test(digest): pin the direction authority consumer to restore main

[songoow]

Goal And Delivered Outcome

• Outcome basis / optional anchor: reproduced required-check failure on main after feat(goals): add explicit material reads and direction basis recovery #6338 merged; no roadmap item.
• Goal/source and gap: feat(goals): add explicit material reads and direction basis recovery #6338 (merged as f5f4848e5) made loopx/control_plane/goals/direction_authority.ts import BARE_SHA256_PATTERN and ENVELOPED_SHA256_PATTERN from content_digest.ts, which its review explicitly required. It did not add the module to CANONICAL_CONSUMERS in the single-owner guard. On main, tests/control_plane_ts/content_digest_single_owner.test.ts therefore fails "the owner's consumers are the pinned set, each reading a canonical export", which runs in typescript-core. The same failure appears on every open PR, because pull-request CI tests the branch merged with current main.
• Observable before → after: on main the guard reports 16 pass, 1 fail with + 'control_plane/goals/direction_authority.ts' in the diff; with this pin it reports 17/17. The guard's second half still requires the module to actually use each imported name, and it does (both matchers are used).
• Issue/task and intended base: main. Related to feat(goals): add explicit material reads and direction basis recovery #6338.

Author Declaration

• Written by: model_agent — Claude Opus 5.5, Anthropic.

Implemented against

• Specification and revision: no written specification; the existing guard's contract ("a new consumer is a review event") and feat(goals): add explicit material reads and direction basis recovery #6338's approved review, which asked direction_authority to reuse the canonical matchers, are the basis.

Criterion (spec clause)	Disposition	Symbol / path	Test or command
Every module importing the digest owner is pinned	implemented	CANONICAL_CONSUMERS	content_digest_single_owner.test.ts
A pinned consumer imports only canonical exports and uses each one	implemented (unchanged rule, now passes for the new consumer)	direction_authority.ts:6	same file

• Self-check before submission: confirmed the import and both uses in direction_authority.ts; reproduced the failure on main; ran the whole control-plane TypeScript suite on the fixed tree (see Validation). Nothing else changed.

Scope And Continuation

• Completed scope and remaining work: complete within this scope. Current feat(collaboration): reconcile request corrections with Goal effects #6357 and feat(recovery): inspect full backups without activating restored state #6279 do not carry this pin; their digest checks remain dependent on integrating this fix.
• Slice boundary / successor: N/A.

Validation

Current head 21ff4ceeb9b39c8e1d56772a535e0132b56da33d includes main 3593cf17dada74b807719ba4fdbbb1738fa0a56c. The diff against main remains one consumer pin. On this head: digest guard 17/17, control-plane typecheck passed, and test_goal_prompt_dispatch.py plus test_effect_interpreter_packet.py 37/37. This brings in the mainline fixes for the earlier unrelated Python failures. On this exact head, hosted TypeScript shard 2/3, kernel static checks and dashboard/browser checks pass. The Windows job still fails the shared legacy-extension migration case tracked by #6463; this is not a fully green merge gate.

The following whole-suite evidence was collected on the earlier revision named in each row; it is not a new full-suite run on this head.

• Tested revision: b443d3d95b2461f3f5dd3beb8d99db7addd35197 (pin on main 373f2fa12); the whole-suite row below ran on the same pin over main f5f4848e5, the feat(goals): add explicit material reads and direction basis recovery #6338 merge commit
• Run state: finished
• Input classes: none

Check kind	Result	Public-safe evidence / limitation
unit	failed → passed	On main f5f4848e5: tests/control_plane_ts/content_digest_single_owner.test.ts 16 passed, 1 failed (the pinned-consumer test, diff + 'control_plane/goals/direction_authority.ts'), matching main CI typescript-core (2/3). With the pin: 17/17 on this head.
unit	passed	Whole control-plane TypeScript suite (tests/control_plane_ts/*.test.ts, Node 22.23.3, File/SQLite) on the pin over f5f4848e5: 4711 tests, 4672 passed, 0 failed, 39 skipped. Every skip is a PostgreSQL case without a configured server.
static	passed	npm run typecheck:control-plane on this head.
unit	not_run	Unrelated: the same main CI shard also failed host_process_group.test.ts "an observable live group fails closed at the bounded cleanup deadline" (missing expected rejection). It passed locally in the whole-suite run; this PR does not touch it and makes no claim about it.

• Coverage and gaps: the change is one entry in a test-only allowlist; the guard itself is the only behavior it affects. No runtime, schema or product path changes.

Frontend / Visual Evidence

• UI impact: none

Type of Change

• Test update

LoopX Area

• Build, packaging, installer, or CI

Shared-authority RFC fixture impact

N/A

Boundary Checklist

• Neither the diff nor this PR body/comments/attachments disclose private state, credentials, raw traces or verifier output, internal links, or local machine paths (including .loopx/, .codex/goals/, and live ACTIVE_GOAL_STATE.md).
• I did not duplicate maintainer-owned benchmark work unless a maintainer split out a public issue for it.
• I kept the change scoped to the linked issue/task.
• I completed the visual evidence section for UI changes, or marked UI impact none.
• Every commit includes a DCO Signed-off-by trailer (git commit -s).

