fix: continue authorized browser work after normal TaskSpace closure

[loopx-agent]

Goal And Delivered Outcome

After an Agent successfully finished its own browser space, later authorized validation could ask the user for permission solely because that closed space no longer existed. Extend the existing Ego host-skill continuation policy: recorded successful cleanup plus an inventory-confirmed absent id permits one replacement for the same authorized task.

Reuse an existing known space first. A refused claim, unexpected disappearance, active user intervention, unresolved browser prompt or explicit pause still stops recovery. The replacement becomes the single active space; finish once per space lifetime.

Author Declaration

• Written by: model_agent — OpenAI GPT-6 family via Codex.
• Specification: the bounded continuation request above; docs/integrations/ego-source-reader.md at bc0533851.
• Implemented: scoped continuation, preserved control/operation authority, existing managed-skill upgrade and customization protection.
• Self-check: compared the policy clauses and ran the existing real filesystem installation/refresh suite.

Scope And Continuation

Complete within the host guidance repair. Existing workflow-skill refresh distributes it; no new capability, native browser behavior, source-reader takeover tool or browser installation change. The installer remains the single owner. Live model compliance is not established by string or filesystem assertions.

Validation

• Tested revision: bc0533851.
• Run state: finished.
• Input classes: synthetic.

Check kind	Result	Evidence / limitation
integration	passed	uv run --extra test python -m pytest -q tests/test_ego_skill_delivery.py: 25 passed, including same-version policy refresh, preserved user edits, atomic publication/recovery and unchanged vendor source.
static / manual	passed	Public-boundary scan of all three changed files, diff whitespace, and clause-by-clause review of ownership/stop/permission rules.
real_entrypoint	passed	The existing managed host skill was refreshed through its delivery owner; immediate readback returned unchanged/ready. No full LoopX or browser upgrade was performed.
live_model	not_run	Guidance delivery does not prove autonomous model compliance.

Frontend / Visual Evidence

UI impact: none. Agent host-skill text and its installation tests only.

Type of Change / Area

Bug fix, host integration, workflow skill, documentation and tests. Shared-authority fixture impact: N/A; no Goal authority or provider behavior changed.

Boundary Checklist

• Public-safe diff and description; no private operating context or logs.
• No benchmark behavior or jobs changed.
• Scoped to the requested continuation defect.
• No paired RFC changes.
• No UI change.
• DCO sign-off included.

[loopx-agent]

Reviewer: model_agent | gpt-6.1-sol | OpenAI | runtime_reported | reasoning_effort=max

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

动机

已经授权 Agent 浏览器任务的用户，可能在正常清理空间后仍需要同一任务的后续验证。 旧指导要求沿用同一个空间且禁止替换；正常 finish 已关闭空空间时，后续验证会卡在不存在的 id。新指导仅在保留成功关闭记录、清单确认 id 不存在且原任务仍授权时允许一个替换空间。

已独立验证普通 wheel 的隔离安装：同版本旧策略会被识别并刷新，读回为 unchanged；用户编辑被保留，未编辑回滚恢复上游链接，没有 Ego 的 host 不会被安装 Ego。

本 PR 不改变浏览器原生控制检查、账号或操作权限，也不启用可选 source reader；真实浏览器生命周期和 live 模型遵从没有在本次评审中运行。

真实模型正常清理后继续验证并交付可用回答的行为仍未独立资格化；本轮只验证指导语义及隔离安装材料。

改动思路

规则仍由现有 host-skill 指导材料承载，既有安装器只负责材料来源、完整性和发布；浏览器继续保有运行时控制边界，无需新增恢复状态机。 本 PR 只交付正常关闭后的有界继续指导、对应文档和材料交付回归，不交付新的浏览器自动恢复执行器。

workflow-skills CLI → workflow_skill_install → reconcile_ego_browser_skill → _reconcile/_publish → managed SKILL.md → host Agent。 既有数据/权威与材料传递职责分开：本头没有另建通用状态机，也没有扩大原操作授权。正向、拒绝及回读都沿原拥有者；在需要新意图、控制权或原生提示处理时仍保留原边界。

具体改动

精确 head bc05338519de58dbcbd39458c1770b28929332f8，实际 merge base b5a331d0b9cc8956a109ab45880a492c6bafba4a，整头 3 files +32/-4。先读取原问题和不可变规范，再检查全部 diff；主要规范为 docs/development/frontend-delivery.md，revision b5a331d0b9cc8956a109ab45880a492c6bafba4a，候选修改文档不自行认证验收。

