fix(todos): share typed Agent addressing across list and quota reads

[huangruiteng]

Agent-scoped Todo lists ignored retained claimed_by on User records, so another Agent's gate/action appeared in the current lane while quota correctly scoped it out. Lists now share typed addressing with quota and decision scope, composed into the existing summary batch.

• Gates use explicit global/blocks scope before the retained claim fallback; actions use explicit binding before claim. Agent work retains claim/exclusion filtering. Visibility grants no execution authority.
• Retire the independent Python list predicates. Preserve full-source resume/succession before selection, source ordinals through filtering, and counts before display limits. Reject downgraded or malformed ordinal responses.
• Keep unfiltered Goal views, existing CLI syntax, provider defaults and v0 summary callers compatible. Frontend/Lark manager reads use the unfiltered Core view; no new editor or activation setting is needed.
• Extend the mixed native/legacy fixture and real-provider readback conformance. Synchronize both shared-authority RFCs and the TS checkpoint with this bounded L5/T2 delta; remaining local-default work still carries the conditional 5–8 PR estimate.

The branch is integrated with main at c57879af3e1781e4f8515aacca644ad8edd098f3; exact head is d52040d589ecd57a584e138d5200dd62b716c2b4. The semantic integration preserves both main's admitted-due/watch-only monitor lanes and this PR's shared actionAddressesAgent rule. The current origin/main..head range contains nine signed commits, all authored by huangruiteng; upstream commits from the merged #4794 are not part of this PR range.

Self-repair also closed two pre-existing validation gaps exposed by the integration:

• Default quota should-run no longer repeats the complete nested vision_authoring schema. It retains the executable writeback summary and a quota should-run --include-detail vision reference; that explicit cold path restores the full schema. turn plan intentionally keeps the validator-owned schema.
• Base/head CLI qualification can measure a parseable, semantically valid historical base that already exceeds an old absolute ceiling, while the candidate must still satisfy current budgets. This prevents a red-base deadlock without adding a candidate bypass.
• Latest main and the candidate both measured the crowded Turn plan at 14,159 JSON characters / 389 lines and 542 Markdown characters. These are typed executor/selection and visible overflow-diagnostic semantics already present on main, so the crowded-only regression ceilings are 14,500 / 400 / 600; small and multi-Agent ceilings and per-Todo growth remain unchanged.

Validation for the repaired change set:

• 104 focused Python output/differential/scoped-read tests passed; the CLI output regression smoke and base/head differential passed. The only differential review signal is the intended removal of the nested default vision schema, restored by the explicit detail selector.
• Targeted Todo scope TypeScript tests and the control-plane typecheck passed. Earlier broad targeted qualification passed 30/30 TS and 98/98 Python cases.
• The complete isolated PostgreSQL 16 authority-store suite passed 193/193 with no failure or skip on the final code head. An earlier run used the wrong system interpreter and produced four subprocess bootstrap failures; rerunning with the checkout Python 3.13 produced 193/193. The final wrapper printed the same 193-pass summary, then its local cleanup shell used zsh's reserved status name and exited 1 after the test process; the isolated server was subsequently stopped and its data moved to Trash. This was harness cleanup, not a product-test failure.
• Exact-head premerge canary passed 19/19 selected checks, including 10 catalog checks, 8 risk-profile checks, compile/diff checks and the public/private boundary scan; no failure, warning, skip or manual hold.
• Ruff, configured mypy and the public-boundary scan passed. No active Goal or existing database was mutated.

Baseline independently reproduced five scope failures, including actual legacy/File/SQLite CLI paths. A read-only source-snapshot rehearsal covers 1,005 Todos/9 leases and compares immutable baseline/head consumers on real File/SQLite/PostgreSQL. Provider heads agree, reads/source remain unchanged, and full Goal/Agent-work observations retain parity. PostgreSQL qualification exercises the production store/runtime and read consumer, not a deployed HTTP/auth service. Missing display, archived dependency, display limits and malformed/downlevel response paths are covered.

