[hhyykk]

Goal And Delivered Outcome

• Outcome basis / optional anchor: TypeScript control-plane migration RFC §2.4 and §8 (no permanent Python/TS twins; delete an adapter with its last real caller).
• Goal/source and gap: Two Python adapters and one private TS runtime operation had no production caller left. coordination/local_snapshot.py lost its last caller in refactor(authority): retire legacy Markdown mutation callers #6396, but the retirement ledger still said to keep it for Todo mutation authorization. build_standing_decision_authority() was called only by tests and one example; production reaches the same TS owner through the composed todo.read batch.
• Observable before → after, with the validation row that proves it: dead adapters and a test-only RPC → removed, with the same semantic assertions now running through the production read path; ledger and RFC checkpoint updated. No runtime behavior change. Proven by the Validation rows below.
• Issue/task and intended base: Self-contained request; base loopx-project/loopx:main. No issue closure claimed.

Author Declaration

• Written by: model_agent: Factory Droid (lead, review and commits) with OpenAI Codex CLI (implementation).

Implemented against

• Specification and revision: RFC sections above at e9eda527a.
• Criteria:

Criterion (spec clause)	Disposition	Symbol / path	Test or command
Delete an adapter only with its last real caller: local_snapshot.py has no reference in code, tests, packaging or manifests	implemented	loopx/control_plane/coordination/local_snapshot.py (deleted)	repository-wide search; canary premerge
Remove the test-only build_standing_decision_authority() and its standalone todo.standing_decision.project handler and request decoder; keep standing_decision_source_items() and the shared TS owner	implemented	loopx/control_plane/todos/standing_decision.py; loopx/control_plane/todos/standing_decision.ts; loopx/control_plane/effect_runtime_handlers.ts	tests/control_plane/test_standing_decision_order.py; tests/control_plane/test_todo_decision_scope_consistency.py; tests/control_plane_ts/standing_decision.test.ts
Keep chronology, revocation, scope, canonical-id and invalid-item coverage through the composed todo.read path; add contradictory-authority refusal without explicit legacy order	implemented	tests above; examples/control_plane/todo-standing-decision-authority-smoke.py; tests/control_plane_ts/effect_runtime_fairness.test.ts	same
Correct the stale retention row and record the retirement (EN and zh-CN)	implemented	docs/architecture/rfcs/ledger/shared-goal-authority-state-provider-v0/2026-09-28-retirement-cadence{,.zh-CN}.md; docs/architecture/rfcs/typescript-control-plane-migration-v0{,.zh-CN}.md	scripts/check_rfc_bilingual.py --base origin/main --head HEAD

• Self-check before submission: Read the full diff, re-searched every removed symbol and method name across the repository, and ran the checks under Validation. Verified DCO trailers.

Migration economics receipt

Field	Result
Canonical owner	Unchanged: todos/standing_decision.ts via todo.read; lease facts with native executors
Legacy code deleted	111 product lines (67 local_snapshot.py, 33 Python wrapper/imports, 9 TS decoder/schema, 1 handler registration, 1 docstring line)
Bridge code added	0
Cross-runtime calls	Production paths unchanged; the removed RPC had no production caller
Product net change	−110 lines
Scaffolding	None added; tests use a small local helper over the production composition
Facade exit	local_snapshot.py, the Python wrapper and the standalone RPC are deleted now

Scope And Continuation

• Completed scope and remaining work: Complete within this scope.
• Slice boundary / successor: N/A. A follow-up candidate, retiring the duplicated turn-scoped settlement predicate in work_items/delivery_outcome.py, was analyzed and deliberately not included. Several refusal paths (Host-result validation, the slot-accounting fallback scan, the missing-outcome refusal in refresh) cross no TS request today, so a cutover would add a cross-runtime call or reorder refusal.

Validation

Public-safe summaries only, including in HTML comments. Do not paste raw logs,
private data or prompts, private screenshots, credentials, internal URLs, connection
strings, or local paths. Use repository-relative commands without sensitive
arguments, aggregate results, and already-public CI links. If evidence is
private, report its category and limitations only; do not upload it to prove a claim.

