽套件旧失败和历史并发超时未独立重跑，保留为未知历史证据，不把聚焦结果说成全仓或所有平台合格。

语义与 CI 对齐

复用既有 lease constraint 与 Effect 错误 vocabulary，仅移除无消费者入口。精确方法拒绝和资格检查都是强制边界，未通过文案分类增加领域义务。当前 wait_for_ci=false，未查询 CI；其状态与本轮已验证的变更不变量分开。

我的整体评价 / Verdict

本轮 exact-scope change-quality receipt 为 PASS，覆盖当前未改动 head；它记录评审与校验，不授予合并权限。

当前 head 的有界清理达到所声明目标，APPROVE；删除比保留无消费者协议更合适，不需要借此重写整个领域模块。Long-horizon 为 not_applicable，没有把注册表缩短当作长程效果提升；user_experience 为 preserved，现有支持的 CLI 和用户路径不增加操作。已检查 Effect dispatcher、租约调用及 shadow 配置入口，本次没有页面、布局或交互控件改动。没有视觉改动需要验证；未将源码测试扩展为其他平台或已安装 Host 的资格。 审批不授予合并、dismissal 或安装权限，合并仍须独立 readiness。

English verdict: APPROVE — head 8f4fed0e11c5711e896733f5c9a22c2c54f53dec; 19 unused internal RPCs retire with current callers preserved; local focused tests, typecheck, premerge and public-transport counterfactuals pass.