[loopx-agent]

Native Codex strips the initial @exec pragma before recording executable cell source. Comparing it with the unprocessed model call rejected a valid live binding and repeatedly sent full context despite complete retained input.

Normalize only a valid first-line JSON-object pragma, preserving the exact executable body, live call/cell identity, ordering and complete current-input bytes. Malformed framing, changed bodies and incomplete or stale input still recover the original full capture. Default-off, unsupported explicit-on errors and existing authority boundaries remain unchanged.

The opt-in recovery guidance distinguishes direct-result and retained-history limits: start conservatively when the effective history limit is unknown; use larger batches only with a sufficient known limit and complete model-visible verification. The shared native fixture also separates its temporary root from its native home, respecting Codex's release helper restriction. No new CLI mode, host-limit change or owner question is introduced.

Current validation

Head 72133e9d1, integrated target main 984691c6a; six native-adapter/test/reference paths, +87/-9.

• 194 focused retention/lifecycle/read/CLI cases pass. Two current-source Mac native code-mode cases pass, covering both packet forms, resume and complete original-capture recovery.
• Actual Harbor 0.20 staging executes the unchanged production installer, installation doctor and synthetic task initialization in disposable Linux Docker. The installed release and runner identify this head, and seven relevant installed module digests match the staged source. Two installed native benchmark checkpoint/resume/recovery cases pass. No scored solver job runs.
• The expanded Linux matrix remains 4 failed / 2 passed. The fixture correction resolves native helper dispatch, but this emulated container cannot perform bubblewrap root-mount propagation. Bounded namespace/capability probes did not qualify it. These failures are retained; no sandbox bypass or passing Linux workspace-write claim is made.
• Configured strict mypy passes 17 source files. Changed-file Ruff, compilation, public-boundary scan and bilingual diff checks pass; semantic advisory reports no supported new vocabulary carriers.
• Six direct and sixteen selected premerge commands pass, but overall qualification remains held. The exact-scope quality receipt is non-passing for the Linux matrix. The previous remote head also had steward-monitor lint and packaged-workspace browser failures; this updated head needs fresh CI and independent review.

Earlier complete-input measurement

A frozen four-trial replay at e6fe94ea7 used two fixed pairs of real benchmark captures, complete model-visible byte checks, generated recovery advice and shared-codec reconstruction. Both arms declared the same 10,000-token history budget.

Measure	Full, 2 pages per batch	Delta, 8 pages per batch
Native inference requests	46	17
Page reads	74	54
Cumulative input JSON bytes	8,117,953	2,587,487
Cumulative input o200k_base proxy	2,178,009	685,841

The input proxy decreased 68.5%; a separate matched 2×2 ablation measured a 52.4% batching contribution within the delta arm. These include retransmitted history and are transport measurements, not billed tokens, solver outcomes, latency or normal desktop adoption. The production transport modules are unchanged by the final fixture correction; this is not a new cost measurement at the current head.

Original low-budget eight-page and larger-page failures remain failed. Release-matched source documents independent history truncation and the unknown-model byte fallback. No live host limits or frozen campaigns changed. Normal installed desktop activation, autonomous solver benefit and merge authority remain separate.

[loopx-agent]

Reviewer: model_agent; model=gpt-6.1-sol; provider=OpenAI; reasoning_effort=max; declaration_source=runtime_reported; observation_id=0f5fe426e50c0e891943d6c5a67419359e67892874d30eb916faa64106f543d6

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

动机

已选择原生上下文投递的 Agent 在继续同一已捕获任务时，可能因首行执行参数而反复收到全量内容。 原来同一活跃调用加上合法首行执行参数后仍返回 full；当前在正文、父子调用和完整模型输入都匹配时返回 delta，压缩或丢失 hook 后仍读回原捕获的完整内容。 准确基线 CLI 在新增原生测试中因 full 不等于 delta 失败；当前6项原生路径及178项定向测试通过。 不更改默认关闭、主机限制、准入、配额或权限；不据确定性输入测量宣称真实求解、费用或已安装桌面的收益。 直接输出完整还可能在后续历史中被裁剪，因此配置说明也必须教 Agent 验证实际模型输入，而不能只调大输出参数。

改动思路

首行语法匹配属于既有原生诊断IO边界；完整性不变量、共享投递决策和执行权限仍各由原owner负责，预算建议不能写入主机策略或变成准入门。 本PR只修复活跃输入framing证明、扩展现有原生fixture，并追加既有配置/参考说明；不增加执行模式、权威字段、host限制或独立产品页。 原生执行器记录的是剥离第一行参数后的正文；因此只在已有活跃父子调用绑定内比较合法首行 JSON 对象与完全相同的正文。首行解析不解释执行参数，也不授予权限。原有完整字节与摘要校验继续决定能否复用，缺失证据仍走同一原捕获的 full 恢复。

这里沿用现有 CLI 的启用、投递、失败、恢复和读回旅程，不增设页面或配置所有者。已知 Goal/Agent/目录继续由原配置携带，默认关闭者零新增交互；已启用者没有新增 owner 提问或确认轮次。读取策略见下表，表格只解释条件，运行证据另列。

条件	当前处理
合法首行参数、活跃绑定、完整当前输入	可复用 delta
正文改变、父调用失效、部分输入	原 full 捕获与恢复
历史输出限额未知	保持从至多两张默认页开始的建议
历史限额已知足够	可较大批次，仍逐份输出并验证完整模型字节

