[JasonBuildAI]

Summary

Proposes a bounded code-owner route for @JasonBuildAI covering runtime/daemon recovery and the private I/O boundary those recovery paths use:

• loopx/control_plane/effect_runtime.py
• loopx/control_plane/effect_runtime_snapshot.ts
• loopx/control_plane/runtime/document_io.py
• loopx/control_plane/runtime/private_permissions.py
• Focused recovery, locator, source-read batching, document I/O, host-permission and Windows snapshot privacy tests

Canonical Goal creation and recovery remain a first-review responsibility rather than part of this code-owner route; that part of the accepted scope still needs cross-author evidence.

Eligibility

• Repository Write is active.
• The bounded runtime-recovery and I/O scope is accepted at #4069.
• Three substantive cross-author reviews in the preceding eight weeks:
  • #7748 review 5722942099 at head 249773887ce8c0903208f8f7308a099914010105: private source-digest freshness in the effect runtime.
  • #7743 review 5722842303 at head 859ffd84bdd0bb8bfb9d9eda63344572ebe77fcf: startup diagnostic recovery.
  • #7603 review 5762728646 at head c4c79652ed91bd31967f07e44ed89d33085f17f6: private I/O, ACLs and Windows long paths.

Each review names the reviewed head, the governing invariant and validation performed.

Scope and exclusions

The route covers runtime recovery and the runtime/daemon I/O boundary it depends on: interrupted recovery paths, damaged or stale locator routes, lock records and route discovery, long-path handling, private-file ACLs, stdio/UTF-8 pinning, helper-process lifetime and focused regressions.

The following remain outside this route:

• Chat/session lifecycle and Turn stop/resume semantics routed to @Duang777;
• Windows installer paths and the four Windows files under @BigDataDZ's code-owner route;
• shared Goal authority, quota and lease policy;
• CI/release policy, bypass and security-sensitive handling.

Changes crossing those boundaries require separate review or a maintainer decision. This PR grants no Maintain role or bypass.

Validation

• uv run --extra test python -m pytest tests/test_codeowners.py -q: 2 passed.
• git diff --check: passed.
• examples/docs-governance-smoke.py reaches the pre-existing stale RFC status index for STATUS.md and STATUS.zh-CN.md; this PR does not modify either file.

Maintainer approval is required. This PR does not claim merge authority.

[loopx-agent]

Reviewer: model_agent · gpt-6.1-sol · OpenAI · max · runtime_reported

APPROVE — 当前 exact head 未发现 blocking finding。 资格、路径和现有所有者均作了独立核验；任命合入与 protected-branch readiness 仍由维护者处理。

动机

受影响的是需要为 runtime 启动恢复、locator 和私有文件 I/O 寻找负责审阅者的贡献者。此前 JasonBuildAI 已公开接受该范围并有 Write 权限，但仍只列作 first-review 联系人，GitHub 的路径规则不会把相应文件路由给他。这个 PR 把有现成跨作者评审证据的十个精确路径加入现有 CODEOWNERS，并同步说明资格与剩余边界。可观察结果是将来的匹配路径可以请求这一技术 code owner，同时保留所有现有审阅者。

目标是补齐一个有证据支撑的审阅路由，不是任命 repository maintainer，也不是授予 Maintain、admin bypass、发布、安全事件处理或全仓库批准权限。更广的 canonical Goal 创建/恢复仍保留 first-review 状态；没有为满足数量要求而制造新实现任务。

改动思路

固定评审 1a5bf1dea4db433e073708dc126e047e92556bcc，base a0130633723210a5406dca61ee27aa33fe48b3f3。本轮先按旧版治理资格逐项核验，再评估作者提出的范围，未用这次新增的说明反向证明资格。保留现状会使已接受且已有 review 活动的路径仍缺少明确 code-owner 路由；为整个 runtime 子树加通配符又会覆盖没有证据的共享 authority 路径。十个 root-anchored 精确文件复用 GitHub 的 last-match 规则，是更小且可回滚的边界。

每条新规则都保留 huangruiteng、songoow 和 loopx-agent。文件规则只影响技术审阅资格，不改变运行时 actor、Todo/lease 状态或执行权限；GitHub 的 code-owner requirement 仍以 PR 的 base branch 规则为准，提议文本不会让尚未合入的路径规则提前生效。公共 roster 和 first-review 表同步更新，且保留不足以升级的 canonical Goal 范围。

具体改动

.github/CODEOWNERS:78–89 新增 runtime owner、snapshot、document/private-permissions 及六个 focused test 文件，共十条精确规则；它们位于 Windows installer 和治理保护规则之前。.github/GOVERNANCE.md 同时加入 bounded roster、资格证据链接和排除范围，没有更改原资格门槛或 lead maintainer 的最终任命权。

