feat(chat): preserve native requests and read exact manager histories progressively

apps/presentation/dashboard/src/features/personal-workspace/capability-localization.ts

@@ -250,6 +250,10 @@ export function localizedCapabilityFieldCopy(locale: WorkspaceLocale, capability
     label: "Codex", description: "仅作用于支持的 Codex 心跳；显式关闭的实验保持关闭。", options: {off: "关闭", on: "开启"},
   } : {
     label: "Codex", description: "Applies only to supported Codex heartbeats; explicitly disabled runs stay disabled.", options: {off: "Off", on: "On"},
+  }, antigravity_mode: locale === "zh-CN" ? {
+    label: "Antigravity", description: "仅作用于强能力 Antigravity 管家的交付历史渐进读取；关闭时保持完整内联。", options: {off: "关闭", on: "开启"},
+  } : {
+    label: "Antigravity", description: "Applies only to progressive history reads in trusted-owner Antigravity manager sessions; off keeps full inline input.", options: {off: "Off", on: "On"},
   }};
   if (capabilityId === "codex_chat") return {...fieldCopy[locale], ...(locale === "zh-CN" ? {
     codex_profile: {label: "Codex 配置来源", description: "选择已有本机配置，例如 codex-gpt。账户和凭据留在原目录，不复制；留空继承服务配置。"},

apps/presentation/dashboard/src/features/personal-workspace/machine-configuration-settings.tsx

@@ -279,10 +279,10 @@ export function MachineConfigurationSettings({ section, onChanged }: {
     setNotice(null);
   }
 