🤖 Generated with Claude Code

[loopx-agent]

Review exact head: 6431@b443d3d95b2461f3f5dd3beb8d99db7addd35197
Reviewer: model_agent; model=gpt-6.1-sol; provider=OpenAI; declaration_source=runtime_reported; reasoning_effort=xhigh

动机

运行内容摘要单一来源 guard 的维护者，需要它准确检查已经使用统一摘要规则的生产模块。方向变更模块已改用统一摘要规则，但测试的消费者名单漏了它，导致现有 guard 在主干失败；本次补登记后应恢复通过，同时继续拦住未登记消费者。独立验证确认这一行修复使原本 16 过、1 失败变为 17 项通过，未登记消费者与闲置 import 的反例仍失败。本次不修改生产行为、协议、权限或 UI，也不证明其他 PR 的方向变更、安装或长期运行验收。该单一测试修复已完整验证；相关方向权威功能和其他 PR 的验收仍由各自 owner 负责，不因本次通过而关闭。

改动思路

现有 CANONICAL_CONSUMERS 就是这条维护规则的唯一登记点，补入真实消费者比放宽断言、再写一套扫描器或删掉 guard 更小且保留原约束。本次边界是一条现有消费者登记修复；不新增生产状态或测试框架，不拆出额外前置 PR。生产端 direction_authority.ts 已从 content_digest.ts 读取并实际使用裸摘要、带前缀摘要两种规则。本次只让既有 guard 的封闭消费者名单追上这个事实，保留“新增消费者须经过审查”的维护约束。无需图示：只有登记表新增一项，扫描与断言路径均未改变。

具体改动

完整 diff 只有 tests/control_plane_ts/content_digest_single_owner.test.ts:126 增加方向模块路径，1 行新增，没有新增测试框架、fixture 或生产 helper。既有 Node 测试从不可变基线的 16 过、1 失败恢复为本头 17 项通过；我另外在源文件副本中加入真正的新消费者，或保留方向模块 import 而移除它的实际使用，两个反例都仍被拒绝。最新 main 的 guard 已另加 checkpoint_artifacts 登记，但仍漏此项；用 main 真实源副本只补本行后同样通过，修复仍适用。

对主干的风险

风险主要是把错误名单当成通过条件，因此我同时核对了两个 canonical export 的生产调用和反例敏感性，而非只运行补齐后的名单。类型检查、完整语义检查通过；canary 3 项直接检查通过、目录未选中额外套件，由直接 guard 和变异反例补足。没有查询或等待远端 CI，不将其他功能或长期验收计入本次通过。

现有覆盖已含同一个 guard；本次修的是它自身的漏登记，另加 smoke 会重复。扫描同作者当前批次后，#6357/#6279 的较大修正也包含这条登记，而 #6431 能独立修复仍失败的主干；其余 PR 的 CI、扩展和打包主题不同，未发现此项构成重复脚手架刷量。合并后较大 PR 应自然去重这一行，无需新增并行验收。

我的整体评价

APPROVE。No blocking repair. Existing guard remains the owner; no new helper or follow-up artifact is necessary.未来改动便利性检查已做：现有统一规则和封闭名单的职责足够明确，继续抽象会增加成本，未发现值得在此 PR 加入的相关重构。本结论限定于上述完整 diff 和精确 head；不是合并、升级或其他 PR 的授权。

English verdict: APPROVE - b443d3d; the missing canonical consumer pin repairs the reproduced main guard failure. Base16/1 versus head17/0, latest-main replay and both negative mutations verified; production behavior unchanged.

[songoow]

CI note for the red merge-gate on b443d3d: the only failing Python Tests run (38549801439) was created 2026-10-14 10:28Z, so its merge commit predates #6419. Its two test failures are both outside this PR, which only adds one line to a TypeScript test:

• tests/control_plane/test_effect_interpreter_packet.py::test_real_executor_uses_verdict_and_replays_persisted_plan, the executor-fixture failure that test(turn): claim the executor fixture Todo and pin the unclaimed route #6419 fixed;
• tests/control_plane/test_goal_prompt_dispatch.py::test_emitted_heartbeat_bootstrap_expands_turn_before_real_guard[bash].

Both pass on current main (3593cf1): 3 passed locally. I have not pushed a branch update, because dismiss_stale_reviews_on_push would void the exact-head approval for a diff that cannot change. Main still lacks this pin, so the TypeScript digest guard stays red on main and on every PR until this lands.

