Repository navigation
Conversation
Signed-off-by: aihop <4408344+hhyykk@users.noreply.github.com>
Signed-off-by: aihop <4408344+hhyykk@users.noreply.github.com>
Signed-off-by: aihop <4408344+hhyykk@users.noreply.github.com>
Signed-off-by: aihop <4408344+hhyykk@users.noreply.github.com>
Signed-off-by: aihop <4408344+hhyykk@users.noreply.github.com>
Signed-off-by: aihop <4408344+hhyykk@users.noreply.github.com>
Public-head integration validation:
|
| Field | Evidence |
|---|---|
| Canonical owner | Before: Python structural diagnostics and disposition composition, plus native consistency checks. After: work_items/interaction_contract.ts owns the complete arbitration decision and shared consistency kernel. |
| Legacy semantic code deleted | Deleted decision-bearing definitions span 139 lines: _required_bool (12), _classify_disposition (35), build_scheduler_arbitration (92). This includes signatures, docstrings, codecs and transport, not 139 lines of pure rules. Structural diagnostics, precedence and disposition ownership are retired from Python. The separate 2-line _mapping codec deletion is excluded. The old native consistency wire function/handler is also deleted. |
| Bridge code added | Conservative gross 103 added product lines: DTO/facts codec 34; interaction pair/dict wrapper/transport 47; quota wiring 11; explicit hint record consumption 4; snapshot allowlists 2; existing native read wrapper/rename 5. No new method, runtime, dependency or setting. |
| Cross-runtime calls | Actual quota should-run CLI traces: active and human gate required-read/consistency calls 3→2; App monitor chain 12→8; paused/stopped 1→1; invalid execution context 2→2. These are counts for this operation family, not all CLI RPCs. The selected paired construction/hint changes 2→1; additional real callers still construct contracts. |
| Product-code net change | 9 product files, +155/−196 = −41 against the final merge base. Tests, fixtures, configuration and documentation are separate. |
| Migration scaffolding | Native literal decision/diagnostic tables replace the removed Python decision oracle. One test-only adapter uses the real native projection for retained Python hint consumers. It exits when those consumers execute in TypeScript. Differential qualification remains external evidence; production never dual-runs. |
| Facade exit | Scalar/Mapping codecs, the 64 KiB transport probe, Enum/dataclass result adapter and the private pair remain for build_scheduler_hint and five dict-only constructions: three in quota/live_decision.py, recovery in quota/unsettled_host_turn.py, and the cooldown finalizer. Delete them when scheduler cadence/hint and interaction construction run in TypeScript. External Host mutation remains its own adapter. |
| Correctness and performance | Final pinned results and reproducible validation are in the validation comment below. No behavior delta is intended. |
Performance: owner_review_hold — exact public HEAD integration V5
Current V5 SQLite/monitor complete CLI p95 is +8.447648% / +178.672962 ms. It exceeds both the +5% and +25 ms gates. The three other CLI rows pass. All four warm native p95 values are below 2 ms. Current integration disposition and overall performance disposition are both owner_review_hold.
This packet pins PR #6634 at HEAD f8555130aab4ceb3e5dcea35884fa70c6e01b209, with baseline 052f492767a1d893dfb96a9f777331459fd4c5ae. V5 qualifies the public HEAD after common-main integration. The nine measured production files are byte-identical to V4. It is a separate integration run, not a retry to erase the valid V4 miss. V3 and V4 remain recorded below. V5 does not resolve or reclassify their holds.
V5 completed exactly one frozen run, with zero retries. All 48 source/base/wheel/sdist CLI qualification runs, the physical TypeScript mutation check and all 256 complete public/domain comparisons passed. No measured sample was removed. Correctness passing does not satisfy the failed CLI performance gate.
| File/SQLite case | Warm native transaction p95, base -> head (ms) | Complete CLI p95, base -> head (ms) | CLI p95 change | Current V5 gate |
|---|---|---|---|---|
| File active | 1.283278 -> 0.775725 | 687.480170 -> 692.964086 | +0.797684%; +5.483916 ms | Pass |
| File monitor | 1.494543 -> 0.601709 | 828.078621 -> 839.394325 | +1.366501%; +11.315704 ms | Pass |
| SQLite active | 1.716340 -> 1.092049 | 684.077129 -> 648.319723 | -5.227102%; -35.757406 ms | Pass |
| SQLite monitor | 1.674389 -> 0.870583 | 2115.061687 -> 2293.734649 | +8.447648%; +178.672962 ms | Hold: exceeds both gates |
The baseline transaction has two selected native requests; the candidate has one. The full active CLI uses 3 -> 2 selected calls; monitor uses 12 -> 8. Every selected request uses the actual production request scope. Each CLI row uses 64 alternating matched pairs. Cold/warm/burst use 16/128/256 observations per variant and row. Quantiles use nearest rank without trimming. The CLI gate requires both <=5% and <=25 ms; the native gate requires strictly <2 ms. Sample counts, ordering and thresholds are unchanged from V4.
All 512 measured CLI samples have stable native PIDs and zero startup events. The light macro trace retains RPC/wire counts and startup timing, but does not time individual RPCs. The separate pure-helper native measurements cannot causally attribute the full SQLite/monitor CLI miss. No new profiling or measurement was started to explain the result.
All owned managed runtimes and observed processes exited. The V5 protocol SHA256 is 692c76c772fac2c923971fb251d794f3252b726fbcca23bdabf706425d149962; final performance receipt SHA256 is 84c2d021a1ace14837b18593d0fcd6658670207d300e37b6ea3efb777d4e4f4a. The V5 evidence seal SHA256 is 7ea402ab79903ebec2a6ae6b4b478b1bec9da8fbbdeaea38ae4020ed42439e0d. These synthetic Linux checks cover local File/SQLite authority; they do not establish real-model or external automation behavior.
Complete CLI p50 and p95
These are the same fixed 64 paired observations per row. p50 is context; it does not replace or waive the p95 gates above.
| Case | Base p50/p95 ms | Head p50/p95 ms |
|---|---|---|
| file/active | 568.606615/687.480170 | 564.738633/692.964086 |
| file/monitor | 715.771013/828.078621 | 719.828922/839.394325 |
| sqlite/active | 581.386836/684.077129 | 593.837458/648.319723 |
| sqlite/monitor | 1695.738770/2115.061687 | 1641.701351/2293.734649 |
Cold startup, complete projection adapter and daemon memory
Cold figures measure managed-process startup with equal prepared disk compile caches, not cold filesystem or Python startup. Warm adapter figures include the complete affected projection transaction and actual native transport; they exclude provider I/O. Inputs come from the accepted real CLI corpus. Macro CLI measurements exercise the actual provider. RSS/HWM are Linux /proc reports without forced GC.
| Case | Cold startup base p50/p95 ms | Cold startup head p50/p95 ms | Warm adapter base p50/p95 ms | Warm adapter head p50/p95 ms |
|---|---|---|---|---|
| file/active | 236.799/350.448 | 238.494/339.900 | 1.006/1.321 | 0.629/0.838 |
| file/monitor | 238.613/290.945 | 237.425/344.092 | 0.800/1.534 | 0.489/0.682 |
| sqlite/active | 240.555/561.143 | 241.819/374.493 | 1.063/1.770 | 0.616/1.156 |
| sqlite/monitor | 265.726/368.829 | 241.694/290.733 | 0.978/1.714 | 0.603/0.957 |
After 1 s idle, then 256 sequential logical projection transactions per variant (baseline 512 native calls, candidate 256):
| Case/variant | RSS idle→after MiB | HWM idle→after MiB |
|---|---|---|
| file/active base | 103.00→103.05 | 103.00→103.05 |
| file/active head | 102.10→102.12 | 102.10→102.12 |
| file/monitor base | 103.01→103.06 | 103.01→103.06 |
| file/monitor head | 99.81→99.88 | 99.81→99.88 |
| sqlite/active base | 92.88→92.93 | 96.89→96.89 |
| sqlite/active head | 101.34→101.36 | 101.34→101.36 |
| sqlite/monitor base | 93.77→93.82 | 95.88→95.88 |
| sqlite/monitor head | 101.17→101.24 | 101.17→101.24 |
Each source identity, script and valid sample is retained. After V3, the projection changed to avoid small-packet snapshot-sink allocation under a checked output bound. V4 retained one CLI p95 miss. V5 qualifies common-main integration on the public head with no owned implementation change. It is not a replacement sample set for V4. No remaining tail miss has isolated causal attribution.
