[loopx-agent]

Goal And Delivered Outcome

• Outcome basis / optional anchor: Reproduced CLI recovery defect; adjacent to the single-session recovery boundary in the controller/executor RFC. This PR does not qualify that RFC as delivered.
• Goal/source and gap: A native Todo update/complete refusal could suggest a claim, inspect or retry command using global loopx, lose the selected registry/runtime, or drop the original operation arguments. A preview could also suggest a mutating recovery command.
• Observable before → after: Returned JSON argv and rendered Markdown retain the selected CLI, registry/runtime, actor, Todo and original retry inputs, including --dry-run. The baseline rejects all eight recovery/preview cases; the candidate passes them through real generated commands (validation below).
• Issue/task and intended base: Self-contained defect repair, targeting main; validated baseline fb16c6cb1369efce52a673030c914b38e1dac166. Follows the already-merged fix(cli): preserve explicit runtime through claim and lease recovery #7885; this independent branch contains only the remaining refusal-recovery fix.

Author Declaration

• Written by: model_agent — OpenAI GPT-6 / Codex.

Implemented against

• Specification and revision: Existing Todo/lease grammar and CLI route behavior at fb16c6cb1369efce52a673030c914b38e1dac166; the bounded defect repair described in this PR is the acceptance basis.
• Criteria:

Criterion	Disposition	Symbol / path	Test or command
Generated native recovery commands retain the selected program and authority route	implemented	_route_native_recovery in loopx/cli_commands/todo_event.py; loopx/control_plane/todos/markdown.py	tests/control_plane/test_todo_claim_argument_recovery.py
Claim/retry retain original inputs and preview semantics	implemented	Existing TODO_OPTION_FIELDS and shared cli_option_args	Same tests: File/SQLite update/complete, option-looking Unicode values, preview, returned argv execution
Existing permission, CAS, replay and display behavior remains intact	implemented	Existing Core Todo/lease owner; update handoff-mode rendering	Eleven owning test modules, including lease and administrative journeys

• Self-check before submission: Read the existing command owner, repository contribution/quality rules and adjacent recovery tests. Ran baseline counterexamples, owning regressions, a fresh wheel outside the checkout, static checks, exact-diff change-quality qualification and standard premerge. Installed-host adoption and independent review remain unverified.

Scope And Continuation

• Completed scope and remaining work: Complete within this CLI recovery scope. Reuses the existing option codec and Todo grammar; preserves update handoff-mode display and keeps malformed optional guidance from hiding the original refusal. No new capability, authority rule, provider promotion, persisted schema or execution grant.
• Slice boundary / successor: A separately reviewable and reversible adapter/rendering fix. CI, independent review and any subsequent release/installed adoption remain separate. No new successor task is needed for the completed author scope.

Validation

• Tested revision: 1e5bedbad50509747e659bc992f2d921fc9ae87c.
• Publication base readback: 15aa574507971b03b81ad7988f844c257a113476 (main advanced through test(context): size settlement fixture from RPC limit #7897 while publishing). The two new main commits only change tests/control_plane/test_quota_settlement_cli.py, with no overlap in these six paths. Local qualification above remains bound to baseline fb16c6cb; current CI/review and exact-head merge readiness are separate.
• Run state: finished.
• Input classes: synthetic, public_fixture.

