[JasonBuildAI]

Goal And Delivered Outcome

• Outcome basis / optional anchor: Fixes evidence scope: grant written on one runtime root, enforced from another #6865.
• Goal/source and gap: Chat manager reads resolved the evidence policy from the --runtime-root override while configure/readback persisted it under ChatRuntimeController.coordination_runtime_root (the registry's common_runtime_root). With different roots, a valid grant silently collapsed to the connection's own Goal, and a stale broader grant on the override root could be inherited. The same function also resolves the configured manager executor, which belongs to the Chat override root; both authorities must be passed separately.
• Observable before -> after, with the validation row that proves it: Before, a coordination-root all_registered grant resolved to ["goal-alpha"]; after, it resolves to ["goal-alpha", "goal-beta"]. Before, a stale override-root all_registered grant shadowed a narrower coordination-root selection; after, the narrower ["goal-alpha"] selection wins.
• Issue/task and intended base: Fixes evidence scope: grant written on one runtime root, enforced from another #6865. Intended base: loopx-project/loopx:main.

Author Declaration

• Written by: Codex, an OpenAI coding agent, at the maintainer's request and under their direction and review.

AI disclosure: this change was drafted with AI assistance at my request, under my direction and review.

Implemented against

• Specification and revision: issue #6865, whose Expected section accepts either one resolver for write/readback/read or a loud mismatch, and whose Suggested fix direction names resolve_runtime_root as the read-path owner. The implementation uses the already-constructed ChatRuntimeController.coordination_runtime_root, the same root used by configure/readback.
• Criteria:

Criterion (spec clause)	Disposition	Symbol / path	Test or command
Manager reads use the same policy root as configure/readback	implemented	loopx/chat_server.py::serve_chat.manager_scope	tests/test_chat_lark_api_contract.py::test_manager_scope_reads_policy_from_coordination_root_when_chat_root_overrides
A grant written only to the coordination root is visible	implemented	manager_scope -> authorized_manager_goal_ids(... runtime_root=coordination_runtime_root)	same focused test, first assertion
A stale broader grant on the Chat override root is not inherited	implemented	manager_scope no longer passes override-resolved runtime_root	same focused test, second assertion
A manager executor configured on the Chat override root still authenticates its session	implemented	authorized_manager_goal_ids(... executor_runtime_root=runtime_root) in loopx/extensions/lark/manager_routing.py	same focused test configures steward_executor=dsh on the Chat root before resolving scope

• Self-check before submission: Reviewed the write/readback call sites and the ChatRuntimeController root derivation; used the existing root owner instead of adding a second resolver or a warning-only workaround. Split policy and executor roots in the existing authorization helper so the Chat storage override cannot disable a configured manager executor. Left persistence formats, policy semantics, and unrelated Chat behavior unchanged.

Scope And Continuation

• Completed scope and remaining work: Complete within this issue's scope. The change aligns the manager read path with the existing configure/readback root and covers both hidden narrower grants and stale broader grants.
• Slice boundary / successor: N/A. The issue is independently fixed and does not require a successor.

Validation

• Tested revision: edc9b921f
• Run state: finished
• Input classes: synthetic

Check kind	Result	Public-safe evidence / limitation
static	passed	uv run --extra test ruff check loopx/chat_server.py loopx/extensions/lark/manager_routing.py tests/test_chat_lark_api_contract.py -> All checks passed!
regression_parity	passed	Reverting the read root fails the focused test with assert ['goal-alpha'] == ['goal-alpha', 'goal-beta']; ignoring executor_runtime_root fails it with assert [] == ['goal-alpha', 'goal-beta']; the final code passes.
real_entrypoint	passed	pytest tests/test_chat_lark_api_contract.py::test_manager_scope_reads_policy_from_coordination_root_when_chat_root_overrides -q -> 1 passed. The test starts the real serve_chat HTTP server with different registry and override roots, configures steward_executor=dsh on the override root, and resolves the manager scope through the live controller.
unit	passed	pytest tests/test_chat_lark_api_contract.py tests/test_manager_evidence_scope.py tests/extensions/test_lark_goal_topic_connections.py -q -> 124 passed.
integration	passed	pytest tests/test_chat_manager_context.py tests/test_chat_manager_inspection.py tests/test_chat_transport_composition.py -q -> 89 passed.
integration	passed	pytest tests/test_manager_context_execution.py -q -> 38 passed.
unit	blocked	Model-backed Lark/native-steward suites require a locally usable Codex Agent endpoint on this Windows host. The endpoint reports CodexChatAgentError: executable_not_found; the same failure reproduces at the clean upstream-base worktree, so these suites are not used as change evidence.

• Coverage and gaps: The real-entrypoint row exercises the changed manager_scope closure through ChatHTTPServer, ChatRuntimeController, the typed audience channel, and policy lookup. The integration rows exercise manager context delivery, inspection, transport composition, and real Chat dispatch around the same root boundary. No UI, persisted schema, provider protocol, or execution backend changed. No model-backed success is claimed.