独立路径探针用仓库现有 _load_codeowners / _owners_for_path，对两个修订的 7,334 个 tracked paths 比较最终匹配结果：只有这十个路径增加 JasonBuildAI，所有原有 owners 均保留。另核对四个 Windows installer 专属路径、共享 Goal/Todo/quota 路径、治理/CI/发布路径与未来 runtime 文件，均无新增覆盖。GitHub 针对该精确 head 返回的 CODEOWNERS errors 为 []。

规格为 .github/GOVERNANCE.md#code-owner-eligibility，修订 a0130633723210a5406dca61ee27aa33fe48b3f3：

criterion_id	独立证据及 disposition
repository write access	implemented：GitHub collaborator permission 为 write；push=true，admin/maintain=false。
publicly accepted a cohesive path scope	implemented：issue #4069 的公开接受 包含 runtime/daemon 恢复及其私有 I/O，明确保留可用性和回避边界。
three substantive cross-author reviews	implemented：7748、7743、7603 均在八周内，由 JasonBuildAI 评审其他作者，正文具有 exact head、invariant 和已执行验证说明。
coherent set of paths	implemented：十条路径集中在 runtime/daemon I/O，独立 last-match 比较证明没有变成整个 control-plane wildcard。

这里保留一项来源细节：7743 的 GitHub review commit_id 为 859ffd84bdd0bb8bfb9d9eda63344572ebe77fcf，当前正文明确复审并给出 verdict 的 head 是 ed1c2ae62f7e64b242f6c323fad72f43b5754208。我按正文实际命名的复审 head 核对“有 exact head/invariant/validation 的跨作者评审”这一资格，而没有声称两者相同或认证历史技术判断。另两条正文与 API commit 一致；本轮资格核验不重跑历史 PR 或替它们作新批准。

对主干的风险

最强风险是较后的 CODEOWNERS 规则覆盖旧规则，悄悄移除现有 owner，或把 Windows/shared authority 等未接受范围一并升级。逐 tracked-path 比较和排除路径反例均未发生这些情况；新规则没有 broad glob、没有覆盖目录，也未改变 Windows 四文件的现有所有者。两侧 tests/test_codeowners.py 都为 2 passed，diff hygiene 和公共边界检查通过。

原生 quick premerge 在该 head 通过：四项直接检查及一项 changed-public-file boundary check，CQR cqr_1f6ade9b5b6849612fd3 为 pass。额外的 examples/docs-governance-smoke.py 在 base/head 都失败于旧的双语 RFC STATUS 索引；保留了原失败，以完整 traceback（仅规范化 checkout root）、完整未变 RFC 输入和相同环境作对照，未重生成或放宽索引。它是范围外的可复现旧失败，不是这个路由改动的通过项；本地必需的 owner、资格、路径和边界检查独立覆盖两个 changed files。没有查询或等待 CI。

本 PR 没有 rendered UI 变化，因此 visual_review 不适用；检查的是 GitHub path routing 与治理文本。权限观察是当前时点的事实，未来撤销 Write 会让 GitHub 不再承认相应 code owner，维护者仍应按治理约定复查活动与范围。技术 APPROVE 不是提前合入路由或越权批准其他变更。

我的整体评价

这是一项完整且比例合适的治理维护：它复用既有路由与资格 owner，同步两个公共文件，给出接受范围和实质跨作者活动，而非以作者 PR 数、一般声誉或声明充当资格。长期价值是让后续恢复/I/O 评审有更明确的负责路径，尚未用团队响应时间、缺陷率或评审次数证明净收益。用户旅程不新增配置或确认，也没有给未来无关路径附加门槛。

bounded refactor pass 判定无需新增路由生成器或资格缓存；十条显式规则更容易审查与撤回。剩余 canonical Goal 路径继续 first-review，Windows/shared authority/CI/release 和安全事件边界保留。没有发现需要本 PR 修复的阻断问题；最强未覆盖项是实际合入后 GitHub 对未来 PR 的 routing/branch-policy 读回，须由拥有任命/合入权限的维护者办理。APPROVE 只适用于这个未变化的 exact head。

English verdict: APPROVE — 1a5bf1dea4db433e073708dc126e047e92556bcc adds ten evidence-backed runtime/private-I/O CODEOWNERS routes, retains all prior owners and exclusions, and passes focused ownership plus native premerge checks. The unchanged broad docs-index failure remains disclosed; appointment, future routing and merge authority stay with the maintainer.