Check kind	Result	Public-safe evidence / limitation
regression_parity	passed	On clean baseline fb16c6cb, all eight selected refusal/preview cases fail: six select the poisoned global CLI or wrong route, two omit --dry-run. The exact candidate passes all eight.
real_entrypoint / real_backend	passed	Real File and SQLite stores, Core runtime and CLI JSON/Markdown; execute generated commands from outside the checkout using a quoted CLI alias and a poisoned global executable. Verify wrong-actor refusal, stale proof inspection, original retry inputs, idempotent replay and preview no-write behavior.
unit / integration	passed	185 tests across eleven owning modules, including Todo claim/update/source routing/Markdown/administrative/native ownership/completion, task-lease grammar/worktree and deferred lease recovery; 272.51 s.
real_entrypoint	passed	A newly built wheel repeats the eight recovery/preview cases outside the source checkout; 22.10 s. The four changed product modules match the tested source. This is isolated packaged validation, not a live installation.
static	passed	Configured mypy target set: 17 files. Ruff: all six changed paths. Diff hygiene, changed Python compilation and bilingual RFC diff check pass.
static	failed	Optional two-module strict mypy analysis retains six baseline diagnostics: four Markdown optional-value errors, one existing TaskLeaseError re-export and one settlement-identity narrowing error. Clean baseline and head match by full normalized diagnostics, source statements, environment and command. Failure remains recorded; it is not a passing check or a CI waiver.
static / manual	passed	Exact-base/head change-quality receipt verified valid; baseline attribution retained for the optional failure. Public/private scan: zero errors/warnings. Shared codec extraction has two active callers and existing grammar parity coverage.
integration	passed	Standard loopx canary premerge --from-git-diff --git-diff-base origin/main: six direct checks plus 18 selected/executed checks, zero failures/skips/manual holds; 133.38 s.
manual	not_run	Windows alias execution, real PostgreSQL integration, independent review and installed-host adoption. No PostgreSQL store or authority behavior changes in this adapter/rendering diff; PostgreSQL conformance is not claimed.

• Coverage and gaps: Runtime tests exercise actual generated commands and durable readback, alongside default-program and unchanged permission/CAS/replay behavior. An initial broader mypy invocation also failed with a mixed import graph and is not used as candidate qualification; the controlled baseline/head comparison above is the retained optional analysis. Windows execution and CI remain separate. Passing author validation grants no merge authority.

See validation disclosure guidance.

Frontend / Visual Evidence

• UI impact: none; existing CLI JSON/Markdown recovery output only, no frontend layout or product journey added.
• Before / after: Covered by executable recovery/preview comparisons above.
• First viewport and preview / states and viewports / attention and craft review: N/A; no graphical UI change.
• Source data: synthetic.

Type of Change

• Bug fix
• Test update

LoopX Area

• Control plane (goals, todos, quota, scheduler, registry, runtime)
• Host or runtime integration

Technical Direction

• Core control-plane hardening; existing controller/executor single-session recovery. This bounded adapter fix does not certify shared-authority migration, cross-host adoption or long-horizon effectiveness/efficiency.

Shared-authority RFC fixture impact

• N/A: No shared-authority or TypeScript migration completion claim, authority-store change, provider promotion or compatibility-projection change.

Boundary Checklist

• Neither diff nor proposal discloses private state, credentials, raw traces/verifier output, internal links or local machine paths.
• No duplicate maintainer-owned benchmark work.
• Change remains scoped to the demonstrated recovery defect.
• No paired RFC changed; the bilingual diff check passes.
• UI impact marked none.
• Every commit includes a DCO Signed-off-by trailer.

[loopx-agent]

Reviewer: model_agent | runtime_reported | model=gpt-6.1-sol | provider=OpenAI | reasoning_effort=max

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

动机 / Motivation

通过指定 CLI 安装和 registry/runtime 管理任务、在领取证明被拒绝后需要继续原操作的用户与 Agent。旧版拒绝任务操作后，生成的恢复命令可能切换到 PATH 上另一份 loopx，丢失原路由或重试参数；新版让调用者沿原安装显式领取，再提交原来的备注或完成结果，预览仍不写状态。File/SQLite 的 update/complete × 预览/执行八组真实命令都保留选定程序；非预览恢复后原 note/evidence 成功读回，预览与错误 actor 无状态变化，重放无重复效果。不更改领取权限、CAS、持久 schema 或 provider；不自动领取、不替换别人的证明，也不宣称已安装到用户环境。

改动思路 / Approach

程序和参数编码复用现有 invocation owner，权限判断留在原 typed Todo/lease owner；在 CLI 输出边界修复路由，比新增第二套领取或重试状态机更小。当前边界是拒绝之后可执行的原路由恢复和原操作读回，不增加产品能力、授权 owner 或状态迁移。 将“允许记录已验证进度/恢复提示”与“授予执行和最终验收”分开是必要的最小修复；单纯放宽错误码或替换一处显示字符串不能完成原任务。保留原 owner 与调用顺序，没有新建权限体系或持久影子状态。