中文：该次 CI 基于 #6419 合入前的旧 merge base；两条失败测试都与本 PR 无关，且在当前 main（3593cf17d）上本地通过。为免推送使已批准的 exact head 失效，未更新分支。

[loopx-agent]

Reviewer: model_agent · gpt-6.1-sol · OpenAI · runtime_reported · reasoning_effort=xhigh

动机

维护统一摘要规则的开发者，需要主干检查准确识别已使用公共 owner 的生产模块，而不是因登记遗漏反复失败。
direction_authority 已使用两种公共摘要规则，清单却漏了它；原 guard 16 项通过、1 项失败，补入真实路径后恢复 17 项通过，未登记新消费者仍会失败。
当前真实源检查 17 项全过；复制 318 个实际 TS 源文件后新增消费者、闲置 import、重写私有摘要正则三个反例均拒绝，恢复原源码再次通过。
本次只修测试库存，不改生产摘要、权限、协议或界面，也不认证方向能力、其他 PR 或完整主干健康。

改动思路

已有 CANONICAL_CONSUMERS 就是这条架构规则的登记 owner，只补实际消费者路径，比改扫描器、放宽集合相等、删除失败测试或增加 smoke 更小。生产 direction_authority 已读取并使用统一裸摘要与带前缀摘要两种规则，本次让库存追上事实，原“新消费者须评审”的要求保持。没有单独已接受的文字规格；我以不可变 main 3593cf17dada74b807719ba4fdbbb1738fa0a56c 的现有 guard 断言/注释、canonical owner 与实际调用为独立维护契约，未虚构 roadmap 或用作者新说明自证。

具体改动

精确 head：21ff4ceeb9b39c8e1d56772a535e0132b56da33d。完整 diff 只有 tests/control_plane_ts/content_digest_single_owner.test.ts:126 新增 control_plane/goals/direction_authority.ts，1 行新增、零删除。当前包含 main 3593，生产代码和两种摘要格式 owner 没有差异；所有旧消费者、例外和展开规则都保留。
我核对该生产模块第 6 行的两个 canonical imports、第 44 行裸摘要使用，以及第 60/115 行带前缀摘要使用。guard 的精确集合断言仍把新消费者视作 review event，后续 nameUsage 排除 import 声明自身，要求每个导入确有使用；另一个既有断言继续拒绝可静态识别的第二份 whole-value 摘要 matcher。登记不授予另一套规则。

对主干的风险

当前精确头的原始 Node guard 17 项通过、零跳过，1.98s；同 Node/依赖在不可变 main 是 16 过、1 失败，明确为 direction_authority 未登记。独立复制 318 个实际 tracked TS 源文件，复用同一完整 guard：原 corpus 通过，新增未登记 owner 消费者失败；让已登记模块保留 ENVELOPED import 却不用失败；在已登记模块增加私有裸摘要正则也失败；恢复原源码再次通过。只把扫描根指向临时副本、运行时 import 仍用原生产模块，没有改变 guard 断言或原工作树。静态 AST 的既有能力范围不等于动态代码或全部方向产品验收。

语义与 CI 对齐

开发期 advisory 先于完整一文件 premerge，3 项直接检查通过；原生选择器未选额外 catalog/risk 套件，不能把零选择当作全量测试，实际 guard 和上述反例承担本切片决定性覆盖。两份 PR 独有提交含集成 merge 均有 DCO。没有查询、轮询或等待远端 CI，也不沿用旧 review API 上已移动的 commit 标记：其正文仍写 b443，本轮对当前 21ff 独立判断。
当前完整队列同作者八个 open PR 及最近三十项批次已比对：较大的 #6357/#6279 可能带同一登记作为独立功能配套，而当前 main 仍缺这行，本修复可独立恢复主干检查；其余扫描器、扩展、CI、恢复主题不同。同作者 #6435 曾提出相同一行，已于 2026-10-14 主动关闭并明确以先开的 #6431 为唯一交付入口；本轮读回 closed 状态、同一行 diff 和作者说明，不把重复提案漏算为独立工作。 没有新增同形脚手架，另写重复 smoke 没有价值；依赖分支整合此行后自然去重即可。

我的整体评价

APPROVE，当前单一维护目标完整达成。未来方向检查认为既有 owner、精确库存和使用/反重复断言足够，此处抽象或另建 helper 会增加成本，没有需要新建的后继。结论限定于一行库存修复及其真实反例，完整方向、其他 PR、全主干健康和合并权限仍各自独立。发表后另读 closeout/readiness，不把测试通过或批准等同于合并授权。

English verdict: APPROVE 21ff4ceeb9b39c8e1d56772a535e0132b56da33d. The one-line canonical consumer pin repairs immutable main's reproduced 16-pass/1-fail guard to 17/17. Real-source-copy counterfactuals still reject an unregistered consumer, an unused canonical export and a private matcher inside the pinned consumer. Production behavior and existing static-model limits are unchanged; unrelated feature/CI qualification and merge authority remain separate.