-  async function setContextDelivery(mode: "off" | "on") {
+  async function setContextDelivery(mode: "off" | "on", key: "mode" | "antigravity_mode" = "mode") {
     if (busy || !editorAvailable || selected?.capability_id !== "context_delivery" || !selected.machine_namespace) return;
     const namespace = selected.machine_namespace;
-    const configuration = {...selected.default, mode};
+    const configuration = {...selected.default, ...selectedCurrent, [key]: mode};
     const generation = editorGeneration.current;
     setBusy("apply"); setError(null); setNotice(null);
     try {
@@ -295,10 +295,11 @@ export function MachineConfigurationSettings({ section, onChanged }: {
       if (generation !== editorGeneration.current) return;
       setInspection(next);
       setReadbackPending(null);
-      if (next.machine_configuration?.namespaces[namespace]?.mode !== mode) {
+      if (next.machine_configuration?.namespaces[namespace]?.[key] !== mode) {
         throw new Error(locale === "zh-CN" ? "保存后的配置已变化，请刷新后重试。" : "The saved configuration changed. Refresh and retry.");
       }
-      setNotice(locale === "zh-CN" ? "Codex 偏好已保存。" : "Codex preference saved.");
+      const targetLabel = key === "antigravity_mode" ? "Antigravity" : "Codex";
+      setNotice(locale === "zh-CN" ? `${targetLabel} 偏好已保存。` : `${targetLabel} preference saved.`);
       onChanged?.();
     } catch (cause) {
       if (generation === editorGeneration.current) setError(cause instanceof Error ? cause.message : t("machine.applyError"));
@@ -530,16 +531,24 @@ export function MachineConfigurationSettings({ section, onChanged }: {
               <span>Codex</span>
               <input aria-label={locale === "zh-CN" ? "在 Codex 中使用差分上下文" : "Use differential context in Codex"}
                 type="checkbox" role="switch" checked={(selectedCurrent?.mode ?? selected.default?.mode) === "on"} disabled={Boolean(busy) || !editorAvailable}
-                onChange={(event) => void setContextDelivery(event.target.checked ? "on" : "off")} />
+                onChange={(event) => void setContextDelivery(event.target.checked ? "on" : "off", "mode")} />
+            </label><label className="is-boolean">
+              <span>Antigravity</span>
+              <input aria-label={locale === "zh-CN" ? "在 Antigravity 中渐进读取管家历史" : "Use progressive manager history in Antigravity"}
+                type="checkbox" role="switch" checked={(selectedCurrent?.antigravity_mode ?? selected.default?.antigravity_mode ?? "on") === "on"} disabled={Boolean(busy) || !editorAvailable}
+                onChange={(event) => void setContextDelivery(event.target.checked ? "on" : "off", "antigravity_mode")} />
             </label></div>
             <p role="status">{(selectedCurrent?.mode ?? selected.default?.mode) === "on"
               ? selectedCurrent
                 ? locale === "zh-CN" ? "已开启；原生初始化与实际使用尚未验证。" : "On; native setup and use unverified."
                 : locale === "zh-CN" ? "默认开启；原生初始化与实际使用尚未验证。" : "Default on; native setup and use unverified."
               : locale === "zh-CN" ? "Codex 已关闭。" : "Off for Codex."}</p>
-            <ContextHelp label={locale === "zh-CN" ? "Codex 支持范围与生效条件" : "Codex support and activation requirements"}><p>{locale === "zh-CN"
-              ? "受支持的 POSIX Codex App／SSH 和 benchmark 心跳默认开启；已保存的关闭继续生效，benchmark trial 可单独显式关闭。其他应用和平台保留完整交付；显式开启遇到未知或冲突跑法会报错。保存偏好不代表当前会话已采用差分。宿主就绪且旧上下文完整时才使用差分，否则完整恢复；私有存储与会话隔离自动管理。"
-              : "Defaults on for supported POSIX Codex App/SSH and benchmark heartbeats. Saved off is preserved; benchmark trials can explicitly disable it independently. Other applications and platforms retain full delivery. Explicit on rejects unknown or conflicting modes. Saving a preference does not establish current-session adoption. Delta needs a ready host and complete retained context; otherwise full context is restored. Private storage and session isolation are automatic."}</p></ContextHelp>
+            <p role="status">{(selectedCurrent?.antigravity_mode ?? selected.default?.antigravity_mode ?? "on") === "on"
+              ? locale === "zh-CN" ? "Antigravity 管家历史渐进读取已开启。" : "Antigravity progressive manager history is on."
+              : locale === "zh-CN" ? "Antigravity 已关闭。" : "Off for Antigravity."}</p>
+            <ContextHelp label={locale === "zh-CN" ? "Codex 与 Antigravity 支持范围与生效条件" : "Codex and Antigravity support and activation requirements"}><p>{locale === "zh-CN"
+              ? "Codex（mode）与 Antigravity（antigravity_mode）独立控制：受支持的 POSIX Codex App／SSH 和 benchmark 心跳默认开启差分，已保存的关闭继续生效，benchmark trial 可单独显式关闭；强能力 Antigravity 管家默认开启私有快照的交付历史渐进读取，关闭时保持完整内联。其他应用和平台保留完整交付；显式开启遇到未知或冲突跑法会报错。保存偏好不代表当前会话已采用差分。宿主就绪且旧上下文完整时才使用差分，否则完整恢复；私有存储与会话隔离自动管理。"
+              : "Codex (mode) and Antigravity (antigravity_mode) are controlled independently: supported POSIX Codex App/SSH and benchmark heartbeats default on (saved off is preserved; benchmark trials can disable it independently), while trusted-owner Antigravity manager turns default on for progressive private-capture history reads and keep full inline input when off. Other applications and platforms retain full delivery. Explicit on rejects unknown or conflicting modes. Saving a preference does not establish current-session adoption. Delta needs a ready host and complete retained context; otherwise full context is restored. Private storage and session isolation are automatic."}</p></ContextHelp>
           </section> : null}
           {editorAvailable && selected.capability_id !== "context_delivery" ? <>{editorMode === "json" || !selected.configuration_editor.fields.some((field) => field.key === "enabled" && field.input_kind === "boolean") ? <div className="personal-capability-editor-mode">
             <button disabled={Boolean(busy)} onClick={() => changeMode(editorMode === "guided" ? "json" : "guided")} type="button">