Machine-readable paired qualification receipts (12 rows, 48 runs)
{
"base": "052f492767a1d893dfb96a9f777331459fd4c5ae",
"head": "f8555130aab4ceb3e5dcea35884fa70c6e01b209",
"fixture_sha256": "8d2914dabb61a710bd3fa0fd8b6543977480a337d39a4d33b5e6d36fc96542df",
"harness_sha256": "4372ce64d7e6df24ab8fb7b94062c54b6c918cc2cb974192138900934d9ec99c",
"entrypoint": "python -m loopx.cli; complete arguments, isolated fixtures and installation steps are below",
"variant_revisions": {
"base": "052f492767a1d893dfb96a9f777331459fd4c5ae",
"head": "f8555130aab4ceb3e5dcea35884fa70c6e01b209",
"wheel": "f8555130aab4ceb3e5dcea35884fa70c6e01b209",
"sdist": "f8555130aab4ceb3e5dcea35884fa70c6e01b209"
},
"artifact_sha256": {
"wheel": "3251b470d149475bedc9b04988222f8b9d84414f8060542f0f59bc821d02e75a",
"sdist": "0b40386e3c03c26b1337ef877669e1668e9425c006779903c7570d017931d820"
},
"comparison": "No domain fields removed. Complete public JSON, canonical revision/Todos/leases and durable domain values/path sets match. Raw bytes retained; differing infrastructure lock PIDs are checked against observed process owners. Fingerprints include local synthetic paths.",
"rows": [
{
"backend": "file",
"scenario": "active",
"variants": {
"base": {
"exit_code": 0,
"public_json_sha256": "8c47bcaee9c7862d3b626b4305a6b6764d5afc7b6f62c637640c3476fe6ed8a4",
"domain_and_canonical_values_equal": true,
"verified_runtime_restart": true
},
"head": {
"exit_code": 0,
"public_json_sha256": "8c47bcaee9c7862d3b626b4305a6b6764d5afc7b6f62c637640c3476fe6ed8a4",
"domain_and_canonical_values_equal": true,
"verified_runtime_restart": true
},
"wheel": {
"exit_code": 0,
"public_json_sha256": "8c47bcaee9c7862d3b626b4305a6b6764d5afc7b6f62c637640c3476fe6ed8a4",
"domain_and_canonical_values_equal": true,
"verified_runtime_restart": true
},
"sdist": {
"exit_code": 0,
"public_json_sha256": "8c47bcaee9c7862d3b626b4305a6b6764d5afc7b6f62c637640c3476fe6ed8a4",
"domain_and_canonical_values_equal": true,
"verified_runtime_restart": true
}
}
},
{
"backend": "file",
"scenario": "human_gate",
"variants": {
"base": {
"exit_code": 0,
"public_json_sha256": "ddcc37cfbfce7cfdf501fcb033d2ec267a3f35de7fb0df0956ec25baec1e5512",
"domain_and_canonical_values_equal": true,
"verified_runtime_restart": true
},
"head": {
"exit_code": 0,
"public_json_sha256": "ddcc37cfbfce7cfdf501fcb033d2ec267a3f35de7fb0df0956ec25baec1e5512",
"domain_and_canonical_values_equal": true,
"verified_runtime_restart": true
},
"wheel": {
"exit_code": 0,
"public_json_sha256": "ddcc37cfbfce7cfdf501fcb033d2ec267a3f35de7fb0df0956ec25baec1e5512",
"domain_and_canonical_values_equal": true,
"verified_runtime_restart": true
},
"sdist": {
"exit_code": 0,
"public_json_sha256": "ddcc37cfbfce7cfdf501fcb033d2ec267a3f35de7fb0df0956ec25baec1e5512",
"domain_and_canonical_values_equal": true,
"verified_runtime_restart": true
}
}
},
{
"backend": "file",
"scenario": "monitor",
"variants": {
"base": {
"exit_code": 0,
"public_json_sha256": "af4a746e5dd14cfe3f386931b547e5f562cb13b683bbc88228946a8db949bad6",
"domain_and_canonical_values_equal": true,
"verified_runtime_restart": true
},
"head": {
"exit_code": 0,
"public_json_sha256": "af4a746e5dd14cfe3f386931b547e5f562cb13b683bbc88228946a8db949bad6",
"domain_and_canonical_values_equal": true,
"verified_runtime_restart": true
},
"wheel": {
"exit_code": 0,
"public_json_sha256": "af4a746e5dd14cfe3f386931b547e5f562cb13b683bbc88228946a8db949bad6",
"domain_and_canonical_values_equal": true,
"verified_runtime_restart": true
},
"sdist": {
"exit_code": 0,
"public_json_sha256": "af4a746e5dd14cfe3f386931b547e5f562cb13b683bbc88228946a8db949bad6",
"domain_and_canonical_values_equal": true,
"verified_runtime_restart": true
}
}
},
{
"backend": "file",
"scenario": "paused",
"variants": {
"base": {
"exit_code": 0,
"public_json_sha256": "420f46ed809efaf045f0ae41c12850fc635f7b90269949641403b49bbd46c435",
"domain_and_canonical_values_equal": true,
"verified_runtime_restart": true
},
"head": {
"exit_code": 0,
"public_json_sha256": "420f46ed809efaf045f0ae41c12850fc635f7b90269949641403b49bbd46c435",
"domain_and_canonical_values_equal": true,
"verified_runtime_restart": true
},
"wheel": {
"exit_code": 0,
"public_json_sha256": "420f46ed809efaf045f0ae41c12850fc635f7b90269949641403b49bbd46c435",
"domain_and_canonical_values_equal": true,
"verified_runtime_restart": true
},
"sdist": {
"exit_code": 0,
"public_json_sha256": "420f46ed809efaf045f0ae41c12850fc635f7b90269949641403b49bbd46c435",
"domain_and_canonical_values_equal": true,
"verified_runtime_restart": true
}
}
},
{
"backend": "file",
"scenario": "stopped",
"variants": {
"base": {
"exit_code": 0,
"public_json_sha256": "7533dc09e3fc93bd2c07ca0d0e7089421c4edd65bc39a6dad43f28b79745386f",
"domain_and_canonical_values_equal": true,
"verified_runtime_restart": true
},
"head": {
"exit_code": 0,
"public_json_sha256": "7533dc09e3fc93bd2c07ca0d0e7089421c4edd65bc39a6dad43f28b79745386f",
"domain_and_canonical_values_equal": true,
"verified_runtime_restart": true
},
"wheel": {
"exit_code": 0,
"public_json_sha256": "7533dc09e3fc93bd2c07ca0d0e7089421c4edd65bc39a6dad43f28b79745386f",
"domain_and_canonical_values_equal": true,
"verified_runtime_restart": true
},
"sdist": {
"exit_code": 0,
"public_json_sha256": "7533dc09e3fc93bd2c07ca0d0e7089421c4edd65bc39a6dad43f28b79745386f",
"domain_and_canonical_values_equal": true,
"verified_runtime_restart": true
}
}
},
{
"backend": "file",
"scenario": "invalid_context",
"variants": {
"base": {
"exit_code": 0,
"public_json_sha256": "b50ae26185ffc6e9ebee7f1d096a7c0d19ba0d7d7189556030121c95f5fdc03f",
"domain_and_canonical_values_equal": true,
"verified_runtime_restart": true
},
"head": {
"exit_code": 0,
"public_json_sha256": "b50ae26185ffc6e9ebee7f1d096a7c0d19ba0d7d7189556030121c95f5fdc03f",
"domain_and_canonical_values_equal": true,
"verified_runtime_restart": true
},
"wheel": {
"exit_code": 0,
"public_json_sha256": "b50ae26185ffc6e9ebee7f1d096a7c0d19ba0d7d7189556030121c95f5fdc03f",
"domain_and_canonical_values_equal": true,
"verified_runtime_restart": true
},
"sdist": {
"exit_code": 0,
"public_json_sha256": "b50ae26185ffc6e9ebee7f1d096a7c0d19ba0d7d7189556030121c95f5fdc03f",
"domain_and_canonical_values_equal": true,
"verified_runtime_restart": true
}
}
},
{
"backend": "sqlite",
"scenario": "active",
"variants": {
"base": {
"exit_code": 0,
"public_json_sha256": "e5a8c8573cccaf1c8e44f47eb1c31fae4225d9e6104080ce05332b18b3e8f8c9",
"domain_and_canonical_values_equal": true,
"verified_runtime_restart": true
},
"head": {
"exit_code": 0,
"public_json_sha256": "e5a8c8573cccaf1c8e44f47eb1c31fae4225d9e6104080ce05332b18b3e8f8c9",
"domain_and_canonical_values_equal": true,
"verified_runtime_restart": true
},
"wheel": {
"exit_code": 0,
"public_json_sha256": "e5a8c8573cccaf1c8e44f47eb1c31fae4225d9e6104080ce05332b18b3e8f8c9",
"domain_and_canonical_values_equal": true,
"verified_runtime_restart": true
},
"sdist": {
"exit_code": 0,
"public_json_sha256": "e5a8c8573cccaf1c8e44f47eb1c31fae4225d9e6104080ce05332b18b3e8f8c9",
"domain_and_canonical_values_equal": true,
"verified_runtime_restart": true
}
}
},
{
"backend": "sqlite",
"scenario": "human_gate",
"variants": {
"base": {
"exit_code": 0,
"public_json_sha256": "5179523d65ae6bda84669596db72c8616a03ee7d9f2b5c1743d0bdcfcb8760c2",
"domain_and_canonical_values_equal": true,
"verified_runtime_restart": true
},
"head": {
"exit_code": 0,
"public_json_sha256": "5179523d65ae6bda84669596db72c8616a03ee7d9f2b5c1743d0bdcfcb8760c2",
"domain_and_canonical_values_equal": true,
"verified_runtime_restart": true
},
"wheel": {
"exit_code": 0,