• Tested revision: 99619c8
• Run state: finished
• Input classes: synthetic

Check kind	Result	Public-safe evidence / limitation
unit	passed	Python decision-scope, standing-decision, user-completion and chat gate suites: 193 passed, 0 failed.
unit	passed	TS standing_decision, effect_runtime_fairness, todo_read, decision_scope, archive_capture, todo_archive_selection: 54 passed, 0 failed.
real_entrypoint	passed	examples/control_plane/todo-standing-decision-authority-smoke.py through the composed read and quota should-run.
static	passed	check_rfc_bilingual.py --base origin/main --head HEAD; loopx canary premerge --from-git-diff --git-diff-base origin/main including the maintainability ratchet and semantic vocabulary drift; merge gate passed.

• Coverage and gaps: The removed RPC had no production caller, so production behavior is unchanged by construction; the migrated tests keep every previous assertion. Installed-artifact checks were not run separately. One reviewer note: the removed RPC rejected a non-boolean legacy_source_order (for example the string "false"), while the production todo.read path already treats any value other than true as not-legacy. That is existing production behavior, not a change introduced here.

See validation disclosure guidance.

Frontend / Visual Evidence

• UI impact: none.
• Before: N/A; no UI surface change.
• After: N/A; no UI surface change.
• First viewport and preview: N/A; no UI impact.
• States and viewports shown: N/A; no UI impact.
• Source data: none.
• Attention review: N/A; no layout change.
• Craft review: N/A; no visual change.

Type of Change

• Bug fix
• New feature
• Breaking change
• Refactoring (no functional changes)
• Documentation update
• Test update

LoopX Area

• Control plane (goals, todos, quota, scheduler, registry, runtime)
• Benchmark boundary (adapters, runners, verifiers, scoring, evidence)
• Capability or extension (providers, adapters, skills)
• Public docs or presentation surface (README, protocols, dashboard)
• Build, packaging, installer, or CI
• Host or runtime integration

Technical Direction

• Direction / acceptance reference, when applicable: TypeScript control-plane migration RFC, Stage 2B deletion rule (adapter exits with its last caller).

Shared-authority RFC fixture impact

• Production-scale fixture schema: N/A; no migration or shared-authority qualification claimed.
• Semantic dimensions changed, or reviewed no-impact rationale: N/A; only uncalled adapters and a test-only RPC are removed.
• Provider conformance arms run: N/A; no conformance claim.
• Read-only legacy/file/PostgreSQL three-arm rehearsal (required for promotion, runtime-routing, or compatibility-projection changes): N/A; none of these changes is proposed.

Boundary Checklist

• Reviewed diff and body for private state, credentials, raw traces, internal links and local machine paths; none included in this body. Test fixtures are synthetic.
• No maintainer-owned benchmark work duplicated.
• Change remains scoped to the request described above.
• Paired RFC and ledger files changed together (EN and zh-CN).
• UI impact marked none.
• Every branch commit includes a DCO Signed-off-by trailer (git commit -s).

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-02T04:22:21.451854Z	99619c8	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[loopx-agent]

1) 问题定义（为什么改、要解决什么）

• 推进控制面减法重构，退役已由组合式 todo.read（kind: "source_fields"）接管的独立 standing_decision.project RPC handler、Python build_standing_decision_authority 包装函数以及无调用的 coordination/local_snapshot.py。

2) 改动摘要（按模块分组）

• 控制面死代码与冗余 RPC 退役 (loopx/control_plane/coordination/local_snapshot.py, loopx/control_plane/effect_runtime_handlers.ts, loopx/control_plane/todos/standing_decision.py, loopx/control_plane/todos/standing_decision.ts)：删除 local_snapshot.py（67 行），移除 standing_decision.project 独立 handler 与 evaluateStandingDecisionProjection / build_standing_decision_authority 包装层，保留核心 projectStandingDecisions 供 todo.read 内部组合调用。
• 测试与示例迁移 (examples/control_plane/todo-standing-decision-authority-smoke.py, tests/control_plane/**, tests/control_plane_ts/**)：将原直接调用 build_standing_decision_authority 或 standing_decision.project 的测试与 smoke 统一迁移至真实生产入口 todo.read（kind: "source_fields"）。
• 双语 RFC 与台账更新 (docs/architecture/rfcs/**)：同步更新中英文迁移主文档与 2026-09-28-retirement-cadence 台账。

3) 逐点审阅结论（架构、语义、正确性、测试、风险）

• 全仓引用与契约一致性：经全仓 git grep 核验，todo_snapshot_from_mapping、build_standing_decision_authority 与 evaluateStandingDecisionProjection 均已无残留调用方；测试直接覆盖组合式 todo.read 入口，消除了测试专用的旁路 wrapper。

4) 建议修改项（分 P0/P1/P2，带文件路径和行号）

• 无阻塞项。

5) 最终结论（Verdict）

Approved — ready to merge once CI completes (exact head 99619c84e47c7033d6731beba40ce6a814337c9f verified).

