fix(manager): read current Goals through a live evidence scope

[huangruiteng]

Problem and outcome

A manager connection saved a fixed list of readable Goals, so registering another Goal later could produce goal_outside_available_scope. Some inspection views also treated the bounded Turn portfolio as the permission list. An authorized manager should be able to find and inspect current registered Goals without granting execution or SSH authority.

New Lark manager connections default to a live all_registered evidence-read scope. The existing connection editor can select or narrow this scope; historical selected grants stay selected until explicitly changed. Local owner inspection resolves current registry membership independently of the initial Turn index, and portfolio pagination filters permission before collecting evidence.

Design and boundaries

• Extend the existing TypeScript source-grant owner; Python adapts policy storage and current registry inputs. Reuse all_registered / selected and the existing Goal-ID validator.
• Use the same live audience grant for portfolio, Todo, delivery, Agent and handoff inspection, preserving binding checks and revocation before/after reads. Page before collecting details, including inventories larger than the initial 128-Goal index.
• Expose scope selection and readback in the existing Lark settings modal. The read grant applies to that authorized conversation audience; delivery recipients, sender authorization, execution and remote-host access remain independent.
• Preserve a committed connection receipt and refresh routing if saving its read scope fails, with an explicit retryable partial result.
• The related simplification consolidates read-scope decisions in the existing typed owner rather than adding another permission store or capability.

Validation

• Real canonical File and SQLite reads with an empty initial Turn index; source state remains unchanged. New registration is visible without rewriting policy, and narrowing to an empty selected scope revokes access.
• Registry pagination across 145 Goals, restricted collection, unreadable inventory, and revocation during a read.
• Focused manager/context/report/discovery/inspection/Lark suites: 228 passed at final head cebcd8f9c98791ab92e144147266bced92146e5b. Related tracking and SSH evidence suites: 60 passed. TypeScript source-grant tests: 11 passed; control-plane typecheck and configured mypy passed.
• Built the packaged frontend and exercised the existing steward group scenario, including default scope, save/readback and narrowing on desktop/mobile; visually inspected the modal.
• Diff hygiene, semantic-vocabulary advisory/full-tree check and maintainability ratchet passed. All 19 risk-based premerge checks passed at the preceding product-identical head; the final delta updates only the existing inspection fixtures, whose full 40 cases also pass in the 228-test run. Independent exact-head review is recorded separately.

The packaged browser uses a synthetic Lark provider boundary; real File/SQLite checks cover the backend. No live Lark message or model invocation is required. This does not migrate Goal authority, qualify a 2.0 installation, or change remote authentication.

[huangruiteng]

Validation update for head 07de119dfb8c4cb11f4077773d9674fac879b10c:

• Changed surfaces: source-grant semantics, manager evidence inspection, Lark scope settings/API and focused tests/docs. The existing TypeScript source-grant owner and Goal-ID validator own the read scope; no duplicate authorization store or execution grant was introduced.
• At this head: 188 focused Python tests, 11 TypeScript source-grant tests, control-plane typecheck and production frontend build passed. The packaged steward group scenario passed desktop/mobile default selection, save/readback and narrowing. Canonical File/SQLite tests read the actual providers and prove state remains unchanged; revocation and partial-connection failure cases are included.
• Related tracking/SSH tests: 60 passed on the pre-rebase implementation. The first full risk-based premerge run passed all 19 selected checks. That run started before the final rebase/refinement; an unchanged-head rerun is in progress and will be reported separately. Configured mypy passed; ad-hoc checking of entire untyped mixins produced existing protocol/type errors and is not represented as a passing project check.
• Public/private scan and exact-scope change-quality qualification passed. No live message, model call or active Goal mutation was used as validation. The browser fixture uses a synthetic Lark provider; frontend packaging and File/SQLite reads were exercised directly. No first-screen redesign or manual product hold is introduced.
• Merge remains subject to independently published exact-head review and current merge readiness. Local installation qualification and major-version migration are separate from this PR.