"public_json_sha256": "5179523d65ae6bda84669596db72c8616a03ee7d9f2b5c1743d0bdcfcb8760c2",
"domain_and_canonical_values_equal": true,
"verified_runtime_restart": true
},
"sdist": {
"exit_code": 0,
"public_json_sha256": "5179523d65ae6bda84669596db72c8616a03ee7d9f2b5c1743d0bdcfcb8760c2",
"domain_and_canonical_values_equal": true,
"verified_runtime_restart": true
}
}
},
{
"backend": "sqlite",
"scenario": "monitor",
"variants": {
"base": {
"exit_code": 0,
"public_json_sha256": "f4e7d430ae51f3e293b987ebf9c412994c4dd6a77eebfe78a64709a82e7f3b39",
"domain_and_canonical_values_equal": true,
"verified_runtime_restart": true
},
"head": {
"exit_code": 0,
"public_json_sha256": "f4e7d430ae51f3e293b987ebf9c412994c4dd6a77eebfe78a64709a82e7f3b39",
"domain_and_canonical_values_equal": true,
"verified_runtime_restart": true
},
"wheel": {
"exit_code": 0,
"public_json_sha256": "f4e7d430ae51f3e293b987ebf9c412994c4dd6a77eebfe78a64709a82e7f3b39",
"domain_and_canonical_values_equal": true,
"verified_runtime_restart": true
},
"sdist": {
"exit_code": 0,
"public_json_sha256": "f4e7d430ae51f3e293b987ebf9c412994c4dd6a77eebfe78a64709a82e7f3b39",
"domain_and_canonical_values_equal": true,
"verified_runtime_restart": true
}
}
},
{
"backend": "sqlite",
"scenario": "paused",
"variants": {
"base": {
"exit_code": 0,
"public_json_sha256": "c0a4f42a774c2b941b2a6df828979b022e2b0076d10cda74ff3fc847ed1ef65c",
"domain_and_canonical_values_equal": true,
"verified_runtime_restart": true
},
"head": {
"exit_code": 0,
"public_json_sha256": "c0a4f42a774c2b941b2a6df828979b022e2b0076d10cda74ff3fc847ed1ef65c",
"domain_and_canonical_values_equal": true,
"verified_runtime_restart": true
},
"wheel": {
"exit_code": 0,
"public_json_sha256": "c0a4f42a774c2b941b2a6df828979b022e2b0076d10cda74ff3fc847ed1ef65c",
"domain_and_canonical_values_equal": true,
"verified_runtime_restart": true
},
"sdist": {
"exit_code": 0,
"public_json_sha256": "c0a4f42a774c2b941b2a6df828979b022e2b0076d10cda74ff3fc847ed1ef65c",
"domain_and_canonical_values_equal": true,
"verified_runtime_restart": true
}
}
},
{
"backend": "sqlite",
"scenario": "stopped",
"variants": {
"base": {
"exit_code": 0,
"public_json_sha256": "9308a352824db2f2ab104a0b91ce823d1f31e36ab8c8ba81cd171f9efa839605",
"domain_and_canonical_values_equal": true,
"verified_runtime_restart": true
},
"head": {
"exit_code": 0,
"public_json_sha256": "9308a352824db2f2ab104a0b91ce823d1f31e36ab8c8ba81cd171f9efa839605",
"domain_and_canonical_values_equal": true,
"verified_runtime_restart": true
},
"wheel": {
"exit_code": 0,
"public_json_sha256": "9308a352824db2f2ab104a0b91ce823d1f31e36ab8c8ba81cd171f9efa839605",
"domain_and_canonical_values_equal": true,
"verified_runtime_restart": true
},
"sdist": {
"exit_code": 0,
"public_json_sha256": "9308a352824db2f2ab104a0b91ce823d1f31e36ab8c8ba81cd171f9efa839605",
"domain_and_canonical_values_equal": true,
"verified_runtime_restart": true
}
}
},
{
"backend": "sqlite",
"scenario": "invalid_context",
"variants": {
"base": {
"exit_code": 0,
"public_json_sha256": "1d5a8b1fc3c85d867b34eec932c7a0ae7c10287a1a17a1a5d723f13e3556b46c",
"domain_and_canonical_values_equal": true,
"verified_runtime_restart": true
},
"head": {
"exit_code": 0,
"public_json_sha256": "1d5a8b1fc3c85d867b34eec932c7a0ae7c10287a1a17a1a5d723f13e3556b46c",
"domain_and_canonical_values_equal": true,
"verified_runtime_restart": true
},
"wheel": {
"exit_code": 0,
"public_json_sha256": "1d5a8b1fc3c85d867b34eec932c7a0ae7c10287a1a17a1a5d723f13e3556b46c",
"domain_and_canonical_values_equal": true,
"verified_runtime_restart": true
},
"sdist": {
"exit_code": 0,
"public_json_sha256": "1d5a8b1fc3c85d867b34eec932c7a0ae7c10287a1a17a1a5d723f13e3556b46c",
"domain_and_canonical_values_equal": true,
"verified_runtime_restart": true
}
}
}
]
}Physical mutation sensitivity, executed through the same complete CLI harness:
{
"head": "f8555130aab4ceb3e5dcea35884fa70c6e01b209",
"target": "loopx/control_plane/work_items/interaction_contract.ts",
"old": "if (must_attempt) return [\"active_work\", \"interaction_agent_attempt_required\"];",
"new": "if (must_attempt) return [\"quiet_wait\", \"interaction_agent_attempt_required\"];",
"original_sha256": "d0ca3d492689af99c094cdf0e5ca210cd950299a7578589fe22722f05119bfc6",
"mutant_sha256": "eeeb61d7ceb6c17ae86a03277bf0d195cec84494099a3b3a0e2ab20faa8dcfe3",
"mutation_count": 1,
"shared_worktree_modified": false,
"executed": true,
"exit_status": 1,
"expected_failure": true,
"independent_invariant": "active work requires scheduler action run_now",
"actual_scheduler_action": "backoff_until_state_change",
"native_arbitrations": [
{
"mode": "bounded_delivery",
"errors": [],
"disposition": "quiet_wait",
"reason_code": "interaction_agent_attempt_required"
},
{
"mode": "bounded_delivery",
"errors": [],
"disposition": "quiet_wait",
"reason_code": "interaction_agent_attempt_required"
}
],
"harness_sha256": "4372ce64d7e6df24ab8fb7b94062c54b6c918cc2cb974192138900934d9ec99c"
}Complete reproducible baseline/source/wheel/sdist CLI replay
Replay the complete CLI parity check
This packet uses the same qualification logic for the immutable baseline, the reviewed source, a fresh wheel install, and a fresh sdist install. It compares every public JSON field, canonical provider revision/Todos/leases, durable domain JSON values, and persisted path sets. It keeps the original file bytes. A differing .lock PID must belong to that execution's observed CLI or Node process. No domain field is removed.
Scope: Linux, Python 3.13.12, Node 22.22.3 with SQLite support, local File/SQLite authority. Use an isolated scratch directory without whitespace. The scripts create synthetic Goals and local runtime processes. They disable usage pings. They do not call a model or an external App automation API.
The fixed wall clock applies during seed construction and every CLI call. Monotonic/performance clocks remain real. This packet runs correctness checks, not a timing benchmark.
1. Prepare the pinned worktrees and normal packages
Set REPO_DIR to a local clone of loopx-project/loopx. Use PR_NUMBER=6634. Put the qualified Node binary directory on PATH first.
set -eu
export REPO_DIR=/path/to/loopx-clone
export PR_NUMBER=6634
export BASE_REF=052f492767a1d893dfb96a9f777331459fd4c5ae
export HEAD_REF=f8555130aab4ceb3e5dcea35884fa70c6e01b209
export TEST_REL=tests/control_plane/test_scheduler_arbitration_native_cli.py
export TEST_SHA=8d2914dabb61a710bd3fa0fd8b6543977480a337d39a4d33b5e6d36fc96542df
export TASK_DIR="$(mktemp -d)"
export BASE_DIR="$TASK_DIR/base"
export HEAD_DIR="$TASK_DIR/head"
export REPLAY_DIR="$TASK_DIR/replay"
mkdir -p "$REPLAY_DIR/hooks" "$TASK_DIR/wheels" "$TASK_DIR/sdists"
node -e 'if(process.version!=="v22.22.3")throw Error(process.version)'
git -C "$REPO_DIR" fetch https://github.com/loopx-project/loopx.git "refs/pull/$PR_NUMBER/head"
test "$(git -C "$REPO_DIR" rev-parse FETCH_HEAD)" = "$HEAD_REF"
git -C "$REPO_DIR" fetch https://github.com/loopx-project/loopx.git "$BASE_REF"
git -C "$REPO_DIR" worktree add --detach "$BASE_DIR" "$BASE_REF"
git -C "$REPO_DIR" worktree add --detach "$HEAD_DIR" "$HEAD_REF"
uv sync --project "$BASE_DIR" --python 3.13.12 --extra test
uv sync --project "$HEAD_DIR" --python 3.13.12 --extra test
export BASE_PY="$BASE_DIR/.venv/bin/python"
export HEAD_PY="$HEAD_DIR/.venv/bin/python"
git -C "$HEAD_DIR" show "$HEAD_REF:$TEST_REL" > "$REPLAY_DIR/fixture.py"
export LOOPX_USAGE_PING=0
"$BASE_PY" - <<'PY_FIXTURE_SHA'
import hashlib,os,pathlib
assert hashlib.sha256((pathlib.Path(os.environ['REPLAY_DIR'])/'fixture.py').read_bytes()).hexdigest()==os.environ['TEST_SHA']