Cost is disclosed: in an eight-sample warm comparison, complete summary plus exact-Todo filtering retained six runtime calls; request bytes increased from 147,838 to 202,692 and median runtime from 390 ms to 419 ms. This is a bounded local observation, not an SLO or performance improvement. The extra scope facts replace Python policy; further bridge retirement belongs with native consumer ownership. Net Python product reduction is 14 lines; this PR retires duplicate decisions rather than claiming wholesale Python removal.

Toward #4574 / shared-authority L5 / TS T2. This does not certify D1 freshness, contributor-owned D2 (#4224), whole-Goal migration (#4799), default onboarding or PostgreSQL service deployment. No active Goal was mutated/promoted.

This PR changes loopx/** control-plane/runtime behavior. Repository policy therefore requires an independent maintainer to perform the final merge even when exact-head review, CI and merge-readiness are green.

[huangruiteng]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

Exact head: b30c42789983c594d29f633ca3527886793a5246; reviewed against 0ef7ebd749ec97a698a8fc7f2a29844dd368689b.

动机

没有发现未解决的阻塞项。旧 todo list --agent-id 的 Python User 谓词忽略仅有 claimed_by 的历史记录，因此 B 的 gate/action 会混进 A 的列表，而 quota 已按 TS 规则排除它们。基线实际 legacy/File/SQLite CLI 均复现错误。这是 #4574、shared-authority L5 和 TS T2 下一个有独立用户结果的增量，不代表默认 provider 或整个 L5 已完成。

改动思路

复用现有 todo.summary_lanes.project 批次，先从完整来源完成 resume/succession，再执行 Agent/status/id 筛选，最后生成 lanes、计数及有界展示。agent_scope.ts 统一列表、quota 和 decision scope 的寻址规则。显式 global/blocks 优先于 gate 的旧 claim；action 的显式 binding 优先于旧 claim；Agent 工作仍受 claim/exclusion 过滤。保留 quota 额外的执行资格检查，可见不等于授权。

只在 Python 加 claim fallback 虽然更短，却会留下本次已发生漂移的第二份决策规则。独立 TS 筛选 RPC 则会多一次跨语言调用；当前方案扩展既有 owner，没有新增 capability/provider、持久化字段或 CLI 参数。Python 仍负责真实调用者需要的输入适配和展示。

具体改动

17 个路径，+431/-82：8 个产品路径 +107/-82，5 个测试/fixture 路径 +259，4 个文档路径 +65。删除独立 Python 列表谓词和旧 gate_scope.ts，更新真实引用；新增的 27 行范围模块承接原有 gate、action、claim 规则。内部 v1 request 带筛选意图，v0 调用兼容；response 中的 source indices 是当次快照的派生索引，不是新的权威状态。

测试包含真实 CLI、混合 native/legacy 复杂图的跨 provider conformance 和桥接负例。中英文 shared-authority RFC、TS checkpoint 和读取文档记录实际行为及未完成边界。前端/Lark manager 的实际调用使用未按 Agent 筛选的 Core 整 Goal 读取，不需要配置或编辑器 companion 改动。

关键代码讲解

• agent_scope.ts:19 actionAddressesAgent：显式 bound 优先，其次 claim。列表与 quota 引用同一函数；所有保留的非 user_gate User 类别都走 action 范围，避免只修显式 user_action 而遗漏历史类别。
• summary_lanes.ts:74 selectRows：筛选已求值的完整来源行，保留 row.ordinal。筛选后的第 0 行不一定来自原数组第 0 行；先解码编号、再过滤保证身份不被重编号破坏。
• todo_summary.py:894 _project_summary_lanes：在原 summary 调用中传递 selection，校验返回索引为精确整数、唯一、合法范围且 lane 不越出 selected source。缺少 v1 selection metadata 的旧响应会报错，不会静默退回整列表。

对主干的风险

最大风险是从筛选后的局部视图重新推导依赖，或把筛选位置误当来源位置。真实 CLI 的已归档依赖、复杂图中的推导 successor、limit=1 保留完整匹配计数，以及错误 ordinal/downlevel 响应测试覆盖这些路径。缺失 Markdown 时 canonical CLI 仍正常读取；权威源不可用时失败关闭，不能悄悄回退旧展示文件。独立 provider readback 验证读取无写入。