[huangruiteng]

Final author validation at cebcd8f9c98791ab92e144147266bced92146e5b:

• The reviewer found five affected inspection-test regressions. Fixed the fixtures to supply the current registry/source while retaining unknown, stopped, oversized-record and subprocess-tool assertions. The production diff from 07de119d is empty.
• All 228 focused Python tests now pass together (29.86s), including all 40 inspection tests. TypeScript 11 tests, control-plane types and configured mypy pass. Rebuilt the final production assets and reran the packaged steward-group scenario: default/save/readback/narrowing on desktop/mobile passes.
• All 19 selected premerge checks passed on 07de119d; the final test-only delta additionally passed pytest, ruff and diff hygiene. Exact-scope change-quality receipt passes for the final head. Public/private scan passes; no live Goal mutation or model/Lark message was used for validation.
• Broad ruff also reports one unchanged roundtrip.py unused import outside this diff; changed-path ruff is green. An extra ad-hoc mypy invocation outside the configured project scope was unsuccessful and is not claimed as validation. The configured project check is the passing check reported above.
• Scope/permission behavior and product journey are described in the PR. No new first-screen presentation or manual hold is introduced. Await independently published current-head judgment and current merge readiness; author validation is not review or merge authority.

[huangruiteng]

Reviewer: model_agent · gpt-6.1-sol · OpenAI · runtime_reported · xhigh

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

Reviewed head: cebcd8f9c98791ab92e144147266bced92146e5b. No blocking finding.

动机

受影响的是通过本机或 Lark 管家询问多个 Goal 当前进展的使用者。Goal 是 LoopX 中持续推进的一项工作；管家开场收到的列表只是有界摘要，不应该成为后续读取的授权清单。

例如，管家开始对话后又注册了一项工作：原实现可能继续按旧列表回答，导致使用者反复更新范围或误以为工作不存在；新实现按当前授权查询注册表，并在采集证据前分页。

本轮已验证动态发现、选定范围隔离及撤销；它不授予执行、发布、跨会话投递或 SSH 访问权限，也不代表已安装客户端升级或真实模型理解能力得到验证。

改动思路

我先比较了不修改、扩大初始摘要上限和修复既有授权 owner 三种方案。扩大上限不能处理后续注册，也会把展示预算继续混同于权限；另建一套授权表则会增加同步和撤销成本。当前方案复用已有 TypeScript source_grants 与 Goal ID 校验器，保存“选定列表”或“全部已注册”的用户意图，实际 inventory 始终从当前注册表派生。Python 负责文件锁、注册表读取和 provider 接线，没有再复制一套授权决策。

保留现有授权 owner 并把当前注册表与有界摘要分离，能同时修复漏读和避免自动扩大旧连接权限。本 PR 的边界是本机证据读取与既有 Lark 设置的完整接线，不包含执行授权、远程主机授权或模型委派生命周期重构。

以下是该 head 的源码路径对照，不是额外执行证据：

入口/条件	原路径	当前路径
本机 owner 按需读 portfolio	重用初始 Turn 行	当前注册表选页后采集
已有 external selected 授权	精确列表	保留精确列表，仍检查当前绑定
新建 Lark manager	连接锚点或显式列表	明示默认全部已注册，可在原设置中收窄
绑定撤销/策略不可读	拒绝或未知	继续 fail closed；读后再次检查

具体改动

覆盖了完整的 22 文件差异：读取策略与 effect dispatch、portfolio/detail/Agent/handoff 调用链、Lark 新建及编辑 API、前端 schema/表单/列表与中英文说明、CLI 参数、文档以及相关测试。没有 generated bundle 或临时证据进入 diff。

关键代码讲解

1. resolveSourceEvidenceGoals / configureSourceEvidenceScope：缺失 mode 仍解释为 selected，缺失列表保留既有连接 fallback，空列表是真正撤销。只有显式 all_registered 才使用当前 available IDs；配置保留其他 source 字段，所以读取设置不增加投递或执行 grant。
2. evidence_scope_readback / configure_evidence_scope：每次解析 all_registered 都读取当前注册表；损坏策略或缺失 registry 不被当成无限授权。写入仍通过同一策略文件锁，并再次计算计划核对落盘结果。CLI 以及 Lark handler 使用这一 owner。
3. ManagerInspection._portfolio：先求当前许可集合、处理 stopped 和分页，再调用原有 portfolio collector。外部会话仍在读取前后验证 live audience/session；Todo、投递、handoff 和 Agent 路径也使用同一当前范围，而不是摘要里“碰巧出现”的行。
4. _lark_connect 与 LarkSettingsPage：编辑沿用已存 App/group identity，不接受表单替换 audience。连接已经提交但范围保存失败时保留 provider receipt、刷新路由并返回 partially_connected，而不是假装整个操作未发生；页面显示错误，可以重试原连接。

