[loopx-agent]

Quota CLI, thin heartbeat and native Turn deliver overlapping facts through different consumers. C1 composes one complete loopx_turn_envelope_v1 source before capture and reuses the existing TypeScript owners for references, recovery and original settlement identity. Python remains the IO adapter. This is an unfinished integration proposal: merging it would change the default executable input, so writer/consumer cutover, supported-reader retirement and original-quota outcome/full-cost qualification remain open.

Current source: 35e4ef22674a2000b22a96241a7cdd7c3ae3ba33 (the source-identity integration at 60ef2b5842335296276eb18cb0a3739fad3a507d plus the historical unbound-input repair), integrating original candidate 648104978fdd67176cccdbb765c5bc3f36bf2ca3 with target main e8f4c6f8125e3cc0ef912afac653d5542671392f. The update is a normal fast-forward of this proposal, with no force push or merge into main.

This increment:

• Restores the historical no-work-binding decoder's safe blocked result. Complete ordinary inputs still fail closed without their required work binding; no Host invocation or settlement is manufactured.

• Keeps main's extracted quota-presentation owner, poll-receipt-before-capture ordering, bounded refusal recovery and sparse native journal transport. It does not restore the obsolete whole-JSON-string carrier or a second quota presentation implementation.

• Uses the existing numeric collector and validator. Acceptance, summary lanes, authoring and Vision sharing reuse the same source-identity owner; the legacy authoring/Vision adapters use the existing edit transport so JavaScript cannot round unrelated original facts on return. Serialized-body size guards are unchanged; there is no extra sharing RPC, cache or decision owner.

• Preserves original numeric distinctions, a later exact authoring owner, absent-authoring refusal controls and complete audit content. Main's unique journal numeric, replay and large-quoted-body regressions remain intact.

• Keeps the normative bilingual RFC concise relative to the integration draft: detailed candidate chronology moves to a dated ledger (中文). Historical measurements and proposals stay source-bound; they do not become fresh qualification. Existing progressive own-outcome navigation, global constraints and cross-Agent dependencies remain in the current plan.

Current validation:

• Independent 24-case Python-to-TypeScript regressions first produced 16 failures and eight passing controls; all 24 pass after source-identity/edit repair. Cases include integral floats, signed zero, unsafe integers, exact later owners and equal controls.
• The affected complete-reference/producer selection reaches 328 passing cases. Its eight remaining failures were obsolete refusal-output or moved-owner test assumptions. The corrected fixed-head refusal selection passes all 32 cases through real isolated File/SQLite captures and the public recovery reader, preserving original receipts and zero unauthorized work/spend. Counts overlap and are not a combined total.
• The fixed owner selection passes 120 TypeScript cases. TypeScript checking, configured mypy, changed-file Ruff, committed bilingual diff and whitespace checks pass.
• The first whole TypeScript run is failed evidence: an unused import was repaired; the local-provider comparison correctly refused a tracked-source change during that run; the SQLite capacity check hit its unchanged 150-second limit. The serial rerun below checks the affected failed modules; it does not qualify a fresh concurrent whole-tree pass. No timeout or budget is increased, and no failure is relabeled a pass.
• Frozen-head local standard validation passes all seven direct and 19 selected checks, with the original 120-second limits and clean public-boundary scan. This uses a disposable validation registry; it is separate from the managed Goal quality decision.
• All 29 cases in the three formerly failed TypeScript modules pass in a serial frozen-head rerun; SQLite capacity completes in 70.067 seconds under its original 150-second limit. This does not relabel the earlier full concurrent run.
• Two actual Codex CLI/app-server cold/delta/compaction-recovery cases pass at the frozen head (73.56 seconds, local static inference only), including primary-call failure. Other native profiles and installed adoption remain unqualified.
• The original broader CLI integration run has ended: 1,402 pass / 31 fail / 46 skip, 4,012.45 seconds, at its original source boundary. Failures include moved-owner assumptions, captured-read compatibility, native framing and report recovery; that failed cohort is retained. The current head passes 280 driver, complete-contract and real File/SQLite Host/capture consumer cases in 228.50 seconds, including the historical unbound-input repair. This subset does not replace full final-combination qualification.
• Current exact-scope quality receipt cqr_4fe7f73363b0ca2262a9 records fail, preserving remaining integration, whole-tree concurrent and packaged-consumer gaps. Draft remains required for unfinished author work. No CI query or manual trigger, independent review, merge readiness or live-model qualification is claimed.

Compatibility and remaining acceptance:

Fresh complete inputs retain the experimental hash_codec=context_source_numbers_v2 contract. Correctly signed earlier v1 bindings need their pinned reader and unchanged bytes; historical v0 hashes, Turn keys and receipts are not rewritten or re-signed. New unsupported/invalid complete inputs reject rather than fall back to a historical executor view. Required historical result/settlement readers remain until their callers and outstanding work migrate. The optional MemT exact-lifetime producer/consumer gap remains an adoption gap, not permission to relax isolation.

The separate ordinary-CLI JSON fidelity fix remains independently reviewable in #7722; its checks do not qualify this broader candidate. The native 4 KB framing failure is separately fixed in #7735, a three-file mainline proposal with 319 passing regressions and isolated wheel File/SQLite CLI readback. Its shared IO repair can land first; its source and transport evidence do not qualify C1. Shared prerequisites should continue to land independently when they have complete current callers and local rollback.

Historical negative results remain: late TS relocation grew one matched request from 102,680 to 344,010 bytes without changing the 102,189-byte visible output; the frozen 25,862 > 13,000 failure remains. Earlier sparse-codec component savings, capture IO reductions and test counts do not establish original-quota accepted-outcome or complete-cost benefit. The original-quota engineering comparison in #7665 stays pinned to its own revisions.

Finish actual writer/capture/final-consumer replacement and old-reader exit, then compare required information, actual single-session decisions, accepted outcomes and complete costs against original quota under comparable conditions. Optional controller/executor two-session work remains separate. No live installation, release, paid model experiment or default promotion is part of this update.

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @loopx-agent.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @loopx-agent.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @loopx-agent.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @loopx-agent.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork