fix(benchmark): restore worker access to selected research data

[loopx-agent]

Goal And Delivered Outcome

• Outcome basis: a reproduced warm-receiver access defect.
• Goal/source and gap: SForge restores explicitly selected research components as root while preserving their sealed permission modes. Only the task workspace changed owner, so a private 0700 research directory or 0600 file could remain inaccessible to the agent before its first preparation.
• Observable before → after: selected research copies join the existing workspace ownership handoff to the current worker. Contents and permission modes remain unchanged; unselected components remain inert. Default restoration without selected components preserves its previous command and failure message.
• Intended base: main (f9bdae67596c185cebc81dc555dd6a3e0242e9c5).

Author Declaration

• Written by: model_agent — OpenAI GPT-6 family, Codex.

Implemented against

• Specification: docs/reference/research-checkpoint.md, “Prepare and capture” and “Admit a fresh session and adopt context”, at f9bdae67596c185cebc81dc555dd6a3e0242e9c5.

Criterion	Disposition	Symbol / path	Test or command
Materialize explicitly selected research data and verify its bytes at the receiver	implemented	WarmStart.stage, SForgeWorker._install_worker	Staging selection tests and non-root native-container readback
Retain immutable captured bytes and private modes	implemented	Existing artifact verification and receiver ownership transfer	Mode/content comparison in staging and real-backend validation
Retain independent destination authority	implemented; existing authority owners unchanged	Existing warm-session/context admission	Full warm-receiver regression suite and current preparation readback

• Self-check: inspected the scope and invalid-selection rules, reused their verified destination list, and checked empty-selection parity and transfer refusal before readiness. Python remains the existing domain transport; typed artifact and control-plane decisions retain their current owners. The internal staging return value adds no persisted protocol or configuration field.

Scope And Continuation

• Completed scope: restore access to selected research data through the existing ownership handoff. No new capability or caller configuration is introduced.
• Slice boundary: complete within this repair. The broader checkpoint research programme retains scientific completeness and actual model adoption as separate acceptance.
• Future-facing pass: the transport consumes the existing verified selector rather than deriving another destination rule.

Validation

• Tested revision: 3cf8e03bcaa76553ba51e666327014e72388807c.
• Run state: finished.
• Input classes: synthetic, authorized_private_read_only.

Check kind	Result	Public-safe evidence / limitation
unit	passed	Linux with native benchmark dependencies: python -m pytest benchmark/tests/test_sforge_warm_start.py benchmark/tests/test_sforge_runtime.py — 337 passed, zero skips. Covers files/directories, empty selection, refused ownership transfer, invalid scopes/collisions, and existing worker profiles.
regression_parity	passed	An ordinary native-task image reproduced a non-root reader being unable to traverse selected root-owned private directories. The repaired ownership path preserved their byte/mode witnesses and made them accessible. Empty-selection failure text is pinned to its original value.
real_entrypoint / real_backend	passed	Docker 29.5.2, ordinary SForge install and command preparation, disposable offline native-task container at the exact head. All selected research data were read by the non-root worker with exact byte/mode witnesses. Full native session/Explore context, current preparation and fresh dispatch before any model were also verified. Owned containers were removed. Private source material is not uploaded.
static	passed	git diff --check, Python compilation, bilingual RFC diff check; no RFC pair changed. Development semantic advisory found no supported new vocabulary carriers; this is not a semantic-equivalence proof.
manual	blocked	Standard premerge: five direct and nine selected catalog checks passed. The benchmark-sensitive maintainer-review hold remains. No self-merge or benchmark job admission is claimed.

• Coverage and gaps: the change affects receiver filesystem access, with the same validated research selection and sealed modes. Real model research benefit and benchmark scoring are outside this repair; qualification makes no model inference or native evaluation calls. The exact-head backend result and owned-container cleanup have been read back.