整合最新 main（含 #4820）后重新验证：Python 121/121、TS 定向 23/23、真实隔离 PostgreSQL 16 193/193；File/SQLite/reference 的 native/legacy scope conformance 6/6。Canary 19/19 加五项直接检查通过；typecheck、Ruff、compile、配置内 mypy 及 public boundary 检查通过，无失败、跳过或 manual hold。质量 receipt 已验证；按 wait_for_ci=false 未查询或等待远端 CI。

真实来源的只读快照（1,005 Todos/9 leases）在同一输入上对照基线与新 head，File/SQLite/PostgreSQL 一致；整 Goal、Agent 工作视图和计数保持一致，peer-only User 泄漏按预期消失。此 PG 证据覆盖实际 store/runtime/read consumer，不覆盖 HTTP/auth 服务部署。

效率存在可测代价：8 次 warm 样本中，六次 runtime crossing 不变，传输 147,838→202,692 bytes，median 390→419 ms。样本不构成 SLO，不能宣传性能改善；作为一项非阻塞效率提示保留。没有提高硬预算或隐藏失败。后续 native consumer 迁移才有条件继续删除桥接。回滚只需还原代码，无持久化数据迁移。

语义与 CI 对齐

复用既有 gate/action/claim 词汇与 typed owner，未新增状态分类或领域专用义务。旧列表行为变化在读取文档中明确披露。范围筛选是机器执行的读取语义，不是可忽略的 guidance，也不是执行许可。仓库本地要求及风险选择检查已执行；不把未验证的 PostgreSQL 服务运维、D1 freshness、D2 soak 或整 Goal 默认切换包装成本 PR 验收通过。

我的整体评价

APPROVE。这是完整的 read-consumer 修复和边界重构，保留必要 Python 宿主适配，同时真正移除重复的决策知识；Python 产品代码净减仅 14 行，不应夸称大规模 Python 退出。已做相邻重构检查，应用共享范围 owner 与索引校验，暂不为此拆散整个大 renderer。剩余 caller/executor、其他 L5 recovery、contributor D2、whole-Goal capture/cutover 和默认 onboarding 仍依 RFC 条件估计为 5–8 个完整 PR，不能按本 PR 数量机械递减。保留 maintainer 合并边界。

English verdict: APPROVE - b30c427. No blocking findings: scoped Todo reads now reuse typed addressing, with explicit User-visibility correction, full-source topology/count preservation and no authority write. Final local validation: 121 Python, 23 targeted TS, 193 real PostgreSQL tests and 19 Canary checks passed. Payload/latency overhead is disclosed; default promotion and PostgreSQL service deployment remain unqualified. Maintainer merge required.

[huangruiteng]

Merge-readiness qualification (exact head; no duplicate fresh audit)

Exact head: b30c42789983c594d29f633ca3527886793a5246
Current origin/main: 09f10c4e37b89c6ed25f2f2354f89d641662e83c

当前 head 已有一份 capability 认可的完整 author-owned APPROVE 结论，因此这次没有重复发布同一审阅；本次只执行队列要求的 exact-head merge-readiness qualification。

结论：not ready。

• loopx pr-review --check-merge-readiness 4823@b30c42789983c594d29f633ca3527886793a5246 返回 ready=false，blocking reasons 为 status_checks_failed、status_checks_incomplete、merge_state_requires_update。
• 当前有效 checks 为 25 success / 5 failure；失败项是 test-shard、test-shard (2)、stage2c (...)、pytest、merge-gate。
• 我用最新 origin/main 做本地 merge-tree：exit 1，唯一实际 content conflict 在 loopx/control_plane/todos/quota_selection.ts。冲突点不是纯格式：main 新增了 admittedDue / watchOnlyMonitors 逻辑，而本分支把 activeVisible 切换到共享的 actionAddressesAgent，rebase 时需要保留两边语义。

最小修复：在最新 main 上 rebase/merge，解决 quota_selection.ts 时同时保留 main 的 monitor admission 变量与本 PR 的共享 Agent-addressing owner；随后重跑本 PR 已声明的 Python/TS scoped-read 回归、真实 PostgreSQL conformance 和 premerge gate。head 会变化，因此旧 exact-head 结论不能直接继承，需重新运行 PR-review capability 和 merge-readiness gate。

English verdict: REQUEST_CHANGES - head b30c427 is not merge-ready against main 09f10c4; resolve the semantic conflict in quota_selection.ts, rerun the scoped-read/real-store validations, then obtain a fresh exact-head review.