docs/architecture/rfcs/manager-runtime-profile-v0.md

@@ -62,6 +62,32 @@ These defaults do not change ordinary Goal Chat models or grant other Agents too
   steps to be done, matching native result recovery's completion requirement.
   Transient idle does not extend the existing no-progress or hard deadline. Permission gates,
   native errors, unverified stop reasons and another input retain their existing refusal paths.
+- Antigravity manager inputs place the complete original user message before the frozen Core
+  evidence, encoding that message as a JSON string so whitespace and quoted transport markers
+  remain exact. Original-result recovery recognizes both this framing and historical
+  evidence-first inputs, with the same source, input-time, prompt-hash and native terminal
+  checks.
+- A trusted-owner Antigravity manager can read supporting delivery histories progressively
+  through the existing private capture/JSON Pointer CLI. Current Goal, Todo, attention,
+  permission and source-quality fields, including unknown fields, stay inline. Only a known
+  `recent_delivery_history.deliveries` payload is deferred: its window, coverage and source
+  metadata remain visible, with `status=not_read` and an executable read reference. The
+  complete originally supplied Core snapshot remains recoverable. For example,
+  `/goals/0/recent_delivery_history` addresses the first Goal's captured history; use its
+  emitted selection command, or the index command when the address is unknown. This is a
+  frozen snapshot reader, not the Codex-only live `loopx_manager_read` tool or a delta baseline.
+  Before relying on that history, read the required section through its final page. Context
+  loss recovers from the same capture without resending the request or repeating effects.
+- The machine `context_delivery.antigravity_mode=off` preference or host environment
+  `LOOPX_CONTEXT_DELIVERY=off` keeps subsequent native manager inputs fully inline, while
+  `context_delivery.mode` remains the independent Codex preference.
+  Restricted/text-only hosts, invalid settings and unavailable private capture IO also retain
+  that input; no host permission or approval is changed. These references preserve only the
+  already-authorized snapshot, not fresh observation or action authority. Capture files stay
+  private in the Chat store, outside the selected project's checkout. RPC and real CLI
+  fixtures qualify input, recovery and refusal behavior; actual model reads, installed host
+  limits, full costs and long-horizon benefit remain separate qualifications. Codex delta
+  activation and native-hook continuity are unchanged.
 - `trusted_owner` applies to the local private owner-manager and a native private steward
   binding freshly verified by the existing Core conversation owner. That owner checks the
   App, owner principal, private source, current resource grant and frozen Session identity.