具体改动 / Changes

审阅全部六个增量文件（+213/-22）。CLI adapter 复用 TODO_OPTION_FIELDS 重建原 retry 参数，保留 actor、Todo、project/state-file、备注、证据、clear 与 update operation identity。shared option codec 延续 task-lease 原有规则，避免合法减号开头的值变成参数；ContextVar 只在本次调用中绑定程序，finally 复位。Markdown 采用同一 descriptor 的 program 和 argv，坏的可选 guidance 不吞掉原拒绝。

• _route_native_recovery：只适配原拒绝给出的 descriptor，在同一调用内带回 program、递归 cli-bin、registry/runtime 与原操作参数，不改变恢复资格。

• cli_option_args：把以减号开头的合法值编码成 flag=value；从 task-lease 抽取原规则，并由两个实际调用者共享。

• _render_lease_recovery：从 descriptor 选择原 program，使用已绑定 cli_args 渲染可执行命令；JSON 与 Markdown 不再选择不同安装。

修改前契约：docs/reference/canonical-lease-renew.md，不可变版本 fb16c6cb1369efce52a673030c914b38e1dac166。采用原文节标题作为 criterion_id：

• Ordinary task operations：普通领取/更新/完成保留当前调用路由与原输入；提示不授予权限，预览不可写状态。 implemented，由上述源码和本轮真实入口/负例/重放验证。

• Commit, retry and readback：拒绝后显式新 claim 再重试原操作，保留 actor、身份与原工作意图，重放不重复效果。 implemented，由上述源码和本轮真实入口/负例/重放验证。

对主干的风险 / Risks

PATH 指向退出86的另一安装；预览不能领取、错误 actor 不能借新证明写任务。 本轮在 File/SQLite 的 update/complete × 预览/执行八组场景实际执行 JSON/Markdown 发出的命令，使用带引号的 CLI alias，并将全局 loopx 设为退出86的其他程序。base 八组真实命令失败；head 八组选择正确安装。四组非预览恢复后原备注和证据可独立读回；错误 actor 拒绝、预览不写、retry 重放无重复效果。112 Python、配置 mypy 的17个文件、changed-path Ruff 和标准 premerge PASS。作者额外报告的 optional strict mypy 六项旧诊断不被冒充本轮通过或已独立归因；本轮必要的配置检查与改变的不变量已有独立证据。

按当前策略未获取、轮询或等待远端 CI。File/SQLite 为隔离真实 backend，不是模型采纳或安装后资格；Windows 原生执行和实 PostgreSQL 未跑，当前增量不改对应 store/authority owner。未以此修改要求或宣称其他未验证维度通过。

我的整体评价 / Verdict

APPROVE：未发现当前功能阻塞项。 程序和参数编码复用现有 invocation owner，权限判断留在原 typed Todo/lease owner；在 CLI 输出边界修复路由，比新增第二套领取或重试状态机更小。当前边界是拒绝之后可执行的原路由恢复和原操作读回，不增加产品能力、授权 owner 或状态迁移。已检查六个增量文件及 Todo CLI JSON/Markdown 输出，没有图形页面布局变更。视觉未验证范围：无适用的图形页面变更；运行边界是精确 head 的隔离 source checkout。作者与当前 GitHub 账号相同，因此以 COMMENTED 发布批准结论；不将其称为 GitHub 正式自批准。当前 bounded 修复有真实可用结果，不需要为已完成修复另建仪式性后续任务。模型采纳、安装 Host、长期完整成本/净收益仍未验证；没有执行合并或部署。

English verdict: APPROVE — head 1e5bedbad50509747e659bc992f2d921fc9ae87c; no blocking findings. Real File/SQLite generated-command execution preserves the selected CLI, preview and original retry intent; configured static checks and premerge pass. Published as an author-owned COMMENTED approval conclusion.