PY_FIXTURE_SHA
# Both worktrees execute the same durable test file. Baseline production stays at BASE_REF.
test ! -e "$BASE_DIR/$TEST_REL"
cp "$REPLAY_DIR/fixture.py" "$BASE_DIR/$TEST_REL"
(cd "$BASE_DIR" && "$BASE_PY" -m pytest -q "$TEST_REL")
(cd "$HEAD_DIR" && "$HEAD_PY" -m pytest -q "$TEST_REL" tests/control_plane/test_scheduler_arbitration_transport.py)
npm --prefix "$HEAD_DIR/apps/presentation/dashboard" ci
npm --prefix "$HEAD_DIR/apps/presentation/dashboard" run build:chat
uv build --project "$HEAD_DIR" --wheel --out-dir "$TASK_DIR/wheels"
uv build --project "$HEAD_DIR" --sdist --out-dir "$TASK_DIR/sdists"
export WHEEL="$(find "$TASK_DIR/wheels" -maxdepth 1 -name '*.whl' -print)"
export SDIST="$(find "$TASK_DIR/sdists" -maxdepth 1 -name '*.tar.gz' -print)"
uv venv --python 3.13.12 "$TASK_DIR/wheel-env"
uv venv --python 3.13.12 "$TASK_DIR/sdist-env"
export WHEEL_PY="$TASK_DIR/wheel-env/bin/python"
export SDIST_PY="$TASK_DIR/sdist-env/bin/python"
uv pip install --python "$WHEEL_PY" "$WHEEL"
uv pip install --python "$SDIST_PY" "$SDIST"The reviewed head also runs the ten transport cases. They cover the compact 64 KiB boundary, quoted/generated replies near the inline limit, serialization failure, and private snapshot cleanup.
2. Save these complete helpers
Save the following scripts exactly. They remain local validation artifacts.
cat > "$REPLAY_DIR/qualify_cli.py" <<'PY_COMPLETE_REPLAY'
"""Restore one seed at the same path; compare complete public output and durable bytes."""
from __future__ import annotations
import argparse
import base64
import hashlib
import importlib.util
import json
import os
from pathlib import Path
import shutil
import subprocess
import sys
import tempfile
parser = argparse.ArgumentParser()
parser.add_argument('--variants', required=True)
parser.add_argument('--output', required=True)
parser.add_argument('--fixture-source', required=True)
parser.add_argument('--fixture-module')
parser.add_argument('--cases', nargs='+', default=['active', 'human_gate', 'monitor', 'paused', 'stopped', 'invalid_context'])
parser.add_argument('--providers', nargs='+', default=['file', 'sqlite'])
args = parser.parse_args()
output = Path(args.output).resolve()
output.mkdir(parents=True, exist_ok=True)
hooks = Path(__file__).resolve().parent / 'hooks'
fixture_source = Path(args.fixture_source).resolve()
sys.path.insert(0, str(fixture_source / 'tests/control_plane'))
fixture_path = Path(args.fixture_module).resolve() if args.fixture_module else fixture_source / 'tests/control_plane/test_scheduler_arbitration_native_cli.py'
spec = importlib.util.spec_from_file_location('scheduler_cli_fixture', fixture_path)
fixture_module = importlib.util.module_from_spec(spec)
spec.loader.exec_module(fixture_module)
variants = json.loads(Path(args.variants).read_text())
assert variants and len({variant['name'] for variant in variants}) == len(variants)
assert os.environ.get('LOOPX_QUAL_CLOCK_EPOCH'), 'freeze seed construction and every CLI, not just the receiver'
assert float(__import__('time').time()) == float(os.environ['LOOPX_QUAL_CLOCK_EPOCH'])
import loopx
assert Path(loopx.__file__).resolve().is_relative_to(fixture_source), loopx.__file__
receipts = []
def snapshot(root):
files = {}
for path in sorted(root.rglob('*')):
if path.is_file():
raw = path.read_bytes()
files[str(path.relative_to(root))] = {
'sha256': hashlib.sha256(raw).hexdigest(), 'bytes_base64': base64.b64encode(raw).decode(),
}
return files
def execute(variant, fixture, argv, label, case_output):
environment = {**os.environ, 'LOOPX_USAGE_PING': '0',
'PYTHONPATH': os.pathsep.join([str(hooks), *variant.get('pythonpath', [])]),
'LOOPX_QUAL_EXPECTED_PACKAGE': variant['expected_package'],
'LOOPX_QUAL_TRACE': str(case_output / f'{variant["name"]}-{label}-trace.json')}
completed = subprocess.run([variant['python'], '-m', 'loopx.cli',
'--registry', str(fixture['registry']), '--runtime-root', str(fixture['runtime']),
'--format', 'json', *argv], cwd=fixture['project'], env=environment,
capture_output=True, text=True, timeout=90)
(case_output / f'{variant["name"]}-{label}-stdout.json').write_text(completed.stdout)
(case_output / f'{variant["name"]}-{label}-stderr.txt').write_text(completed.stderr)
assert completed.returncode == 0, (label, completed.stdout, completed.stderr)
result = json.loads(completed.stdout)
trace = json.loads(Path(environment['LOOPX_QUAL_TRACE']).read_text())
assert Path(trace['loopx_file']).resolve().is_relative_to(Path(variant['expected_package']).resolve()), trace
return result, trace
def canonical_snapshot(variant, fixture, label, case_output):
environment = {**os.environ, 'LOOPX_USAGE_PING': '0',
'PYTHONPATH': os.pathsep.join([str(hooks), *variant.get('pythonpath', [])]),
'LOOPX_QUAL_EXPECTED_PACKAGE': variant['expected_package'],
'LOOPX_QUAL_TRACE': str(case_output / f'{variant["name"]}-{label}-trace.json')}
script = ('import json,sys; from loopx.control_plane.coordination.canonical_snapshot import read_canonical_snapshot; '
'from loopx.control_plane.effect_runtime import effect_runtime_result; '
'print(json.dumps(read_canonical_snapshot(rpc=effect_runtime_result,runtime_root=sys.argv[1],'
'goal_id=sys.argv[2],include_leases=True,projection_readback=None,timeout=20)))')
completed = subprocess.run([variant['python'], '-c', script, str(fixture['runtime']), fixture_module.GOAL],
cwd=fixture['project'], env=environment, capture_output=True, text=True, timeout=45)
(case_output / f'{variant["name"]}-{label}.json').write_text(completed.stdout)
assert completed.returncode == 0, (completed.stdout, completed.stderr)
value = json.loads(completed.stdout)
assert value['status'] == 'loaded' and value['decision_read_from_provider'] is True
return value
def assert_stopped(receipt):
status = receipt.get('status')
if status == 'not_running':
assert not Path(receipt['info_path']).exists(), receipt
else:
assert status == 'stopped' and receipt.get('stopped') is True, receipt
def stop(variant, temporary):
environment = {**os.environ, 'PYTHONPATH': os.pathsep.join([str(hooks), *variant.get('pythonpath', [])]),
'TMPDIR': str(temporary), 'TEMP': str(temporary), 'TMP': str(temporary),
'LOOPX_QUAL_EXPECTED_PACKAGE': variant['expected_package']}
environment.pop('LOOPX_QUAL_TRACE', None)
completed = subprocess.run([variant['python'], '-c',
'import json,os,pathlib,loopx; assert pathlib.Path(loopx.__file__).resolve().is_relative_to(pathlib.Path(os.environ["LOOPX_QUAL_EXPECTED_PACKAGE"]).resolve()); '
'from loopx.control_plane.effect_runtime import restart_effect_runtime; print(json.dumps(restart_effect_runtime(wait_for_exit=True)))'],
env=environment, cwd=temporary, capture_output=True, text=True, timeout=30)
assert completed.returncode == 0, completed.stderr
receipt = json.loads(completed.stdout)
assert_stopped(receipt)
return receipt
for provider in args.providers:
for case in args.cases:
case_output = output / f'{provider}-{case}'
case_output.mkdir(exist_ok=True)
live, pristine, temporary = case_output / 'live', case_output / 'pristine', case_output / 'temporary'
temporary.mkdir(exist_ok=True)
for variable in ('TMPDIR', 'TEMP', 'TMP'):
os.environ[variable] = str(temporary)
os.environ['NODE_OPTIONS'] = ('--experimental-sqlite --import ' + str(hooks / 'freeze_clock.mjs'))
tempfile.tempdir = str(temporary)
if live.exists():
shutil.rmtree(live)
if pristine.exists():
shutil.rmtree(pristine)
live.mkdir()
fixture = fixture_module.make_scheduler_fixture(live, provider, case)
assert_stopped(fixture_module.restart_effect_runtime(wait_for_exit=True))
shutil.copytree(live, pristine)
(case_output / 'seed-state.json').write_text(json.dumps(snapshot(live), indent=2) + '\n')
reference = None
for variant in variants:
shutil.rmtree(live)
shutil.copytree(pristine, live)
packets = {}
traces = {}
try:
canonical_before = canonical_snapshot(variant, fixture, 'canonical-before', case_output)
packets['guard'], traces['guard'] = execute(variant, fixture, fixture['guard'], 'guard', case_output)
hint = packets['guard']['scheduler_hint']
expected = {
'active': ('bounded_delivery', 'run_now', 'active_work', 'interaction_agent_attempt_required'),
'human_gate': ('user_gate', 'backoff_waiting_for_user', 'human_gate', 'interaction_blocking_user_gate'),
'monitor': ('monitor_quiet_skip', 'backoff_until_material_transition', 'monitor_wait', 'interaction_monitor_quiet_wait'),
'paused': ('skip', 'stop_until_explicit_resume', 'quota_paused', 'quota_paused'),
'stopped': ('skip', 'stop_until_explicit_resume', 'goal_stopped', 'goal_stopped'),
'invalid_context': ('bounded_delivery', 'repair_scheduler_execution_context', 'control_plane_repair', 'invalid_scheduler_execution_context'),
}[case]