docs/architecture/rfcs/manager-runtime-profile-v0.zh-CN.md

@@ -50,6 +50,24 @@ LoopX 管家最初只有受限的规划会话：它可以读取 LoopX 提供的
   LoopX 继续观察原调用，不重发输入；最终答案须带正常停止标记，且本次覆盖的全部步骤均
   已完成才能收尾，与原生结果恢复的完成要求一致。短暂 idle 不延长既有无进展或硬截止
   时间；权限等待、原生错误、未核验的停止原因及另一个输入仍沿既有拒绝路径处理。
+- Antigravity 管家输入先呈现完整用户原话，再附上冻结的 Core 证据；用户原话按 JSON
+  字符串编码，保留空白和被引用的传输标记。原始结果恢复同时识别新格式与历史上的
+  证据在前格式，沿用同一来源、输入时间、prompt hash 和原生终止检查。
+- 强能力 Antigravity 管家可通过既有私有 capture/JSON Pointer CLI 渐进读取支撑用的
+  交付历史。当前 Goal、Todo、attention、权限、来源质量及未知字段仍内联保留；只将已知
+  `recent_delivery_history.deliveries` 正文移到按需读取，其窗口、覆盖及来源元数据仍可见，
+  同时明确 `status=not_read` 并给出可执行读取引用。原先供应的完整 Core 快照仍可恢复。
+  例如 `/goals/0/recent_delivery_history` 是首个 Goal 的已捕获历史地址：知道地址时直接
+  执行供应的选择命令，不知道时再查目录。这是冻结快照读取，不是 Codex 专属的实时
+  `loopx_manager_read` 工具或差分基线。依赖该历史前，应读完所需片段的全部页；上下文
+  丢失后从同一 capture 恢复，不重新发送请求或重复副作用。
+- 机器配置 `context_delivery.antigravity_mode=off` 或宿主环境变量 `LOOPX_CONTEXT_DELIVERY=off`
+  使后续原生管家输入保持完整内联，`context_delivery.mode` 仍保持为独立的 Codex 偏好。
+  受限/文本宿主、配置损坏或私有 capture IO 不可用时
+  也保留原输入，不改变宿主权限或审批。引用只保留原已授权快照，不是新鲜观察或动作
+  授权；capture 私有保存于 Chat 存储，不写入所选项目的检出目录。RPC 与真实 CLI fixture
+  验证输入、恢复及拒绝行为；真实模型读取、已安装宿主限制、完整成本和长程收益仍需
+  独立资格。Codex 差分激活与 native-hook 连续性不变。
 - `trusted_owner` 适用于本地私有 Owner 管家和由既有 Core conversation owner 重新核验的
   原生本人管家私聊。Core 核验 App、Owner 身份、私聊来源、当前资源授权和冻结的 Session
   身份；受众证明本身不授予工具，仍按实际机器策略执行，包括显式受限选择。其他外部

docs/reference/required-work-context.md

@@ -511,19 +511,22 @@ the existing Turn or its recovery files.
 
 ### Machine default
 
-**Settings → This machine → Capabilities → Differential context → Codex** uses the
+**Settings → This machine → Capabilities → Differential context** exposes independent
+application rows for **Codex** (`mode`) and **Antigravity** (`antigravity_mode`), using the
 existing revision-locked preview, apply and readback operations in one switch action.
 Switching off uses the same transaction. A saved preference does not certify native
 host setup or actual delta use; the settings view states this explicitly. Its
 `context_delivery` machine namespace accepts
-`{"schema_version":"context_delivery_machine_defaults_v0","mode":"off"}` or
-the same object with `"mode":"on"`. The CLI exposes that same owner through
+`{"schema_version":"context_delivery_machine_defaults_v0","mode":"off","antigravity_mode":"on"}`
+(or `"off"`/`"on"` for either field; omitting `antigravity_mode` defaults it to `"on"` while
+preserving the saved `mode`). The CLI exposes that same owner through
 `machine-config preview/apply --namespace context_delivery --config-json FILE`;
-apply requires the exact preview revision. Removing the namespace restores the on default for supported native Codex sessions; save `mode: "off"` to keep it disabled.
-Sibling settings and Goal records are preserved. The application row selects Codex
-within this capability; the existing `mode` remains that Codex preference, with no
-additional global switch or host configuration authority. Read-only editors cannot
-save it. The UI does not alter other hosts or initialize the current native session.
+apply requires the exact preview revision. Removing the namespace restores the on defaults for supported native Codex sessions and trusted-owner Antigravity manager history reads; save `mode: "off"` or `antigravity_mode: "off"` to keep either application disabled independently.
+Sibling settings and Goal records are preserved. The Codex row (`mode`) remains scoped to Codex,
+while `antigravity_mode` controls progressive private-capture reads of `recent_delivery_history`
+in trusted-owner Antigravity manager turns (`off` or `LOOPX_CONTEXT_DELIVERY=off` keeps full inline input),
+with no additional global switch or host configuration authority. Read-only editors cannot
+save it. Each application row leaves the other host unchanged and does not initialize the current native session.
 