[loopx-agent]

Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; reasoning_effort=max

动机 / Motivation

维护控制面和审查其变更的开发者会在旧入口已退役后仍看到这些代码与过时保留说明。 过去测试只走独立的 standing-decision 包装，生产已走组合读取；现在删除死包装，让原测试断言通过实际的组合读取验证。 调用与字符串 dispatch 搜索没有找到被删 owner 的生产消费者；同一 standing-decision smoke 在 base/head 通过，决定资格、撤销和跨 Agent 隔离保持。 本次只完成这组已无消费者代码的退役，不宣称整个 Python facade 或长程收益已资格化。

改动思路 / Approach

生产已经采用现有 typed owner，退役死包装符合迁移 RFC 的“最后一个真实消费者退出后删除”约束。保留另一份不再执行的实现只增加下一次修改的搜索和误读成本。 当前 PR 删除两个 Python 适配边界与仅供旧测试的 RPC，保留共享 standing-decision 规则和生产 todo.read。 不修改会保留已无消费者的语义和过时 checkpoint；加兼容 shim 会重新创造死入口。当前已有真实 owner，只应移除最后消费者之后的局部边界，未要求重写仍活跃的 Python I/O。 正向路径从 source_todo_fields → todo.read → projectStandingDecisions 进入既有 owner，同一源/fixture 经过真实 owner 和 CLI，得到原有正确断言结果；异常路径保留 原 typed eligibility / Todo actor-lease-completion validation，原有负向 suite 和真实 smoke 保持拒绝及恢复断言，删除死代码没有绕过拒绝。本次完整审查当前 head，没有继承先前模板审查的通过结论。

具体改动 / Changes

13 paths +79/-137；生产删除局部 adapter/handler，三个测试/示例调用改走既有组合读，RFC/ledger 两个语言配对更新。 standing_decision_source_items/共享 TS eligibility 与 chronology 保留；旧 RPC 没有独立公共或持久化 reader。 没有新状态、分类或 persisted schema。决定资格/chronology 或 Todo lease/proof 规则均沿用原 typed owner。

关键代码讲解

• standing_decision_source_items：为组合读取解码来源 metadata。 函数 AST 保持；删除的是它外面的独立批量 RPC 包装。 输入为legacy/canonical standing-decision records，关键条件是canonical ID 不重新按 Markdown token 解码。非法/冲突决定由既有 typed owner 拒绝或诊断

• projectStandingDecisions：拥有决定资格、先后及撤销规则。 删除独立 request decoder，规则函数保留。 输入为完整记录与 legacy ordering flag，关键条件是后发生的拒绝撤销较早允许；冲突不授予 active authority。无证据时不产生授权

规格为 docs/architecture/rfcs/typescript-control-plane-migration-v0.md，spec_revision e9eda527afd5fcb262ee7c199e1822b1a936cc24；§2.4/§8 要求以生产 caller 为依据退役，不通过改名、移入档案或永久保留 Python/TS twins 宣称完成。

• §2.4 reuse_and_retirement：implemented。已有 typed owner 继续负责决策；死包装不再构成平行 owner。 对应 source_todo_fields → todo.read → projectStandingDecisions；全仓 caller/字符串搜索与 AST audit。
• §8 source_and_behavior：implemented。只删除最后消费者已退出的代码，保留真实状态/回执/恢复消费者。 对应 source_todo_fields → todo.read → projectStandingDecisions；38 Python tests; 30 TypeScript tests; same source smoke at base/head。

对主干的风险 / Risks

最强风险是遗漏字符串/懒加载消费者，或误删真正承担授权/恢复职责的 helper；仅以净减行数无法排除它。 为区分修复与无效测试，我对不可变 base/head 执行相同输入：base 相同生产 smoke exit 0，原语义断言通过；head 同一 smoke exit 0；当前受影响 suites 全部通过。全仓检查同时搜索函数名、旧模块路径和动态 dispatch；不是只搜索 Python import。仅同名 _scope_identity 命中另一个 manager_context owner，已检查其 import，和被删 local_snapshot 无关。 决定测试包括晚发生 revoke、反序 source、canonical ID、scope 不匹配；Todo suites 保留 actor/lease/completion、archive/successor/恢复。没有新授权或受展示 limit 限制的 source 选择。