assert (packets['guard']['interaction_contract']['mode'], hint['action'], hint['cadence_class'], hint['reason_code']) == expected
fixture_module._assert_no_private_arbitration(packets['guard'])
states = {'guard': snapshot(live)}
if case == 'active':
binding = ['--goal-id', fixture_module.GOAL, '--agent-id', fixture_module.AGENT,
'--todo-id', fixture_module.TODO, '--turn-instance-id', fixture_module.TURN]
packets['refresh'], traces['refresh'] = execute(variant, fixture,
['refresh-state', *binding, '--classification', 'validated_intermediate_progress',
'--delivery-batch-scale', 'implementation', '--delivery-outcome', 'outcome_progress',
'--delivery-boundary', 'in_flight_continuation', '--delivery-workspace-path', str(fixture['project']),
'--no-global-sync', '--suppress-external-sinks'], 'refresh', case_output)
packets['spend'], traces['spend'] = execute(variant, fixture,
['quota', 'spend-slot', *binding, '--slots', '1', '--source', 'heartbeat', '--execute'], 'spend', case_output)
restart_receipt = stop(variant, temporary)
packets['settled_replay'], traces['settled_replay'] = execute(variant, fixture,
fixture['guard'], 'settled_replay', case_output)
assert traces['guard']['native_pid'] != traces['settled_replay']['native_pid'], 'managed runtime did not restart'
assert packets['settled_replay']['interaction_contract']['mode'] == 'heartbeat_settled_skip'
assert packets['settled_replay']['scheduler_hint']['action'] == 'preserve_current_schedule'
states['settled_replay'] = snapshot(live)
else:
restart_receipt = stop(variant, temporary)
packets['restart_replay'], traces['restart_replay'] = execute(variant, fixture,
fixture['guard'], 'restart_replay', case_output)
assert traces['guard']['native_pid'] != traces['restart_replay']['native_pid'], 'managed runtime did not restart'
states['restart_replay'] = snapshot(live)
canonical_after = canonical_snapshot(variant, fixture, 'canonical-after', case_output)
assert canonical_before == canonical_after, f'canonical records or revision changed: {provider}/{case}/{variant["name"]}'
complete = {'packets': packets, 'states': states,
'canonical_before': canonical_before, 'canonical_after': canonical_after}
(case_output / f'{variant["name"]}-complete.json').write_text(json.dumps(complete, indent=2) + '\n')
if reference is None:
reference = complete
reference_process_ids = {pid for trace in traces.values()
for pid in (trace['cli_pid'], trace['native_pid']) if pid is not None}
assert complete['packets'] == reference['packets'], f'complete public output differs: {provider}/{case}/{variant["name"]}'
assert complete['canonical_before'] == reference['canonical_before']
assert complete['canonical_after'] == reference['canonical_after']
assert complete['states'].keys() == reference['states'].keys()
lock_owners = []
key_order_only = []
process_ids = {pid for trace in traces.values() for pid in (trace['cli_pid'], trace['native_pid']) if pid is not None}
for phase, files in complete['states'].items():
prior = reference['states'][phase]
assert files.keys() == prior.keys(), f'persisted paths differ: {provider}/{case}/{variant["name"]}/{phase}'
for path, value in files.items():
other = prior[path]
if value == other:
continue
raw = base64.b64decode(value['bytes_base64'])
previous_raw = base64.b64decode(other['bytes_base64'])
try:
current_json, previous_json = json.loads(raw), json.loads(previous_raw)
except ValueError:
raise AssertionError(f'non-JSON durable bytes differ: {phase}/{path}') from None
if current_json == previous_json:
key_order_only.append(f'{phase}/{path}')
continue
if path.endswith('.lock') and isinstance(current_json, dict) and isinstance(previous_json, dict):
assert {key: value for key, value in current_json.items() if key != 'pid'} == {
key: value for key, value in previous_json.items() if key != 'pid'}, f'lock metadata differs beyond owner: {phase}/{path}'
assert current_json['pid'] in process_ids, f'lock owner outside observed CLI/native: {phase}/{path}'
assert previous_json['pid'] in reference_process_ids, f'reference lock owner outside observed CLI/native: {phase}/{path}'
lock_owners.append({'path': f'{phase}/{path}', 'reference_pid': previous_json['pid'],
'actual_pid': current_json['pid'], 'both_observed': True})
continue
raise AssertionError(f'complete persisted JSON value differs: {provider}/{case}/{variant["name"]}/{phase}/{path}')
counts = {}
for label, trace in traces.items():
count = {}
for request in trace['requests']:
key = f'{request["method"]}:operation={request.get("operation")}:scope={request["request_scope"]}'
count[key] = count.get(key, 0) + 1
counts[label] = count
receipt = {'provider': provider, 'scenario': case, 'variant': variant['name'],
'complete_sha256': hashlib.sha256(json.dumps(complete, sort_keys=True, separators=(',', ':')).encode()).hexdigest(),
'public_output_equal_to_first': True, 'complete_domain_state_equal_to_first': True,
'runtime_restart': {'stop_receipt': restart_receipt,
'before_pid': traces['guard']['native_pid'],
'after_pid': traces['settled_replay' if case == 'active' else 'restart_replay']['native_pid'],
'pid_changed': True},
'public_output_sha256': hashlib.sha256(json.dumps(packets, sort_keys=True, separators=(',', ':')).encode()).hexdigest(),
'infrastructure_lock_owner_differences': lock_owners,
'json_key_order_only': key_order_only, 'effect_boundary_counts': counts,
'module': traces['guard']['loopx_file'], 'python': traces['guard']['python'],
'wall_clock': traces['guard']['wall_clock']}
receipts.append(receipt)
(output / 'receipts.json').write_text(json.dumps(receipts, indent=2) + '\n')
print(json.dumps(receipt), flush=True)
finally:
cleanup_errors = []
for owned_variant in variants:
try:
stop(owned_variant, temporary)
except Exception as error:
cleanup_errors.append({'variant': owned_variant['name'], 'error': str(error)})
assert not cleanup_errors, cleanup_errors
PY_COMPLETE_REPLAY
cat > "$REPLAY_DIR/hooks/sitecustomize.py" <<'PY_CLOCK_AND_TRACE'
"""Private qualification: freeze wall clocks and observe the actual Effect boundary."""
import atexit
import datetime
import hashlib
import json
import os
import pathlib
import sys
import time
if os.environ.get('LOOPX_QUAL_CLOCK_EPOCH'):
epoch = float(os.environ['LOOPX_QUAL_CLOCK_EPOCH'])
original_datetime = datetime.datetime
original_date = datetime.date
class FrozenDatetime(original_datetime):
@classmethod
def now(cls, tz=None):
return cls.fromtimestamp(epoch, tz)
@classmethod
def today(cls):
return cls.fromtimestamp(epoch)
@classmethod
def utcnow(cls):
return cls.fromtimestamp(epoch, datetime.timezone.utc).replace(tzinfo=None)
class FrozenDate(original_date):
@classmethod
def today(cls):
value = FrozenDatetime.now()
return cls(value.year, value.month, value.day)
datetime.datetime = FrozenDatetime
datetime.date = FrozenDate
time.time = lambda: epoch
time.time_ns = lambda: int(epoch * 1_000_000_000)
if os.environ.get('LOOPX_QUAL_TRACE'):
import loopx
from loopx.control_plane import effect_runtime
expected = pathlib.Path(os.environ['LOOPX_QUAL_EXPECTED_PACKAGE']).resolve()
actual = pathlib.Path(loopx.__file__).resolve()
if not actual.is_relative_to(expected):
raise RuntimeError(f'qualification package provenance mismatch: {actual} outside {expected}')
original_request = effect_runtime.effect_runtime_request
requests = []
def observed_request(method, params, **kwargs):
entry = {'method': method, 'operation': params.get('operation'), 'params': params, 'request_scope': effect_runtime._REQUEST_RUNTIME_REVISION.get() is not None,
'params_sha256': hashlib.sha256(json.dumps(params, sort_keys=True, ensure_ascii=True,
separators=(',', ':')).encode()).hexdigest()}
requests.append(entry)
try:
result = original_request(method, params, **kwargs)
entry['result'] = result
entry['result_sha256'] = hashlib.sha256(json.dumps(result, sort_keys=True, ensure_ascii=True,
separators=(',', ':')).encode()).hexdigest()
return result
except Exception as exc:
entry['error'] = {'type': type(exc).__name__, 'message': str(exc)}
raise
effect_runtime.effect_runtime_request = observed_request
def save_trace():
fingerprint = effect_runtime._runtime_fingerprint()
info = effect_runtime._read_info(effect_runtime._runtime_info_path(fingerprint), fingerprint=fingerprint) or {}
pathlib.Path(os.environ['LOOPX_QUAL_TRACE']).write_text(json.dumps({
'python': sys.executable, 'python_version': sys.version, 'loopx_file': str(actual),
'cli_pid': os.getpid(), 'native_pid': info.get('pid'), 'runtime_identity': info.get('runtime_identity'),
'wall_clock': time.time(), 'argv': sys.argv, 'requests': requests,
}, indent=2) + '\n')
atexit.register(save_trace)
PY_CLOCK_AND_TRACE
cat > "$REPLAY_DIR/hooks/freeze_clock.mjs" <<'JS_CLOCK'
// Private qualification: preserve monotonic/performance clocks.
if (process.env.LOOPX_QUAL_CLOCK_EPOCH) {
const epoch = Number(process.env.LOOPX_QUAL_CLOCK_EPOCH) * 1000;
const RealDate = globalThis.Date;
globalThis.Date = new Proxy(RealDate, {
apply() { return new RealDate(epoch).toString(); },
construct(target, args, receiver) { return Reflect.construct(target, args.length ? args : [epoch], receiver); },
get(target, property, receiver) {
return property === 'now' ? () => epoch : Reflect.get(target, property, receiver);
},
});
}
JS_CLOCK3. Bind the four actual package roots and check production bytes
The installed children receive the hook directory in PYTHONPATH. The source checkouts are supplied only to source variants. The controller uses the baseline environment and the exact fixture SHA above.
(cd "$REPLAY_DIR" && "$BASE_PY" - <<'PY_VARIANTS'
import hashlib,json,os,pathlib,subprocess
root=pathlib.Path(os.environ['REPLAY_DIR'])
variants=[]
for name,directory,python in [('base',os.environ['BASE_DIR'],os.environ['BASE_PY']),('head',os.environ['HEAD_DIR'],os.environ['HEAD_PY'])]:
variants.append({'name':name,'python':python,'pythonpath':[directory],'expected_package':str(pathlib.Path(directory)/'loopx')})
clean_env={**os.environ,'PYTHONPATH':''}
for name,variable in [('wheel','WHEEL_PY'),('sdist','SDIST_PY')]:
python=os.environ[variable]
package=subprocess.check_output([python,'-c','import pathlib,loopx;print(pathlib.Path(loopx.__file__).resolve().parent)'],env=clean_env,text=True).strip()
variants.append({'name':name,'python':python,'pythonpath':[],'expected_package':package})
paths=['control_plane/effect_runtime.py','control_plane/effect_runtime_handlers.ts','control_plane/effect_runtime_server.ts','control_plane/quota/should_run.py','control_plane/quota/should_run_packet.py','control_plane/scheduler/arbitration.py','control_plane/scheduler/scheduler_hint.py','control_plane/work_items/interaction_contract.py','control_plane/work_items/interaction_contract.ts']
source=pathlib.Path(os.environ['HEAD_DIR'])/'loopx'
expected={p:hashlib.sha256((source/p).read_bytes()).hexdigest() for p in paths}
for variant in variants[2:]:
package=pathlib.Path(variant['expected_package'])
assert {p:hashlib.sha256((package/p).read_bytes()).hexdigest() for p in paths}==expected,variant['name']
artifacts={name:{'sha256':hashlib.sha256(pathlib.Path(os.environ[variable]).read_bytes()).hexdigest()} for name,variable in [('wheel','WHEEL'),('sdist','SDIST')]}
(root/'variants.json').write_text(json.dumps(variants,indent=2)+'\n')
(root/'package-replay-receipt.json').write_text(json.dumps({'base':os.environ['BASE_REF'],'head':os.environ['HEAD_REF'],'fixture_sha256':os.environ['TEST_SHA'],'harness_sha256':hashlib.sha256((root/'qualify_cli.py').read_bytes()).hexdigest(),'product_sha256':expected,'artifacts':artifacts},indent=2)+'\n')
PY_VARIANTS
)
LOOPX_USAGE_PING=0 PYTHONHASHSEED=0 LOOPX_QUAL_CLOCK_EPOCH=1792137600 \
PYTHONPATH="$REPLAY_DIR/hooks:$BASE_DIR" \
"$BASE_PY" "$REPLAY_DIR/qualify_cli.py" \
--variants "$REPLAY_DIR/variants.json" \
--output "$REPLAY_DIR/evidence" \
--fixture-source "$BASE_DIR" \
--fixture-module "$REPLAY_DIR/fixture.py"
"$BASE_PY" - <<'PY_RECEIPTS'
import json,os,pathlib
root=pathlib.Path(os.environ['REPLAY_DIR'])/'evidence'
rows=json.loads((root/'receipts.json').read_text())
assert len(rows)==48
for provider in ['file','sqlite']:
for case in ['active','human_gate','monitor','paused','stopped','invalid_context']:
selected=[row for row in rows if row['provider']==provider and row['scenario']==case]
assert len(selected)==4
assert len({row['public_output_sha256'] for row in selected})==1
assert all(row['public_output_equal_to_first'] and row['complete_domain_state_equal_to_first'] and row['runtime_restart']['pid_changed'] for row in selected)
print(json.dumps({'provider':provider,'scenario':case,'variants':[row['variant'] for row in selected],'public_json_sha256':selected[0]['public_output_sha256'],'canonical_and_domain_values_equal':True,'restart_pid_changed':True}))
PY_RECEIPTSEach source/installed child verifies its actual Python module root and records its native runtime PID/version, complete Effect boundary calls, and whether the production request scope was active. The active case executes refresh-state, spend-slot, a runtime restart, and settled replay. Other cases repeat their guard after a restart. Every row requires a changed native PID and a stopped or independently absent runtime receipt. Cleanup attempts every owned variant even if one stop fails. Monitor polling retains its expected no-spend audit row.
Evidence stays in the reviewer's scratch directory: complete stdout/stderr, canonical readbacks, RPC traces, seed snapshots, and all persisted file bytes. Fingerprints include local synthetic paths, so compare the four variants within each row. A failed invariant, changed public field, domain value, unexpected path, or unknown lock owner stops the script. An environment error does not count as a passed row.
4. Prove that the same harness rejects a semantic mutation
This changes one TypeScript branch in a separate package copy. The original worktrees and installed packages remain available for review. The expected failure is the active case's literal run_now invariant.
"$BASE_PY" - <<'PY_MUTANT'
import hashlib,json,os,pathlib,shutil
root=pathlib.Path(os.environ['REPLAY_DIR'])
mutant=root/'mutant-source'
assert not mutant.exists()
shutil.copytree(pathlib.Path(os.environ['HEAD_DIR'])/'loopx',mutant/'loopx',ignore=shutil.ignore_patterns('__pycache__','*.pyc'))
path=mutant/'loopx/control_plane/work_items/interaction_contract.ts'
original=path.read_bytes()
old='if (must_attempt) return ["active_work", "interaction_agent_attempt_required"];'
new='if (must_attempt) return ["quiet_wait", "interaction_agent_attempt_required"];'
text=original.decode()
assert text.count(old)==1
path.write_text(text.replace(old,new))
variants=json.loads((root/'variants.json').read_text())
(root/'mutant-variants.json').write_text(json.dumps([variants[0],{'name':'mutant','python':os.environ['BASE_PY'],'pythonpath':[str(mutant)],'expected_package':str(mutant/'loopx')}],indent=2)+'\n')
(root/'mutation-input.json').write_text(json.dumps({'original_sha256':hashlib.sha256(original).hexdigest(),'mutant_sha256':hashlib.sha256(path.read_bytes()).hexdigest(),'replacement_count':1},indent=2)+'\n')
PY_MUTANT
if LOOPX_USAGE_PING=0 PYTHONHASHSEED=0 LOOPX_QUAL_CLOCK_EPOCH=1792137600 \
PYTHONPATH="$REPLAY_DIR/hooks:$BASE_DIR" \
"$BASE_PY" "$REPLAY_DIR/qualify_cli.py" \
--variants "$REPLAY_DIR/mutant-variants.json" \
--output "$REPLAY_DIR/mutation-evidence" \
--fixture-source "$BASE_DIR" --fixture-module "$REPLAY_DIR/fixture.py" \
--cases active --providers file > "$REPLAY_DIR/mutation.log" 2>&1; then
echo 'ERROR: the semantic mutant passed' >&2
exit 1
else
test "$?" = 1
fi
"$BASE_PY" - <<'PY_MUTATION_PROOF'
import json,os,pathlib
root=pathlib.Path(os.environ['REPLAY_DIR'])
case=root/'mutation-evidence/file-active'
packet=json.loads((case/'mutant-guard-stdout.json').read_text())
trace=json.loads((case/'mutant-guard-trace.json').read_text())
assert pathlib.Path(trace['loopx_file']).is_relative_to(root/'mutant-source/loopx')
assert packet['interaction_contract']['mode']=='bounded_delivery'
assert packet['scheduler_hint']['action']!='run_now'
assert any(request['method']=='work_item.interaction_reads.project' and request.get('result',{}).get('result',{}).get('arbitration',{}).get('disposition')=='quiet_wait' for request in trace['requests'])
assert 'AssertionError' in (root/'mutation.log').read_text()
print(json.dumps({'physical_ts_mutation_executed':True,'same_cli_harness_rejected':True,'independent_invariant':'active work requires scheduler action run_now'}))
PY_MUTATION_PROOFRetained V3 performance misses
The earlier measured candidate 69186e5885feb9ecc4b4156ff8d10c8527788195 used baseline ef05bb2d9b250af0d05e8dadd47a48b69226fc74. It completed one frozen run. Its source checkpoint is preserved at that commit. These valid misses remain recorded:
| File/monitor measurement | Observed result | Original gate |
|---|---|---|
| Warm non-durable native p95 | 2.158608 ms | Strictly below 2 ms |
| Complete CLI p95, 64 alternating pairs | 832.624079 -> 900.477825 ms; +8.149386%, +67.853746 ms | At most +5% and +25 ms |
No sample was dropped or relabeled as environmental noise. The V3 seal SHA256 is eed5fe661e5c274da88d03452f8d9cf3ca6ebbefc7036da60ec088129a8244e0.
Source inspection found unconditional response-sink I/O for small projections. The V4 source uses ordinary inline transport for complete compact ASCII parameters up to 64 KiB. Larger inputs and failed size probes retain the existing private snapshot path. The 2 MiB inline and 64 MiB snapshot limits remain unchanged. This is a changed source revision with fresh qualification and the same frozen sample counts and gates. The V3 misses remain separate from the final head's results.
Retained V4 performance gate miss
V4 HEAD was ce2e9635d53c75354adea244642d178d717fbece, with baseline dda6f7ef79b2f88bf66ec335c12f027b2e2976d9. Its complete record remains separate. The valid File/monitor additive-gate miss remains an owner review requirement. No V5 result is treated as a repair or as evidence that V4 was environmental noise.
Historical V4: owner_review_hold
The frozen V4 run completed once, with zero retries. All 48 source/base/wheel/sdist CLI qualification runs and the physical TypeScript mutation check passed. All four warm native p95 values are below 2 ms. The File/monitor complete CLI row exceeds the separate 25 ms additive gate. This PR has not passed every performance gate.
| File/SQLite case | Warm native transaction p95, base -> head (ms) | Complete CLI p95, base -> head (ms) | CLI p95 change | Gate |
|---|---|---|---|---|
| File active | 1.115814 -> 0.691607 | 635.585804 -> 638.786536 | +0.503588%; +3.200732 ms | Pass |
| File monitor | 1.342389 -> 1.085817 | 783.327287 -> 809.739958 | +3.371856%; +26.412671 ms | Hold: exceeds 25 ms |
| SQLite active | 1.309567 -> 0.766808 | 672.619207 -> 663.347898 | -1.378389%; -9.271309 ms | Pass |
| SQLite monitor | 1.136332 -> 0.711574 | 898.165726 -> 803.763056 | -10.510607%; -94.402670 ms | Pass |
The baseline transaction has two selected native requests; the candidate has one. The full active CLI uses 3 -> 2 selected calls; monitor uses 12 -> 8. Every selected request uses the real production request scope. Each complete CLI row uses 64 alternating matched pairs. All 256 pairs preserve complete public JSON and durable domain values. Cold/warm/burst use 16/128/256 observations per variant and row. Quantiles use nearest rank, without sample removal. The CLI gate requires both <=5% and <=25 ms; the native gate requires strictly <2 ms. The fixed wall clock also applies to seeding; performance clocks remain real.
All owned managed runtimes stopped. The exact source, script, raw sample and state evidence seal SHA256 is ecef977f9c3334c212237c7df285a52f3c376dfb363de416d8606a46fae9a846. The protocol SHA256 is 93c6b357101b392bbafe4a177a29c7c3f558dafe1e76931381e4841fb40de665. The V3 misses remain recorded in this packet. These synthetic Linux checks do not establish real-model or external automation behavior.
loopx-agent
left a comment
loopx-agent
left a comment
There was a problem hiding this comment.
Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; reasoning_effort=max
REQUEST_CHANGES · head f8555130aab4ceb3e5dcea35884fa70c6e01b209
[P2] 一起迁移仍调用旧签名的三个公开 smoke。 build_scheduler_hint 删除 agent_scope_frontier_actions 并要求调用者提供 arbitration，但 interaction-contract-state-machine-smoke.py:189 仍传旧 keyword，quota-scheduler-hint-compaction-smoke.py 与 quota-scheduler-policy-smoke.py 仍未提供新 record。本次在实际基线和精确 head 执行同三条命令：base 全部 exit0；head 分别抛 TypeError: ... unexpected keyword argument 'agent_scope_frontier_actions' 和两次 ValueError: scheduler arbitration must come from the interaction projection。原生 premerge 也选中并报出第一项。请在本提案迁移这三处既有调用，接到现有原生组合结果并保留原断言，再执行相关 canary；不要删覆盖或恢复第二个 Python 仲裁 owner。位置：loopx/control_plane/scheduler/scheduler_hint.py:1298。
动机
需要通过定时唤醒持续推进 Goal、同时依赖现有调度验证保护恢复行为的维护者和用户。旧路径先构造交互要求，再由 Python 调用一次原生一致性检查并选择调度动作；新路径在同一次原生投影中返回要求和仲裁结果，减少往返。但三个现存公开 smoke 的调用方式未迁移，当前直接报错。真实 File/SQLite 的六类 CLI 场景在源码及正常 wheel、sdist 安装中保持完整输出和持久状态，重启后仍正确等待或结算；公开验证入口的兼容缺口和既有性能 hold 尚未关闭。本次不迁移整个 scheduler、cadence、Host IO 或存储事务，不证明 Windows、PostgreSQL、真实模型、已安装 App、外部自动化或长期收益，也不放宽原性能门。先迁移三个仍在使用旧 helper 签名的现有公开 smoke；原 V3/V4/V5 的有效性能失败继续由本迁移 owner 处理，不能用这次正确性重放覆盖。
实际基线 052f492767a1d893dfb96a9f777331459fd4c5ae，完整提案27路径。先读 docs/architecture/rfcs/typescript-control-plane-migration-v0.md 在该不可变版本中的 2.4 Replacement, not production dual-running、5. Payoff-phase PR contract、Caller-observable semantic parity is a promotion gate 与 Performance。这些既有条款支持合并一个真实热路径的决策 owner，也要求接通真实消费者、保留诊断/恢复及原性能门；PR 自己新增的 RFC checkpoint 不能证明这些条件已满足。后续整体 R5 与正式安装采用继续由原路线验收，没有为本批新增门槛。
改动思路
仲裁规则适合归入既有 TS interaction owner，与已经必须执行的 required-read 投影同一次调用；Python 只保留输入 codec、结果适配和尚未迁移的 cadence。本提案是现有 quota 两个 producer 的仲裁 consumer 切换，必须同时接通现有验证消费者；它不关闭整体 scheduler、安装采用或性能资格。
以前 required-read 投影后，Python 再组织结构诊断、调用独立 native consistency RPC 并选 disposition；现在 projectInteractionRequiredReads 在既有 TS 模块内组合 reads 和 projectSchedulerArbitration。两个 quota producer 把返回的私有 SchedulerArbitration 直接传给 hint，公开 interaction dictionary 不增加仲裁字段。已有 consistency kernel 继续负责共同非法状态，诊断顺序与 first-match 优先级只在同一 TS owner 维护，生产环境没有新旧双跑。
| 调用边界 | base | 当前 head |
|---|---|---|
| 一个选定的构造/仲裁对 | reads + 独立 consistency | 同一现有原生投影 |
| 实际 active guard 的相关家族调用 | 3 | 2 |
| 实际 monitor guard 的相关家族调用 | 12 | 8 |
| cadence、Host IO、存储提交 | 原 owner | 原 owner |
这是实际生产 request scope 的 CLI trace；它不是所有 RPC 总数，更不能代替端到端延迟。dict-only 的后续 cooldown/recovery 构造仍保留原字典 API，丢弃未消费的私有 record，不覆盖 hint 较早的决定。
具体改动
9个产品文件为 +155/−196，净−41；15个测试/夹具为+620/−50；2份双语 RFC checkpoint +29；手工维护的 tsconfig 编译纳入项+1。不是把整片代码量都算成纯规则删除：删除的139行定义还含签名、docstring、codec/transport。原 Python _required_bool、_classify_disposition、build_scheduler_arbitration 和 standalone consistency handler 被移除；Python 仍保留 scalar/Mapping codec、Enum/dataclass 结果适配、私有 pair 及未迁移的 cadence。退出条件对应真实 hint/五个 dict construction caller，而不是抽象的“以后迁移”。
projectSchedulerArbitration 累积 schema/通道/布尔结构错误，再复用 interactionConsistencyIssues，最后按既有优先级决定终止、peer/monitor 等待、人类 gate、settled、replan 或 active。non-gating notice 仍需 non_gating_notice=true 与 wait_source=turn_settlement 同时成立；invalid/terminal/spend 矛盾不产生工作授权。没有 substring denylist 或从 prose 猜状态。
完整 compact ASCII facts ≤64KiB 时走 inline；更大的输入与探测序列化失败复用既有私有 snapshot，不截断；2MiB wire/64MiB snapshot 上限不变。原 reads 透传、最多3条生成 read、shell quoting 和有界诊断支持文档所述保守输出上界。10个实际 transport 用例覆盖64KiB边界、Unicode/引号、超大回复、近 wire cap、原序列化错误和私有文件清理。这里迁移的是内部决定组合，不新增 operator-facing 读模型；没有用内部 tuple 冒称整个 quota 投影封套或所有平台已经迁移。
独立验证：377 Python、45 native TS 测试通过，包含目前新增 transport/caller tests；control-plane TypeScript、Ruff、先 diff advisory 后完整 semantic smoke、workspace contract、正常 Chat/wheel/sdist 构建通过。两份全新隔离安装的9个产品文件与源码及归档逐字节一致。
