test: repair Todo projection faults and Chat origin fixtures

[loopx-agent]

Goal And Delivered Outcome

The natural Python CI run exposes three assertion regressions that reproduce on current main: Todo projection fault injection still patches the previous CLI module, and two Chat projection cases assume the Status server's broader loopback-origin policy. Patch the active Todo list transport and send authorized Chat reads from the fixture server's exact origin. Keep Status cross-origin loopback coverage and public-origin rejection.

• Outcome basis: reproduced regression failures; base main at ad863559af7a7cd6e10aa62137bbf69dd877fb3f.
• Before → after: the selected five baseline cases give three failures/two passes; the final two complete test files pass through real CLI/provider and HTTP paths.

Author Declaration

• Written by: model_agent; OpenAI GPT-6 (Codex).
• Specification and revision: existing regression invariants in the two changed test files and docs/development/testing-and-quality.md at ad863559af7a7cd6e10aa62137bbf69dd877fb3f.

Criterion	Disposition	Path / evidence
Projection failure returns the standard CLI error without modifying source state	implemented	test_todo_list_record_references.py: patch todo_list; preserve all error/readback assertions
Authorized projection reads reach route validation; untrusted origins remain rejected	implemented	test_status_server_extension_projection.py: exact Chat origin, original Status cross-origin requests and host-specific rejection text

Self-check: inspected the active transport and origin gate, the complete related #6463 file diff, and actual hosted source parity. The atomic-write fault fixture repair is already owned by #6463 and is excluded from this final diff. No production code or origin admission changes.

Scope And Continuation

Complete within this two-file fixture repair. The existing atomic-write repair stays in #6463; this PR does not duplicate it. The bounded refactor pass reuses current owners and needs no production extraction.

Full Python qualification remains open. All six jobs in the cited natural window are now terminal: four reach final pytest reports, while two have deadline annotations and incomplete execution. Those silent intervals have no executing-stack evidence and are not attributed to these fixture failures. Existing #6458 diagnostics and #6468 runtime work remain separate. Independent exact-head review approves this proposal. The reviewer independently verified the complete two-file scope (12 tests), the 70-test CORS suite and two deliberate production mutants that the original assertions reject. Complete current-head hosted CI, native Windows and sustained qualification remain pending; no merge is performed.

Validation

• Tested revision: 4591c660c1956ef8e5b0740e1c43439522fd97b5.
• Run state: finished for scoped local validation; full hosted CI pending.
• Input classes: synthetic, public_fixture.

Check kind	Result	Evidence / limitation
regression_parity	passed	Existing baseline evidence reproduces all three unchanged failure signatures. Final full two-file scope: 12 pass, zero skips.
real_entrypoint	passed	Actual Todo CLI projection-failure/unchanged-state negative with isolated canonical providers; real loopback HTTP accepted reads, invalid-reference rejection and foreign-origin rejection.
integration	passed	Python 3.11.17, two xdist workers, pytest-split and coverage: 12 selected/observed/finished, zero invalid durations, exit 0. This targeted local split does not qualify the full six-shard hosted collection.
static	passed	CQR cqr_261b7710e00d974e05a0; final premerge: 4 direct checks and all 6 selected canaries pass. Both final files, diff and PR body pass public-boundary scans.
regression_parity	passed	Prior Chat CORS suite evidence remains applicable: its fixture and production owner are unchanged. Earlier three-file totals describe the prior head and are not final-head coverage claims.
integration	not_run	Native Windows, sustained operation and complete current-head hosted CI remain unqualified. The unrelated Lark atomic-fixture baseline failure awaits #6463.

Frontend / Visual Evidence

UI impact: none; only existing tests change. Screenshots and visual review are not applicable. Frontend/Lark/CLI/HTTP implementation and user operations are unchanged.

Type of Change / LoopX Area

• Test update
• Build, packaging, installer, or CI

Technical direction: S10 reliability and S12 validation hygiene; their broader acceptance remains open. Shared-authority RFC fixture impact: N/A; no provider promotion, runtime routing or persisted contract changes.

Boundary Checklist

• No private state, credentials, local paths or raw logs in the public diff/body.
• Related PR file diffs checked; reuse fix(extensions): keep unverified legacy status readable #6463's existing atomic-write repair.
• Scoped to the three reproduced fixture assertions; no benchmark work duplicated.
• UI impact is none.
• Both commits include DCO sign-offs.