• reuse_scoped_authority — implemented：同一任务授权、成功关闭记录和清单缺席三个条件共同限制替换。
• preserve_control_stops — implemented：_POLICY 的 Stop 段、refused-claim 禁令与 no-new-authority 段保持；非 policy AST 相同。
• managed_delivery_readback — implemented：普通 wheel 隔离 CLI 的刷新、编辑拒绝、回滚与 Ego 缺席八个观察。
• live_agent_journey — deferred：按既有 release evaluation owner 单独资格化；不由字符串或文件系统测试推断。

关键代码讲解

1. _POLICY 先要求历史出处和原授权，再 inventory，存在则沿原 id 复用；缺席分支要求成功正常关闭记录。拒绝 claim、异常消失、失败/超时和新用户停止都不能转成替换理由。替换只使用初始 p1，记录新身份，保持一个活动空间；finish 规则改为每个空间 lifetime 一次。
2. 同文件 _reconcile 的 policy_sha256 比较及 _publish 原子发布未变；实际同版本旧策略安装会被识别为 would_refresh，刷新后当前文本逐字一致并读回 unchanged。用户修改与发布中断的保护沿既有 owner，不另建恢复状态。
3. handle_workflow_skills_command 与 workflow install owner 未变。普通 wheel、独立非 editable 环境和 -I CLI 观察了 8 个 present/absent/modified/rollback 状态，原 vendor 与其他 skill 内容保留；安装 receipt 的 installed_at 和进程锁诊断单独说明，不冒称整个目录每字节不变。
4. 现有测试 的 25 项通过，新增断言证明材料包含限制语句；它们不能证明模型在真实浏览器中理解并遵从。

对主干的风险

最大的风险是模型把“缺席”误当成“正常关闭”或忽略后续用户干预。因此逐项检查了 actor、先后顺序、条件、出处、范围、继续和停止条款，而没有把新段落中出现某个词当执行证明。除 _POLICY 外全部 Python AST 与其余生产树相同。普通 wheel 初次因旧前端 bundle 被拒，正常 npm ci/build:chat 后重建成功；初私有检查把安装 timestamp/进程锁计入 skill 内容，纠正比较边界后才记录安装证据，原失败保留。Goal-bound 质量凭据仍过期。

语义与 CI 对齐

复用既有 TaskSpace API、host guidance 与 marker；没有新 Enum、状态 owner、泛化协议或 authority grant。材料指导、文件完整性检查和浏览器原生 enforcement 分别归属原 owner；可选 reader 没有被启用。标准 source premerge 的实际检查通过，与质量凭据门未通过分别陈述。

验证：25 项交付测试、CI Ruff 范围、6 direct/11 selected 标准 premerge 执行通过。该执行未绑定 Goal；另一次 Goal-bound 不执行计划仅核对质量凭据，返回 stale_receipt，不能称完整质量门通过。初 wheel 因旧前端 bundle 拒绝，按正常 npm ci/build:chat 后重建通过，未绕过打包检查。 实际隔离 CLI 保留用户编辑并拒绝回滚，恢复原内容后回滚成功；无 Ego 的 host 保持 absent。源条款逐项核对缺少关闭记录、拒绝 claim、用户暂停、未解决提示及异常丢失均不进入替换例外；这是指导语义评估，不是执行这些 live 浏览器状态。

我的整体评价

长期约束和浏览器权威边界保持；用户体验是有据的指导增量，实际模型行为仍属于未验证维度。该 host 材料修复作为 justified_increment 可以接受；更大的 native/live journey 由既有发布资格化继续，本评审不推断持续收益或授予共享安装、发布、合并权限。结论 APPROVE；同账号作者关系需以 COMMENTED 记录该结论，不能称 GitHub 正式自批准。 规则仍由现有 host-skill 指导材料承载，既有安装器只负责材料来源、完整性和发布；浏览器继续保有运行时控制边界，无需新增恢复状态机。 本 PR 只交付正常关闭后的有界继续指导、对应文档和材料交付回归，不交付新的浏览器自动恢复执行器。 没有以测试数、哈希或评审记录数证明采用与效用。小范围重构检查已完成：复用既有 owner，保留必要负例，未发现需要在本切片新增的抽象。

English verdict: APPROVE — The bounded host-guidance change is correctly delivered through the existing managed installer. Live browser/model compliance remains unverified; the current quality receipt is stale. This author-owned COMMENTED verdict is not formal GitHub self-approval or merge authority.