具体改动

审查完整新头 e6fe94ea70ba30003b84241043ee5c459222ca35，实际基线 6393ab60ecae1879534f36446f1fb700072711a1，5路径 +81/-9；没有把旧 b77d19c6a07ec12870be6369b62bca9ea83f3bba 的测试资格直接转移。规格为 docs/reference/required-work-context.md，固定版本 6393ab60ecae1879534f36446f1fb700072711a1。本次映射标签 RW-Complete、RW-NoAuthority 均 implemented：依赖任务前完整来源与原捕获恢复有当前真实 CLI/native 证据，投递和恢复不增加准入/权限。

关键代码讲解

1. _code_mode_source_matches 只接受原文完全相同，或第一行是有效 JSON 对象且之后正文完全相同。非对象、非有限值、额外 pragma、任意注释和正文变化不能充当绑定证明。
2. _native_tool_is_bound 保留唯一活跃父 cell、对应模型 call、child 身份、未结束与严格序列顺序，只替换最后的 source 比较。codex_context_in_active_input（143行）继续独立校验完整模型字节、摘要、连续分页及同 session/call，不能由 hook 成功或文件存在代替。
3. codex_context_recovery_instructions 保留原恢复文字作为真实 CLI 发出的逐字前缀，追加直接输出/保留历史两类预算说明；相同命令的 base/head 配置对照证明 hooks、activation 和原义务不变。原有 fixture 新参数默认仍两页、未声明历史预算；独立10k历史预算的8页用例保留旧断言，并验证实际模型输入中确有大于两页的批次。

上游固定版本 history owner 和 unknown-model fallback 已实际读回，支持区分历史截断与直接结果预算。没有据此认定本机二进制与该源码完全同构；本机行为由独立真实进程测试覆盖。

对主干的风险

最强风险是过宽规范化让假绑定或部分输入误用 delta。当前否定矩阵覆盖改正文、错误/缺失/已结束 parent、其他 session/tool、非对象或损坏首行、缺页/preview 等；178项定向测试通过。真实 Codex 0.163.0-alpha.11.1 的6项当前源码 CLI 测试覆盖两个包格式、原两页路径、合法参数、resume/compact、已知历史预算8页和丢失 hook 后完整原捕获恢复，均通过。同一新增测试换用准确6393基线 CLI，在真实调用后因 warm full != delta 失败，说明 oracle 能捕获原缺陷；该预期反例不计作当前头失败。

实际 base/head 各5项默认关闭/unsupported-on CLI 用例通过：默认或 off 不触达 observer、不创建 transport；unsupported-on 在准入前拒绝且无 receipt/spend。真实配置发出比较保留所有原义务：依赖工作前恢复、追到 eof 验证字节/摘要、查找失败恢复原引用、不猜测/重新准入/问 owner、恢复不更新权限或新鲜度、独立已授权工作可继续。新增批次文字是条件建议，完整输入证明仍是原机器条件。

当前配置 mypy 在准确 base/head 的17个源文件均通过；standard premerge 6 direct +13 selected 通过，0 manual holds。完整 Ruff 仍失败：两边都是未改 tests/test_native_steward_monitor.py 的5条 E701，完整诊断仅去掉 worktree 根目录后完全相同，规范化签名 f9378acbf060ba53da1cf9134c3ed3c609d70690821d738757c715f30ade657f。归因为 pre_existing_unrelated，严格质量记录仍 FAIL，没有豁免 required 检查。旧 c1a/b77 的5241条相同类型错误保留为旧源版本历史，不能称这份新PR修复了它们。没有查询、轮询或等待 CI。

语义与 CI 对齐

复用现有 input-proof、配置与共享 codec 词汇，私有 helper 和两条诊断 reference id 不构成新共享状态；不增加领域词分类、执行模式或权限字段。Python placement 留在既有 native 诊断 IO；预算建议不能成为全局准入义务。对原有恢复文字与新增建议已逐句比较并经过真实 CLI 发出，不以字段相同替代义务核对。

我的整体评价

该命名的原生适配器缺陷与读取指导修复为 goal_achieved，范围 proportionate。首行语法匹配属于既有原生诊断IO边界；完整性不变量、共享投递决策和执行权限仍各由原owner负责，预算建议不能写入主机策略或变成准入门。 本PR只修复活跃输入framing证明、扩展现有原生fixture，并追加既有配置/参考说明；不增加执行模式、权威字段、host限制或独立产品页。 兼容处理保留真实无参数/有参数两类 native 调用，原持久 capture/epoch 读者不变；可逆小 helper 与同一 fixture 已是合适边界，无需增加并行 owner 或新的抽象。

长程判断 improved 限于当前已复验的重复投递与恢复路径；用户体验 improved 限于既有 CLI 旅程，零新增确认/重填，默认 off 完整隔离。视觉检查 not_applicable：改动只在内部绑定和 CLI 配置文字，没有渲染页面变化。未验证范围是正常已安装 App/Lark、真实自主模型采用、作者68.5%/52.4%输入统计和完整费用/solver收益；确定性 loopback 不能替代这些证据。未发现新头引入的可行动缺陷，代码结论 APPROVE。完整 Ruff/严格 CQR 的失败及维护者合并权限仍分别保留，本审查不执行合并或安装。

English verdict: APPROVE e6fe94ea70ba30003b84241043ee5c459222ca35. Current6 real native source-CLI cases,178 focused tests and exact-base/head default-off cases pass; the actual-base CLI fails the intended new pragma oracle. Both current revisions pass configured mypy. The same5 pre-existing Ruff diagnostics remain failed and strict quality remains FAIL. Autonomous adoption, author efficiency percentages and installed-host benefit are unverified; no CI or merge action was performed.