[loopx-agent]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)
Reviewer: model_agent · gpt-6.1-sol · OpenAI · runtime_reported · reasoning_effort=xhigh

动机

维护 Todo 列表和本地投影读取的贡献者需要测试真正覆盖当前入口。
投影故障原来未注入当前列表入口，Chat 合法读取又被错误端口挡在门外；修复后可观察真实错误和投影验证，同时继续拒绝外部 Origin。
独立主干对照复现3失败2通过；当前完整两文件12项通过，真实CLI及HTTP反例仍能抓住错误成功退出和任意Origin放行。
没有改变产品代码、权限、配置或浏览器交互，也不解释完整托管运行的静默区间；原生 Windows、完整 CI 和持续运行仍未认证。

改动思路

不改会维持已复现的三条测试回归；只放宽期望值会丢掉测试价值。本版复用现有 Todo list 的桥接入口和 Chat 的精确 Host/Origin 规则，没有引入新实现。Status 原来的跨端口 loopback 读取仍保留。原子写入补丁与 #6463 实际 diff 相同，当前已移除重复文件，维持其现有归属；这里不需要再抽一层生产或测试框架。恢复 RFC 的产品旅程建议不构成这个测试维护切片的新门槛。

具体改动

精确 head：4591c660c1956ef8e5b0740e1c43439522fd97b5。spec_ref=docs/development/testing-and-quality.md，spec_revision=ad863559af7a7cd6e10aa62137bbf69dd877fb3f。

• Quality Layers / 质量分层：implemented，既有错误、源状态不变及拒绝断言保持；额外两个生产语义 mutation 证明独立 oracle 能失败。
• Local Validation Environment / 本地验证环境：implemented，独立 worktree/uv 当前源码、真实子进程 CLI 与 loopback HTTP 验证。
• Evidence Boundary / 证据边界：implemented，仅候选测试及评审文本扫描；原始证据和私有路径不进入公开产物。

test_projection_failure_returns_the_standard_cli_error_without_source_changes 的注入改到 todo_list.effect_runtime_result，仍要求标准错误、退出码 1、无成功列表和源字节不变。另一个文件把 Chat 合法请求的 Origin 设为该测试服务器实际地址，Status 继续使用原 loopback 跨端口地址；外部 Origin 仍要求 403，仅按既有服务分别匹配完整错误。owner-only 与不完整 ref 仍要求 400。最终两文件 +10/-7，无生产代码改动；两个提交均有 DCO。

对主干的风险

我独立执行完整两文件：12 passed，零跳过，20.36s；当前独立 CORS 全文件 70 passed，零跳过，51.76s。不可变主干相同五例为 3 failed/2 passed，分别是旧 Todo hook 未命中，以及 Chat 正常/不完整 ref 请求被旧 Origin 提前 403 拒绝。受控子进程分别把生产 CLI 错误退出改成成功、把 Chat Origin 判断改成全部允许；两个原测试都按预期失败，未修改测试期望或持久源码。CLI 的 legacy/File/SQLite 读取、损坏源拒绝和恢复均属于真实本地路径，extension provider 是公开合成夹具。
开发 advisory 在完整检查前执行；当前4直接与6选中canary全部通过、零hold，候选公共边界扫描通过。没有查询或等待远端 CI，未把作者旧三文件85/91计数算作当前覆盖。完整托管静默区间、原生Windows与长期资格未验证；已排除的Lark夹具仍归6463，本PR不宣称整个测试树全绿。

我的整体评价

APPROVE；没有阻塞发现。这个切片恢复既有测试的实际意义，生产行为和用户步骤保持，额外反例证明并非单纯把断言改绿。未来方向检查已落实在去重并复用既有owner；当前再新增抽象没有可证明收益。剩余环境和完整运行限制如上，批准不授予合并或绕过权限，发表后另读closeout及readiness。

English verdict: APPROVE 4591c660c1956ef8e5b0740e1c43439522fd97b5. The two-file fixture repair reaches the current Todo transport and respects the existing distinct Chat/Status origin contracts. Independent current validation:12 tests and70 CORS tests pass without skips; immutable main reproduces3 failures, both deliberate production mutants are caught, and4direct/6selected canaries pass. Full hosted, native Windows and sustained qualification remain open; no merge performed.