[huangruiteng]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

Exact head: d52040d589ecd57a584e138d5200dd62b716c2b4; reviewed against c57879af3e1781e4f8515aacca644ad8edd098f3.

代码审阅未发现实现阻塞。此前 Frontstage packaged-assets 失败已在 owning main/UI 边界由 #4828 修复并进入本基线；本精确头重新触发了完整 CI。PR 已在该批检查完成前于 2026-09-21T06:15:28Z 合并为 9982ee0d0b398ac9653c612c2cbc8c8666f2d055，因此本条是 exact-head review 的事后补录，不会把合并动作本身当作审阅证据。

动机

原问题已由真实 legacy/File/SQLite 路径复现：按 Agent 读取 Todo 时，Python User 谓词没有把历史 claimed_by 当作 gate/action 的保留寻址信息，导致别的 Agent 的 User Todo 混入当前列表，而 quota 的 TS 规则已把它排除。修复后的用户结果是列表与 quota 使用同一 typed addressing，整 Goal 读取和执行授权保持不变。这是 #4574 / shared-authority L5 / TS T2 的一个独立可用增量，不宣称完成默认 provider、D1/D2 或 whole-Goal 迁移。

改动思路

寻址知识收敛到 agent_scope.ts：gate 按 global → blocks → retained claim，action 按 explicit bound → retained claim，Agent work 保留 claim/exclusion。summary_lanes.ts 在完整来源上完成 resume/succession 求值后再选择行，并保留 source ordinal；Python 只传递选择意图、校验返回 ordinal 与 lane 子集、再做展示限制。这样不会从局部视图重新推导拓扑，也不会把可见性误当成 mutation/execution 权限。

合并最新 main 时语义冲突已人工解决：保留 main 的 admittedDue / watchOnlyMonitors，同时让 activeVisible 使用共享 actionAddressesAgent。相邻重构应用了共享寻址 owner 与严格 ordinal 校验，没有扩大为整个 renderer 或 store 迁移。

集成还暴露了主干已有的 CLI 预算死锁。候选把默认 quota should-run 中完整嵌套的 vision_authoring schema 移到可达的 --include-detail vision 冷路径，热路径仍保留可执行 writeback summary；turn plan 继续携带 validator 接受的完整 schema。base-only probe 可测量超出旧 ceiling 但仍可解析、语义完整的历史 base，candidate 仍执行当前绝对预算与 base/head 语义差分。这比只提高 quota/per-Todo ceiling 更能保留预算约束；相关 #4847 有重叠，不能盲目同时合入。

具体改动

26 个路径，+725/-116。核心 Todo 改动删除 Python 独立谓词与旧 gate_scope.ts，新增共享 TS owner，扩展既有 summary RPC 的 v1 选择请求；没有新增持久化状态、外部 CLI 参数或权限。CLI 自修复增加默认投影压缩、base-only measurement mode、聚焦预算与文档/测试。最后两处 conformance runner 使用 LOOPX_TEST_PYTHON，避免系统 Python 与 checkout Python 不一致。

关键代码讲解

• loopx/control_plane/todos/agent_scope.ts:8 gateAddressesAgent / :19 actionAddressesAgent：统一 gate、action 与 retained claim 的寻址优先级；注释和调用者明确“visibility never grants authority”。
• loopx/control_plane/todos/summary_lanes.ts:76 selectRows：在已求值的完整 rows 上组合 role/status/todo/agent 选择，返回原 source ordinals；v0 caller 保持原行为。
• loopx/control_plane/todos/todo_summary.py:898 _project_summary_lanes：将 legacy facts 适配给 typed owner，并拒绝非精确整数、重复、越界、downlevel 或逃离 selected source 的 ordinal。
• loopx/control_plane/quota/cli_projection.py:460 _compact_replan_action_packet：只移除默认热路径中的 nested authoring schema，保留 required_fields、path outcomes、rule 与显式 detail ref。
• examples/control_plane/cli-output-probe-runner.py:127 _assert_output_contract：仅历史 base 可跳过旧绝对尺寸断言；JSON object/required keys、Markdown anchor 与后续语义差分不被跳过，candidate 无旁路。