• PASSED：same source smoke on base/head — both exit0；full semantic assertions preserved。
• PASSED：38 Python tests; 30 TypeScript tests; same source smoke at base/head — all selected current Python/TS suites passed。
• PASSED：whole-repo symbol search; AST compare; check_rfc_bilingual.py --base e9eda527afd5fcb262ee7c199e1822b1a936cc24 --head HEAD; git diff --check — caller/AST evidence verified；双语与 diff 见独立日志。

语义与 CI 对齐

复用既有 typed source/decision vocabulary；退役 transient private RPC 不删除持久化回执格式。RFC 英中同步修正，旧历史边界仍可追溯。 没有新增或重定义 default-off 路径；所有可达生产状态/权限保持，相关 enabled/disabled 和非法主体 suite 已执行。 独立证据覆盖当前 changed invariant；远端 CI 的其他状态与合并 readiness 另行保留，没有把检查颜色当作正确性证明。 真实 source CLI/TS 和合成隔离状态已执行；未宣称 installed 或整体长程效率资格。未触及 PostgreSQL authority store，无新增该后端义务。

我的整体评价 / Verdict

APPROVE：当前完整 diff 在所声明边界内达到 goal_achieved；long_horizon 为 preserved，原决定、租约、完成、恢复和历史读取路径保持；减少无消费者维护表面，不把减少行数当作实测长程收益。 user_experience 为 preserved，现有 CLI/Chat 调用、拒绝和恢复保留；维护者可从准确 checkpoint 找到当前 owner。 检查现有 Todo read/update、worker bridge 与 primary-action 内部调用；没有渲染展示变化，visual_review not_applicable。 生产已经采用现有 typed owner，退役死包装符合迁移 RFC 的“最后一个真实消费者退出后删除”约束。保留另一份不再执行的实现只增加下一次修改的搜索和误读成本。 当前 PR 删除两个 Python 适配边界与仅供旧测试的 RPC，保留共享 standing-decision 规则和生产 todo.read。 已做同域收口；仍有活跃调用的 decoder/trace/writer 不应为减少代码继续删除。 不把本次 review 当作合并授权。

English verdict: APPROVE — 99619c84e47c7033d6731beba40ce6a814337c9f; unreachable legacy boundaries are retired while the existing production owner and semantic checks are retained. 38 Python tests; 30 TypeScript tests; same source smoke at base/head pass.

[loopx-agent]

Reviewer: loopx-agent; exact head: f0e163a2d90014ae67b3f7ddbb0bcb10aa3b6b9c

动机 / Motivation

维护控制面的开发者仍会看到已经没有任何生产调用的 Python snapshot 适配器和 standing-decision 包装，也可能因为过时的保留说明误以为这些边界仍承担授权职责。生产读取已经通过 todo.read 到达共享 TypeScript owner；移除死入口后，测试和示例改走真实组合读取，减少错误搜索、维护和后续双实现漂移的成本。本次只退役已无调用方的局部适配边界，不宣称整个 Python facade 或长时程收益已经完成。

改动思路 / Approach

生产路径保持不变：source_todo_fields → todo.read → projectStandingDecisions。删除的是最后调用方已经退出的 coordination/local_snapshot.py，以及只被测试使用的 build_standing_decision_authority()、独立 todo.standing_decision.project handler 和 request decoder。决策先后、撤销、scope、canonical ID 与非法输入规则继续由现有 TypeScript owner 承担；Python 只保留组合读取所需的来源解码。

具体改动 / Changes

关键代码讲解

• standing_decision_source_items 继续把来源记录解码给组合请求，但不再被独立批量 RPC 包装。
• projectStandingDecisions 继续拥有决定资格、时间顺序、撤销和冲突拒绝；本次删除其独立 request decoder，没有复制规则。
• readTodoRuntime 成为测试、示例和现有生产调用共同经过的组合读取入口，保留同一组 chronology、revocation、scope、canonical-id 和 invalid-item 断言。

验证

• 相关 TS 定向测试：87/87 通过，包含 handler 退役后必须 fail closed 的 leaf RPC 检查。
• 当前 Python decision-scope、standing-decision、user-completion 与 chat-gate 选择：127/127 通过。
• todo-standing-decision-authority-smoke.py 通过真实组合读取和 quota 路径。
• npm run typecheck:control-plane、双语 RFC 检查和 git diff --check 通过。
• 分支已重放到最新 main 58a85d0a，并处理 main 已退役 todo.public_update.plan 的交叉变化；最终合并树只额外移除 todo.standing_decision.project。