用同一个完整 CLI harness 与不可变 synthetic fixture，在真实 File/SQLite 上对 active、人类 gate、monitor、paused、stopped、invalid-context 六类场景执行 base/source/wheel/sdist：48行全部通过。保留全部 public JSON、完整持久 domain 值与 path sets、canonical revision/Todos/leases、真实进程 owner，而非只比字段名/原因码。active 完成实际 refresh/spend，停原生进程后同 Turn replay；其他场景也实际重启并核对 PID 改变。再将私有拷贝的 TS active 分支物理改成 quiet_wait，相同 public CLI harness 因 run_now 不成立而失败；原 source/packages 未改。以上是有界正确性证据，不是模型或长期运行收益。
对主干的风险
当前最直接的回归是 F1：新增的 test-only adapter 把测试调用迁移了，所以377/45可以绿；仓库仍可执行的三个公开 smoke 却遗漏。原生 canary 有5项 direct、19项 selected，独立报出 interaction-contract-state-machine 的签名错误。另两项实际命令独立复现，不是从 traceback 猜测。修复应迁移这些验证消费者，保留跨层断言和紧凑/详细输出断言；不能把它们当 obsolete 删除，也不必为同仓库源调用恢复旧 Python 决策。
maintainability 的 DSH advisory 单独保留：同一命令在实际 base/head 都 exit1，完整 stdout/stderr 逐字节相同，因果 dsh_operation_host.py 未变，magnitude regression0。它不解释本次新 smoke 失败，也不被写成通过。
原性能资格仍是 owner_review_hold：公开 exact-head V5 SQLite/monitor p95 为2115.061687→2293.734649ms（+8.447648%、+178.672962ms）；V4 File/monitor +26.412671ms 的有效失败也保留。本次独立重放正确性与实际调用数，没有重跑原冻结计时协议，也没有证明这些尾延迟已被修复或因环境而无效。warm helper 更快、调用更少或另一次集成正确性成功都不覆盖既有5%/25ms门。Windows、PG、外部 Host、真实模型及 installed App 没有被本结果认证；该纯投影组合不新增PG写事务。本次遵守当前 no-CI 策略，没有查询、轮询、等待或触发 hosted CI。
我的整体评价
迁移方向和大小基本合理：一个既有 TS owner，真实重复 Python 规则和独立 leaf handler 被移除，输入/结果适配都有具体剩余 caller；不是为了迁移而新增服务。相关 future-facing pass 已应用在规则去重和现有 coarse operation 组合；可把本地 disposition 返回类型进一步收紧为既有 vocabulary 的 union，但无需新 schema 框架或额外迁移项目。
当前 head 请求修改：先把三个既有公开 smoke 消费者一同迁移并让原断言重新执行；同时继续保留、处理原性能 hold。48行 public CLI/状态重启对照证明当前选定生产路径的正确性，不能把没迁移的验证入口或未满足的性能门涂绿。本评审不授予合并、默认采用或整体 scheduler 完成状态。
English verdict: REQUEST_CHANGES - f8555130aab4ceb3e5dcea35884fa70c6e01b209 breaks three existing public scheduler smoke callers: each passes at the immutable base and crashes on this head after the helper API change. 377 Python/45 native tests and48real File/SQLite base/source/wheel/sdist CLI/restart comparisons pass, including physical TS mutation sensitivity. The original V3/V4/V5 performance holds remain; this review neither reran nor waived their frozen timing gates. CI was not consulted.
| *, | ||
| user_action_required: bool = False, | ||
| agent_scope_frontier_actions: Collection[str] = (), | ||
| arbitration: SchedulerArbitration | None = None, |
There was a problem hiding this comment.
[P2] 一起迁移仍在调用旧签名的三个公开 smoke。在同一提案把三个既有 smoke 接到现有原生组合结果，保留原断言并执行完整相关 canary；不要恢复第二个 Python 仲裁 owner 或删掉失败覆盖。 本次已独立复现：All3pass at actual base but crash on the reviewed head; the selected native premerge canary fails before cross-layer regression assertions execute. 验证要求：Same3commands at immutable base/exact head, then native premerge; retain complete File/SQLite public CLI/restart parity and physical TS mutation sensitivity.
This branch has not been deployed
2 participants
Review status: performance hold
Current V5 hold: sqlite/monitor complete CLI p95 2115.061687→2293.734649 ms (+8.447648%; +178.672962 ms). The CLI gate requires both ≤5% and ≤25 ms. No target is waived. Performance acceptance remains
owner_review_hold; no merge or default-adoption approval is claimed. Historical V3/V4 misses remain in the validation packet.Summary
Advance the TypeScript control-plane migration RFC with one bounded consumer cutover: compose scheduler arbitration with the existing interaction required-read projection.
Python still owns cadence and explicit Host IO. This PR completes one arbitration consumer boundary; it does not claim whole-scheduler retirement or installed-cohort adoption.
Migration economics receipt
work_items/interaction_contract.tsowns the complete arbitration decision and shared consistency kernel._required_bool(12),_classify_disposition(35),build_scheduler_arbitration(92). This includes signatures, docstrings, codecs and transport, not 139 lines of pure rules. Structural diagnostics, precedence and disposition ownership are retired from Python. The separate 2-line_mappingcodec deletion is excluded. The old native consistency wire function/handler is also deleted.quota should-runCLI traces: active and human gate required-read/consistency calls 3→2; App monitor chain 12→8; paused/stopped 1→1; invalid execution context 2→2. These are counts for this operation family, not all CLI RPCs. The selected paired construction/hint changes 2→1; additional real callers still construct contracts.build_scheduler_hintand five dict-only constructions: three inquota/live_decision.py, recovery inquota/unsettled_host_turn.py, and the cooldown finalizer. Delete them when scheduler cadence/hint and interaction construction run in TypeScript. External Host mutation remains its own adapter.Validation
Performance acceptance remains
owner_review_hold. The valid V4 File/monitor CLI p95 was 783.327287→809.739958 ms: +3.371856% and +26.412671 ms. It missed the frozen 25 ms additive target. The owned implementation is unchanged in V5, so this integration run does not prove that miss fixed or waive it. Current V5 hold: sqlite/monitor complete CLI p95 2115.061687→2293.734649 ms (+8.447648%; +178.672962 ms). The CLI gate requires both ≤5% and ≤25 ms. No target is waived. V3/V4 results retain their original source identities and remain in the validation packet.f8555130aab4ceb3e5dcea35884fa70c6e01b209, main/base052f492767a1d893dfb96a9f777331459fd4c5ae. Main was integrated immediately before publication. Six commits carry DCO sign-offs. All 27 authored files match the previously reviewed parent; fresh checks below use this public integration head.d3b7b141c0d4b97a20746d1179396cbef481ac08. Its two Lark admission-identity files do not intersect the 27 authored paths or repeat this arbitration implementation. This later main is not in the qualified head; that merge combination still needs integration validation before merging this PR._run_dsh_operation_host(93 statements, ceiling 90). No new finding or budget exception remains. This local differential qualification covers Linux File/SQLite. It does not cover Windows, PostgreSQL, real-model execution or external Host mutation. GitHub CI results are tracked separately.Scope and overlap
The live inventory at
2026-10-16T10:20:13.295789+00:00covered all 45 other OPEN PRs, with complete paginated file lists and shared-hunk review. No duplicate arbitration implementation was found. Delegation inventory (#6591), whole-Goal task maps (#6602), semantic progress (#6613), and the two broad scheduler proposals concern different owners. Shared RFC/handler/snapshot-list edits are distinct methods or paragraphs.This PR deletes one Python arbitration authority and its standalone wire operation. Both real quota producers consume the existing native projection. The remaining Python facade has the exit condition listed above. The PR is open for review; performance acceptance remains held. No merge or default-adoption approval is claimed.