对主干的风险

最强回归场景是筛选后重编号导致 lane 指向错误 Todo，或把另一个 Agent 的 gate/action 错误纳入当前列表；混合 native/legacy 图、归档依赖、limit、malformed/downlevel ordinal、File/SQLite/PostgreSQL readback 覆盖这些路径。可见性不写状态，store/runtime 源与 provider heads 在读取前后保持不变。

预算风险是为了修红而隐藏必要语义或放宽规模增长。实测 latest main 与候选的 crowded Turn plan 都是 14,159 JSON chars / 389 lines、542 Markdown chars；只调整 crowded 固定语义余量，small/multi-Agent ceiling 与 60 chars/Todo 不变，TurnEnvelope overflow warning 仍显示。quota 默认移除 59 个 nested shape paths，explicit vision detail 恢复完整 schema；base/head differential 把这项列为人工 review signal 并通过。

本地证据：104 个 output/differential/scoped-read Python 测试、30 个定向 TS、98 个广义 Python 回归、control-plane typecheck、Ruff、mypy、CLI budget smoke 和 base/head differential 均通过；隔离 PostgreSQL 16 最终为 193/193、0 fail/skip；精确头 canary 为 19/19、无 warning/manual hold。第一次 PG 运行的四个 bootstrap 失败来自错误系统解释器，换为 checkout Python 3.13 后全部通过；最终 wrapper 在 193-pass summary 后因 zsh 保留变量名退出 1，实例已停止并移入 Trash，产品测试本身无失败。

发布本 review 时，远端 DCO、Dependency Review、Release Artifacts 与 PostgreSQL authority 已通过；Frontstage 和 Python 矩阵仍在完成，没有已知失败。由于合并发生在完整 required checks 和 exact-head review 之前，这是一项流程缺口；后续 CI 失败仍需按 owning boundary 回补，不能由本条事后 APPROVE 抹去。

语义与 CI 对齐

状态分类全部来自 typed role/task_class/global/blocks/bound/claim/excluded 字段，没有 substring denylist 或产品专用措辞。旧列表默认行为变化已在读取协议与中英文 RFC 披露。Agent scope 是机器执行的读取语义，不是 guidance；它也不授予 lease、mutation 或 execution。该 PR 无 default-off/opt-in 宣称，整 Goal 无筛选 v0/v1 parity 已验证。

我的整体评价

实现与语义层面没有阻塞 finding；改动复用了现有 owner，负例和真实数据库边界充分，且 self-repair 没有通过降低 candidate gate 获得绿色。剩余集成风险是与 #4847 的预算修复重叠：本 PR 通过压缩真实热路径并保持 candidate budget，不能再盲目叠加一个仅抬高 ceiling 的替代方案。

本次代码审阅结论为 APPROVE。origin/main..head 的九个提交均由 huangruiteng 签名提交；songoow 的 #4794 提交只属于基线，不在本 PR 提交范围。流程结论不是通过：本 PR 修改 loopx/** 控制面/运行时，仓库硬规则要求独立 maintainer 执行最终 merge，但实际在完整 CI、exact-head published review 和独立 maintainer merge 之前由作者完成了合并。本条仅补全可审计 review 结论，不能追溯性地消除该缺口。

English verdict: APPROVE - exact head d52040d589ecd57a584e138d5200dd62b716c2b4 has no code-review blocker; focused Todo/CLI/TypeScript/PostgreSQL checks and the 19/19 exact-head premerge canary pass. Process gap: the author merged the control-plane/runtime change as 9982ee0d0b398ac9653c612c2cbc8c8666f2d055 before the full required CI batch completed, before this exact-head review was published, and without the independently performed maintainer merge required by repository policy. This post-merge review records the conclusion but does not retroactively cure that gap.