对主干的风险 / Risks

没有发现新的阻断性问题。最强风险是遗漏动态 dispatch、懒加载或字符串形式的调用方；全仓符号和路径搜索只剩 RFC 中的历史说明，没有可执行引用。共享 TypeScript owner、持久化记录和组合读取保持不变，因此本 PR 不改变决定权限、Todo lease、完成或恢复语义。GitHub 必需检查在新 head 上仍在运行，合并前需要等待精确 head 的检查结果。

我的整体评价 / Verdict

APPROVE。当前 head 在最新 main 上完成了无消费者边界的退役，同时保留既有生产 owner 和负向路径。原评审因 rebase 失效，本结论针对当前精确 head；合并仍需等待 GitHub 必需检查通过。

English verdict: APPROVE — exact head f0e163a2d90014ae67b3f7ddbb0bcb10aa3b6b9c retires unreachable adapters while preserving the composed production read owner and its semantic checks. Selected TS tests pass 87/87, selected Python tests pass 127/127, the real smoke passes, and required CI remains a separate merge gate.

[huangruiteng]

Reviewer: loopx-agent; exact head: f0e163a2d90014ae67b3f7ddbb0bcb10aa3b6b9c

动机 / Motivation

维护控制面的开发者仍会看到已经没有任何生产调用的 Python snapshot 适配器和 standing-decision 包装，也可能因为过时的保留说明误以为这些边界仍承担授权职责。生产读取已经通过 todo.read 到达共享 TypeScript owner；移除死入口后，测试和示例改走真实组合读取，减少错误搜索、维护和后续双实现漂移的成本。本次只退役已无调用方的局部适配边界，不宣称整个 Python facade 或长时程收益已经完成。

改动思路 / Approach

生产路径保持不变：source_todo_fields → todo.read → projectStandingDecisions。删除的是最后调用方已经退出的 coordination/local_snapshot.py，以及只被测试使用的 build_standing_decision_authority()、独立 todo.standing_decision.project handler 和 request decoder。决策先后、撤销、scope、canonical ID 与非法输入规则继续由现有 TypeScript owner 承担；Python 只保留组合读取所需的来源解码。

具体改动 / Changes

关键代码讲解

• standing_decision_source_items 继续把来源记录解码给组合请求，但不再被独立批量 RPC 包装。
• projectStandingDecisions 继续拥有决定资格、时间顺序、撤销和冲突拒绝；本次删除其独立 request decoder，没有复制规则。
• readTodoRuntime 成为测试、示例和现有生产调用共同经过的组合读取入口，保留同一组 chronology、revocation、scope、canonical-id 和 invalid-item 断言。

验证

• 相关 TS 定向测试：87/87 通过，包含 handler 退役后必须 fail closed 的 leaf RPC 检查。
• 当前 Python decision-scope、standing-decision、user-completion 与 chat-gate 选择：127/127 通过。
• todo-standing-decision-authority-smoke.py 通过真实组合读取和 quota 路径。
• npm run typecheck:control-plane、双语 RFC 检查和 git diff --check 通过。
• 分支已重放到最新 main 58a85d0a，并处理 main 已退役 todo.public_update.plan 的交叉变化；最终合并树只额外移除 todo.standing_decision.project。

对主干的风险 / Risks

没有发现新的阻断性问题。最强风险是遗漏动态 dispatch、懒加载或字符串形式的调用方；全仓符号和路径搜索只剩 RFC 中的历史说明，没有可执行引用。共享 TypeScript owner、持久化记录和组合读取保持不变，因此本 PR 不改变决定权限、Todo lease、完成或恢复语义。GitHub 必需检查在新 head 上仍在运行，合并前需要等待精确 head 的检查结果。

我的整体评价 / Verdict

APPROVE。当前 head 在最新 main 上完成了无消费者边界的退役，同时保留既有生产 owner 和负向路径。原评审因 rebase 失效，本结论针对当前精确 head；合并仍需等待 GitHub 必需检查通过。

English verdict: APPROVE — exact head f0e163a2d90014ae67b3f7ddbb0bcb10aa3b6b9c retires unreachable adapters while preserving the composed production read owner and its semantic checks. Selected TS tests pass 87/87, selected Python tests pass 127/127, the real smoke passes, and required CI remains a separate merge gate.