独立规范依据是 docs/architecture/rfcs/capable-manager-semantic-handoff-v0.md，固定版本 0da60df7a23abf5fad23e31129ed617031f1aa7a，并结合该版本 loopx/capabilities/manager_context/README.md 的已有约定。映射如下：5.3 的权限分离由现有 source-grant owner 和 live binding 检查实现；5.5 的完整许可 inventory 发现由按需分页实现；Audience-authorized Goal summaries 的旧列表与 audience 隔离得到保留，新的全注册范围是明确披露的扩展；Manager-directed Core inspection 的读取前后撤销检查、未知来源和只读 provider 路径保留。它们均有当前 head 的测试或反证支持，而非用本 PR 改写后的说明反向定义验收。

对主干的风险

最强风险是把“发现了注册记录”当成“该外部会话可以读取”，尤其在新增 Goal、切换群或读取中撤销时泄露信息。核验了 wrong session/executor/audience、disabled target/binding、ambiguous binding，以及读后授权变化；拒绝路径不返回读取内容。selected 同一注册表内的其他 Goal 仍被拒绝；all_registered 包含未来 Goal 是明示授权，不是安装或 provider 可用性自动激活。读取策略没有改动 sender、target、blocked target 或执行绑定。

本轮独立证据：

• 最终 head 的 286 项 Python 测试全部通过，涵盖 Lark API、live binding、tracking、返回、manager context/inspection 及真实 File/SQLite authority；11 项 TypeScript source-grant 测试、控制面 typecheck 和生产前端构建通过，diff hygiene 通过。
• 同一合成 fixture 在固定 base 与最终 head 执行真实 loopx_manager_read 和 CLI export：初始摘要仅含 1 个 Goal 时，base 只匹配 1 个，head 按页覆盖全部 145 个；超过原采集上限的 CLI 页从 collection_limit 变成实际采集结果。刻意缺失的证据源仍标为 unreadable/unknown，不把缺失伪装为任务为零。
• 真实 CLI 配置 all_registered 后新增第 146 个 Goal，无需重写 policy 即可发现；重新选定单 Goal 后新 Goal 被排除，空列表撤销生效，投递字段未变。真实 File/SQLite 测试还覆盖长 Todo 的 canonical 内容回读和前后只读快照一致。
• Ego Lite 操作本次源码构建的页面，检查桌面/390px 表单、默认全部、保存回读、selected 收窄，以及部分保存失败提示后重试成功。页面 transport 使用合成 Lark 数据；授权/落盘结论另由真实 policy/provider 测试支撑，不声称发送了真实消息或完成安装验收。

旧 head 07de119dfb8c4cb11f4077773d9674fac879b10c 曾在本轮出现 5 项 inspection 测试失败，而固定 base 同组 40 项通过。最终 delta 只补齐真实 registry/source fixture，保留 unknown、oversized、stopped 及 subprocess 原断言；最终组合 286 项重新通过。这个历史失败没有被删除或以作者的绿色结果代替。浏览器辅助脚本的 selector/观察参数错误也未计为产品失败；修正后读取了实际状态。未查询或等待远程 CI。

语义与 CI 对齐

这里扩展的是既有 read-scope 词汇与 source-grant owner，未创建另一套 actor 或权限生命周期。typed selector 使用精确枚举和 Goal ID validator，不以子串猜权限。新增默认只发生在新建 manager 连接，旧连接、未传 CLI scope 和普通 Goal 连接保留旧语义；README、双语字段和测试披露了差别。此处是机器执行的授权约束而非建议，不涉及 quota/work-lane obligation 的改变。

我的整体评价

APPROVE；没有阻塞性发现。long_horizon: improved：后续注册不再要求反复维护静态清单；user_experience: improved：原 Lark 设置能完成范围选择、读回、收窄及可见失败重试，无新增手工同步步骤。保留现有授权 owner 并把当前注册表与有界摘要分离，能同时修复漏读和避免自动扩大旧连接权限。

规模与问题相称：新增状态只表达无法从注册表猜出的授权意图，列表本身保持派生；既有 persisted selected 兼容确有当前 reader，不应为少几行代码而移除。未来改动的有界整理已落实为共享 TS scope 决策和原 collector 复用，没有必要在本 PR 追加无关语言迁移。剩余未验证边界是已安装 App 升级、真实 Lark 往返与模型理解；这些不被本轮模拟浏览器证据冒充。批准仅针对上述 exact head，不代表正式 GitHub 自我批准或合并授权。

English verdict: APPROVE - cebcd8f. Live evidence scope preserves selected/audience boundaries while discovering current and future authorized Goals. Independent 286 Python tests, 11 TS tests, typecheck, production build, paired real-reader/CLI probes and Ego Lite settings/retry checks passed; no merge performed.