 An explicit `--context-delivery on|off` wins; otherwise each invocation reads the
 machine preference, preserving a saved off. An absent preference defaults on only
@@ -872,15 +875,14 @@ quota 能力候选沿用同一精确 codec 复用已登记 Todo 的正文、标
 
 ### 机器级默认
 
-在**设置 → 本机设置 → 能力中心 → 差分上下文 → Codex**选择关闭或开启，沿用现有
-精确修订预览、应用和读回，由一次开关操作完成；关闭也使用同一事务。
+在**设置 → 本机设置 → 能力中心 → 差分上下文**分别提供 **Codex**（`mode`）与 **Antigravity**
+（`antigravity_mode`）两行独立开关，沿用现有精确修订预览、应用和读回，由一次开关操作完成；关闭也使用同一事务。
 设置页明确区分已保存偏好与尚未验证的原生初始化、实际差分使用。机器 namespace 为 `context_delivery`，配置为
-`{"schema_version":"context_delivery_machine_defaults_v0","mode":"off"}`；开启时
-把 `mode` 改为 `on`。CLI 的 `machine-config preview/apply --namespace context_delivery
---config-json FILE` 使用同一 owner；应用须带原预览修订。移除此 namespace 恢复受支持 Codex 原生会话的默认开启；保持关闭须保存 `mode: "off"`，
-不改写其他配置和 Goal 记录。应用行选择的是此能力下的 Codex；既有 `mode` 仍表示
-该 Codex 偏好，不新增总开关或宿主配置 authority。只读编辑器不能保存；界面不会
-改变其他应用或初始化当前原生会话。
+`{"schema_version":"context_delivery_machine_defaults_v0","mode":"off","antigravity_mode":"on"}`
+（两个字段各自支持 `"off"` 或 `"on"`；省略 `antigravity_mode` 时默认 `"on"` 并保留所选 `mode`）。CLI 的 `machine-config preview/apply --namespace context_delivery
+--config-json FILE` 使用同一 owner；应用须带原预览修订。移除此 namespace 恢复受支持 Codex 原生会话与强能力 Antigravity 管家历史渐进读取的默认开启；保持关闭须分别保存 `mode: "off"` 或 `antigravity_mode: "off"`，
+不改写其他配置和 Goal 记录。`mode` 仍表示 Codex 偏好，`antigravity_mode` 控制强能力 Antigravity 管家是否将 `recent_delivery_history` 移至私有快照渐进读取（`off` 或 `LOOPX_CONTEXT_DELIVERY=off` 保持完整内联），
+不新增总开关或宿主配置 authority。只读编辑器不能保存；两行应用开关互不影响，也不会初始化当前原生会话。
 
 显式 `--context-delivery on|off` 优先；省略时每次读取机器设置，已保存的关闭继续生效。
 未配置时，仅在受支持的 POSIX Codex App／SSH 和已声明的 benchmark 心跳入口默认开启；

loopx/capabilities/configuration_ui.py

@@ -89,9 +89,14 @@ def capability_configuration_editor(
     definitions: dict[str, dict[str, Any]] = {
         "context_delivery": {
             "supported_scopes": ["machine"], "writable_scopes": ["machine"],
-            "fields": [_field("mode", "Codex App / benchmark heartbeats", "select",
-                options=CONTEXT_DELIVERY_SETTINGS, required=True,
-                description="On accepts only declared Codex App or benchmark heartbeats. Native host setup is still required; unsupported or unknown modes return an error.")],
+            "fields": [
+                _field("mode", "Codex App / benchmark heartbeats", "select",
+                    options=CONTEXT_DELIVERY_SETTINGS, required=True,
+                    description="On accepts only declared Codex App or benchmark heartbeats. Native host setup is still required; unsupported or unknown modes return an error."),
+                _field("antigravity_mode", "Antigravity manager history", "select",
+                    options=CONTEXT_DELIVERY_SETTINGS, required=True,
+                    description="On defers trusted-owner Antigravity manager delivery histories to private capture reads while keeping current facts inline; off keeps full inline input."),
+            ],
         },
         "codex_chat": {
             "supported_scopes": ["machine"], "writable_scopes": ["machine"],