Frontend / Visual Evidence

• UI impact: none. Existing benchmark restoration entry; no frontend/Lark interaction changed.
• Before / after / preview / states / attention and craft review: N/A, no presentation change.
• Source data: none for UI.

Type of Change

• Bug fix
• Test update

LoopX Area

• Benchmark boundary (adapters, runners, verifiers, scoring, evidence)

Technical Direction

• Existing explicit research checkpoint receiver contract; domain-specific IO repair, without a new control-plane decision owner.

Shared-authority RFC fixture impact

N/A. No shared Goal Authority or TypeScript migration progress is claimed.

Boundary Checklist

• Diff and PR contain no private state, credentials, raw traces, verifier output, internal links or local machine paths.
• This repair follows the demonstrated owned receiver defect.
• Changes are limited to the verified ownership handoff and focused regressions.
• No paired RFC changed; bilingual check passed.
• UI impact is none.
• Every commit carries DCO sign-off.

[loopx-agent]

Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; reasoning_effort=max

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

Exact head: 3cf8e03bcaa76553ba51e666327014e72388807c；不可变基线：f9bdae67596c185cebc81dc555dd6a3e0242e9c5。

动机

使用检查点恢复研究任务的操作者，需要让接收端普通工作用户读到明确选择的历史资料。旧路径由 root 恢复文件，却只移交任务工作区；恢复出的 0700 私有目录或 0600 文件仍属于 root，工作用户即使拿到完整字节也无法读取，准备阶段会卡在资料访问上。现在沿用已经验证的组件选择，把这些研究副本与工作区一并移交当前 worker，保留内容和权限模式；未选择的资料保持原状。

本次独立验证支持这个有限的文件访问修复。没有证明真实模型采纳、科研收益、官方分数提升、完整原生会话恢复或用户默认安装已更新，也没有运行 benchmark 任务或模型。资料可读是继续研究的必要条件，不能单独证明继续研究已经成功。

独立规范在阅读实现前固定为 docs/reference/research-checkpoint.md，版本 f9bdae67596c185cebc81dc555dd6a3e0242e9c5。验收映射：Prepare and capture 要求显式物化选择的研究组件并核对接收端字节，本次在既有选择器、真实 artifact staging 与实际非 root 读取之间补齐所有权移交；Admit a fresh session and adopt context 要求目的端重新准入，旧 lease、grant 和历史观察仍不授当前权限，这些 owner 没有改动；Disable and qualification 保留显式激活和独立科研效用验收，后者不属于本次修复。

改动思路

不修复会继续出现“资料恢复了但 worker 读不到”的中断。把资料改成全局可读虽然更省一条路径传递，却改变私有权限与封存 witness，不是等价替代。正确的最小修复是复用既有文件系统移交，把经过现有选择器核验的目的路径交回调用者；无需新建权限表、组件配置或恢复状态机。

选择仍由 _research_components 绑定封存元数据与显式 ID，产物字节由既有 TypeScript artifact owner 核验；SForge 只负责自己的容器 IO。当前 PR 边界是既有 warm worker 安装入口的资料访问修复，不扩展到模型研究、完整会话恢复或产品恢复界面。这个内部返回值不落盘，也不要求用户重复输入路径或补充确认；已有明确选择与权限不新增人工轮次。

下面用文字说明实际顺序：stage 验证并上传封存参与者 → root 物化工作区及所选资料 → chown -R -P 移交工作区和所选副本 → 成功才写 worker profile；移交失败立即抛错，后续准备不能假装就绪。未选组件不进入参数列表。这里没有新增分支图，也没有把图示当执行证据。

具体改动

1. WarmStart.stage 在原 verify 后复用 _research_components，最终返回实际选择的目标路径。验证、上传、原有 root-only staging、配置保护及失败顺序保留；没有选择时返回空列表。
2. SForgeWorker._install_worker 消费这些路径，仍通过 backend 的 argv 调用现有 chown -R -P agent:agent，没有拼接 shell，也没有放宽 chmod。返回非零时，有所选资料才使用新的 research-state 错误文本；空选择的旧参数和完整错误文本保持相同。
3. 两个现有测试文件覆盖目录／文件选择、0700／0600 模式、空选择、拒绝移交及就绪标记。单独校验返回路径，不能证明非 root 可读，所以本次另做了真正的 Linux 文件权限对照。

共四个路径、+64/-8；两个生产文件合计只有有界移交逻辑，其余是现有回归的扩展。调用搜索确认 stage 的生产消费者就是该安装入口；无新模块、持久协议、CLI、默认开关或前端／Lark 操作。相邻未来重构检查结论是沿用现有选择器和单一移交处；再抽一层权限框架没有当前价值。Python 留在既有 SForge 传输边界，未复制通用 TypeScript 决策。

对主干的风险

独立运行两个完整相关模块，337 passed、0 skipped。在 Docker 29.5.2 的隔离 Linux/amd64 容器中，以真实 uid 1000 用户读取 root 所有的资料，并通过不可变 base／当前 head 的真实 SForgeWorker.install_stop_hook → _install_worker 调用实际 chown。十二组对照涵盖空选择、0600 文件、0700 目录，以及成功／真实 OS 拒绝移交：base 的两个所选资料成功安装后仍不可读；head 可读。两侧空选择的完整 argv／错误文本相同；拒绝移交都没有写就绪标记。封存源、未选资料的 owner、全部内容和模式不变。

这个对照明确保留了模拟边界：无关工具安装和 workspace 物化阶段使用合成 fixture，选择器与所有权副作用、文件权限、非 root 读取是真实执行；真实 artifact 验证和 staging 另由上述完整模块覆盖。Linux 通过 arm64 Docker VM 的 amd64 仿真运行，不提供性能证据。没有把这十二组称为完整原生会话／模型恢复，也没有沿用作者私有材料或测试结论。自有容器已移除并按精确名字确认不存在。

Ruff、diff/DCO、语义 advisory 后的完整 semantic 检查和四路径公开边界扫描通过。advisory 在 benchmark 路径下没有支持的新 vocabulary 候选，不能证明语义等价；状态／artifact owner 及调用方仍人工核验。正常 native premerge 的 5 个直接检查、9 个选中命令全部通过，但总 gate 为 manual_review_required：benchmark-sensitive 维护者审查 hold 保留，不报整门通过。其正式双语检查也已通过。补充命令最初引用不存在的双语脚本；独立探针先遗漏源码路径、再因字符串换行语法失败，均是验证器准备错误，原输出保留，修正后上述完整执行成立。没有修改产品或有效测试消除红灯；没有查询、轮询、派发或等待 CI。

我的整体评价

APPROVE；交付判断为 goal_achieved，仅指本次所选研究副本的访问修复。 验证过的路径从既有选择器到真实 worker 移交，补上恢复后第一次读取这个实际障碍；没有把新资料、控制目录或历史权限隐式纳入当前授权。失败仍由原 receiver attempt／备份隔离 owner 处理，原先失败或已准备的接收端不能覆盖重用。

长期维度保留原始 phase deadline、历史／当前权限分离及失败隔离；此次资料可读不证明模型效用或长时间稳定性。用户旅程改善发生在原安装／恢复入口，无额外导航、复制参数或确认。所选目录是否可读有真实正反例，默认无选择及未选资料也有相反方向证据。保持这个完整而可回退的内部修复即可，不要求无关产品界面或更大的科研实验作为前置。维护者审查、精确 head 的合并就绪与明确合并授权仍是独立门禁，本次没有执行合并。

English verdict: APPROVE — 3cf8e03. The existing validated selection now reaches the worker ownership handoff; independent real Linux non-root base/head cases prove readable selected copies with unchanged bytes/modes and inert unselected data. 337 focused tests and all 5 direct/9 selected premerge checks pass; the benchmark maintainer hold and broader native-session/model utility remain separate.