Frontend / Visual Evidence

• UI impact: none
• Before: N/A
• After: N/A
• First viewport and preview: N/A
• States and viewports shown: N/A
• Source data: none
• Attention review: N/A; this changes policy-root selection in the backend and does not alter presentation or interaction.
• Craft review: N/A; no visual surface changed.

Type of Change

• Bug fix
• New feature
• Breaking change
• Refactoring (no functional changes)
• Documentation update
• Test update

LoopX Area

• Control plane (goals, todos, quota, scheduler, registry, runtime)
• Benchmark boundary (adapters, runners, verifiers, scoring, evidence)
• Capability or extension (providers, adapters, skills)
• Public docs or presentation surface (README, protocols, dashboard)
• Build, packaging, installer, or CI
• Host or runtime integration

Technical Direction

• Direction / acceptance reference, when applicable: Operator surface and IM integration.

Shared-authority RFC fixture impact

• Production-scale fixture schema: N/A
• Semantic dimensions changed, or reviewed no-impact rationale: N/A; no shared-authority or migration contract changed.
• Provider conformance arms run: N/A
• Read-only legacy/file/PostgreSQL three-arm rehearsal (required for promotion, runtime-routing, or compatibility-projection changes): N/A

Boundary Checklist

• Neither the diff nor this PR body/comments/attachments disclose private state, credentials, raw traces or verifier output, internal links, or local machine paths (including .loopx/, .codex/goals/, and live ACTIVE_GOAL_STATE.md).
• I did not duplicate maintainer-owned benchmark work unless a maintainer split out a public issue for it.
• I kept the change scoped to the linked issue/task.
• Existing English/Chinese RFC pairs (including ledger entries) both have a diff, and the local premerge check python3 scripts/check_rfc_bilingual.py --base origin/main --head HEAD passes, or no paired RFC changed.
• I completed the visual evidence section for UI changes, or marked UI impact none.
• Every commit includes a DCO Signed-off-by trailer (git commit -s).

[JasonBuildAI]

[P1] Keep executor-endpoint authority on the Chat root

The new runtime_root= value at loopx/chat_server.py:1816 is used by authorized_manager_goal_ids for two separate decisions: the evidence-policy lookup and the live manager executor comparison (manager_connection_executor_endpoint(runtime_root) at loopx/extensions/lark/manager_routing.py:273). Manager sessions are opened using machine settings from the Chat override root (ChatRuntimeController.steward_executor_defaults() reads store.root.parent, and _lark_connect uses the same defaults), so this read now compares the session against a different machine configuration.

When the machine-configured steward endpoint differs between the two roots, authorization returns [] before the grant is read. A temporary probe with steward_executor=dsh configured only at the Chat root and a valid goal-alpha grant at the coordination root produced:

chat_endpoint= dsh
coordination_endpoint= codex
session_agent_id= dsh
old_override_root_result= ['goal-alpha']
new_coordination_root_result= []

This trades the reported policy-root bug for a manager-authorization outage for configured stewards. Please keep the executor endpoint resolution on the Chat root, or separate policy_runtime_root from runtime_root inside authorized_manager_goal_ids. The new test should also cover a manager executor configured on the Chat root while the coordination root has no such configuration.

The focused test and the author-cited tests currently pass; the gap is that both roots resolve the same default endpoint in the new test. Other review areas look appropriately scoped.

[JasonBuildAI]

Addressed in \�dc9b921f.

The review correctly found that
untime_root\ was serving two authorities. The final change keeps the evidence policy on \coordination_runtime_root\ and passes the Chat override root explicitly as \�xecutor_runtime_root, so a manager executor configured on that root still authenticates its session. The focused real-entrypoint test now configures \steward_executor=dsh\ on the override root; ignoring the executor root fails with \�ssert [] == ['goal-alpha', 'goal-beta'], while the final code passes.

Re-ran: focused 1 passed; 124 + 89 + 38 related tests passed; Ruff clean. PR body updated to the new head.

[loopx-agent]

Reviewer: model_agent | model=gpt-6.1-sol | provider=OpenAI | declaration_source=runtime_reported | reasoning_effort=max

结论：APPROVE，评审 head：edc9b921f20a4ea0d29ba89596c527e78ef62523。未发现阻塞性代码问题。完整三文件提案已核验；下面保留独立验证范围与既存验证失败。

动机

受影响的是为外部管理会话配置跨 Goal 证据范围的用户。
当 Chat 存储目录与注册表的协作目录不同，旧读路径可能漏读已授权的 Goal，也可能沿用旧目录里的更宽授权；新路径从实际保存授权的协作目录读取。
当前 head 已验证授权收窄、显式清空、后续新增 Goal 和重新授权均由协作目录决定，并保留 Chat 目录中的执行器设置。
本次范围止于现有管理会话的证据读取边界；授权格式、模型执行和界面交互继续沿用既有契约。

改动思路

复用现有授权读取器和协作目录解析，仅把证据策略根与执行器配置根明确分开，避免为同一授权再建一份状态。
当前提案完整交付这条读取根目录修复；真实飞书投递、模型回答质量和长期净收益仍需各自证据。

原先一个 runtime_root 同时承担两种职责，单纯换成协作目录会使配置在 Chat 目录中的执行器失去匹配。这次使用已有 coordination_runtime_root 读取证据策略，同时显式传入 executor_runtime_root，把两种现存权威交给各自拥有者。连接、会话、执行器与 audience 的精确匹配仍先于证据读取；授权范围交给原有 evidence_goal_scope 派生。

决定	旧路径	当前路径
证据策略读取	随 Chat 覆盖目录走	与配置、回读一致的协作目录
执行器身份匹配	Chat 目录	保留 Chat 目录

此表根据当前源码说明职责，不替代运行证据。继续复用现有 owner 比另建 resolver、复制授权文件或只添加警告更直接，也未引入额外用户确认轮次。

具体改动

先读问题 #6865 与既有评审，再按接受前的 docs/reference/protocols/manager-evidence-and-continuity-v0.md、修订 764b989dce88ef43ade5aba5af4958ee2cf3a821 判断，未用作者新增测试定义需求。以下 MC 索引对应原文相关章节：MC-1 对应 Global conversation initialization 的当前范围读取与同源授权；MC-2 对应 Steward channel host selection 的执行器来源；MC-3 对应 One service, scoped continuity 的过滤及变更撤销。三项在此 head 均已实现并验证。

关键代码讲解

• serve_chat.manager_scope：现有服务构造 controller 后使用回调读取范围，把策略交给 controller 的协作目录，把执行器匹配留在服务的 Chat 目录。Owner/private 分支及外部连接快照生产者保持原路径。
• authorized_manager_goal_ids：增加可选执行器目录；省略时保留当前同目录调用语义。先核唯一连接、audience、Session、connector 与执行器，再读取原生当前授权；没有第二份授权状态。
• 测试新增 190 行启动真实 serve_chat，使用真实持久机器设置和证据策略。连接快照为合成注入，飞书 provider 和模型未运行；此范围写明，避免把服务构造验证说成线上回答验收。

对主干的风险

独立跑完七个相邻测试文件：251 passed，无 skip。同一冻结测试文件在真实基线 764b989dce88ef43ade5aba5af4958ee2cf3a821 暴露旧缺陷、当前 head 通过。另在两个版本中显式设置完全相同的“Chat 旧全局授权 + 协作目录只选 Alpha”状态，核对八种情况：窄范围、错误执行器、错误 Session、错误 audience、新增 Gamma、显式全局授权、清空授权及重新授权。当前八项均符合原生授权语义；基线仍会沿用更宽范围，显式清空也不能正确撤销。没有用脚本退出 0 代替这些逐项断言结果。

本地风险 premerge 的 6 项 direct 通过，10 项 selected 均执行，只有语义 twin 门失败。已在实际基线独立重跑，比较完整 46 个原始路径对、2 个已验证生成排除项和相同 44 个独立维护项，连同预算 43 及检查源码均相同。该失败是 pre_existing_unrelated，没有放宽预算，也没有声称整门通过。Ruff 和 diff 检查通过。按当前策略未查询、轮询或等待 CI。

语义与 CI 对齐

共享授权仍由既有 typed Session/connector 与 manager-context 策略决定；新增参数选择数据来源，不授予跨 Goal 执行权。关闭/错误连接、空授权及后来新增对象的边界已验证；这不是新增 default-off 功能。既有回传 transport 未改，实际飞书回传、模型输出以及安装后的全链路仍保留原资格边界。

我的整体评价

本次问题范围达到 goal_achieved，不是父级 manager 产品或长期收益的完成证明。长程维度为 preserved：当前授权在反复读取、撤销与新对象出现后保持有效边界；用户体验为 improved：已配置意图直接生效，新增强制交互为零。复用现有授权读取器和协作目录解析，仅把证据策略根与执行器配置根明确分开，避免为同一授权再建一份状态。当前提案完整交付这条读取根目录修复；真实飞书投递、模型回答质量和长期净收益仍需各自证据。 两个现有 owner 的职责已足够，继续增加抽象没有当前证据支持。保留同目录调用兼容，未新增持久版本分叉；批准后的阻塞 review、质量回执与 merge readiness 另行原生回读。

English verdict: APPROVE — edc9b921f20a4ea0d29ba89596c527e78ef62523. The three-file change reads the current evidence policy from its coordination owner while retaining the Chat executor authority. 251 tests and matched real-service scope counterfactuals pass. The unchanged 44/43 twin-budget failure remains disclosed; live provider/model behavior and long-term benefit are not claimed.