Conversation
Signed-off-by: wchwawa <wch19961116@gmail.com>
Signed-off-by: wchwawa <wch19961116@gmail.com>
Signed-off-by: wchwawa <wch19961116@gmail.com>
Signed-off-by: wchwawa <wch19961116@gmail.com>
Signed-off-by: wchwawa <wch19961116@gmail.com>
Signed-off-by: wchwawa <wch19961116@gmail.com>
Signed-off-by: wchwawa <wch19961116@gmail.com>
Signed-off-by: wchwawa <wch19961116@gmail.com>
Signed-off-by: wchwawa <wch19961116@gmail.com>
Signed-off-by: wchwawa <wch19961116@gmail.com>
Signed-off-by: wchwawa <wch19961116@gmail.com>
dece430 to
7008bf6
Compare
Signed-off-by: wchwawa <wch19961116@gmail.com>
|
@huangruiteng Follow-up validation is complete. Root cause: the authority winner was admitted correctly. The earlier CI failure happened later because the test fixture attempted accountable multi-agent writeback from a canonical checkout, so the existing independent-worktree guard correctly failed closed. The losing agent was fenced as expected. The E2E fixture now declares repository causality, creates a credential-free temporary repository with a real linked worktree, and verifies the recorded delivery workspace before settlement. No production behavior or guard was weakened. Validation:
|
huangruiteng
left a comment
huangruiteng
left a comment
There was a problem hiding this comment.
动机
RFC 最终确实需要一个 Goal、两个 Agent 的 TEST ONLY canary，验证 shared coordination authority 能约束 Turn admission、lease fencing、恢复和 settlement composition。这个目标有价值，且显式环境开关、无 NoKV→file fallback、恢复时缺 guard fail-closed 都是正确的安全方向。
改动思路
本 PR 在真实 turn run-once 主路径中注入 argv/stdin authority guard：Host 前 admission，writeback/quota/completion/scheduler 前 revalidation；示例 guard 再调用 Python CoordinationAuthorityExecutor 与 file/NoKV coordination provider 执行 claim、renew、complete。测试覆盖双进程竞争、过期 reclaim、SIGKILL 与 stale fence。
具体改动
- 新增约 891 行的 Turn authority checkpoint/controller，并改造 executor settlement composition；
- 新增
authority_rejectedTurn result/journal contract； - 增加 TEST ONLY CLI 参数和环境门禁；
- 新增约 610 行 Python reference guard、约 670 行 canary，以及大规模 E2E/恢复测试；
- 对 prepared-effect resolver、terminal completion 和 scheduler 增加 authority checkpoint。
对主干的风险
这是当前 stack 的架构 blocker，不应作为 Stage 4 qualification 合入：
- 阶段越序。 RFC 要求先完成 Stage 2C local canonical promotion，再做 Stage 3 从唯一 local canonical 到远端候选的单向 shadow，之后才进入 Stage 4。当前 #3818 只提供 best-effort post-commit observation，尚未 promotion；#3819 也只是 Stage 2A provider candidate。本 PR 却以非 Draft 形式把真实 Turn 主路径登记为 Stage 4。
- 没有消费上一层的 TypeScript NoKV provider。 #3819 新增的是
NoKVAuthorityStore+ byte-only helper；本 PR 的authority_guard.py实际使用旧的 PythonCoordinationAuthorityExecutor和examples/nokv-shadow-provider/provider.py的NoKVCoordinationProvider。因此 “#3818 → #3819 → #3820” 在 authority execution 上并未真正组合，反而形成第二条 Python provider/semantic path，违背 TypeScript transaction owner 与单一 authority seam 的规划。 - canary 尚不能证明 RFC 要求的 effect safety。 README 已承认没有 arbitrary Host workspace-effect exactly-once、lease keepalive/cancellation、wake delivery/ACK。没有 keepalive/cancellation 时，长 Host 执行期间 lease 可过期并被 reclaim，旧 Host 仍可能继续产生外部 effect；因此现有成功用例不能作为 Stage 4 “外部 effect 不重复”证据。
- binding 未完整绑定 Turn identity。 reference guard 的后续 revalidation 只验证 admission receipt 与
agent_id/todo_id/lease，没有重新校验 admissionoperation_id必须由当前 request 的turn_key推导。把同一 agent/todo 的另一份有效 admission binding 代入当前 journal，后续 checkpoint 可能接受跨 Turn binding。需要 cross-Turn substitution negative test，并让 admission receipt/binding 明确覆盖 turn/effect identity。 - default-off 路径的执行效果基本保持隔离，但公共 Turn result/journal schema 已增加
authority_rejected；所以可以说“默认不启用 guard”，不能把它表述成主路径/协议完全零变化。
建议将 PR 暂时转 Draft/hold。若想保留实验价值，可以先把 canary 留在 examples/tests 中，不接入 production Turn executor；正式推进时应：
- 基于 Stage 2C promotion + Stage 3 shadow 的 canonical/provider binding；
- 直接消费 TypeScript
AuthorityStore/NoKV adapter 和同一 typed transaction boundary，不再建立 Python subprocess authority oracle； - 由 registry/service 声明 provider binding，而不是用任意 argv 充当产品 authority selector；
- 补齐 Host lease liveness/cancellation 或将 effect-owning fence 收进可恢复协议；
- 增加 cross-Turn binding substitution、长 Host 过期/reclaim、ambiguous effect reconciliation 的负向测试。
我的整体评价
这是有价值的未来 canary 原型，但规模很大、进入真实 Turn 核心，并且越过了 RFC 的两道 promotion gate。TEST ONLY 只能隔离默认用户风险，不能替代阶段顺序和单一语义 owner；当前形态应 Request changes/hold，而不是视为 Stage 4 已完成。
English verdict: Request changes and hold. This is a useful future canary prototype, but it jumps ahead of local canonical promotion and one-way remote shadow, bypasses the new TypeScript NoKV AuthorityStore through a second Python authority path, and cannot yet prove long-running Host effect safety. Rebase the design on the single typed authority boundary and bind admission receipts to the exact Turn identity before Stage 4 qualification.
f74722f to
e63f204
Compare
|
@huangruiteng #3819 has been unstacked onto I am marking #3820 Draft and keeping it on hold. It should be re-cut only after the remaining Stage 2C parity/crash/migration work, the separate local-authority promotion, and Stage 3 remote shadow parity are complete. Please do not merge this head. |
…3833) Add two open owner decisions to Section 12 in both language mirrors: whether the Stage 4 canary must hold Host lease liveness (renew during Host execution and cancel on fence loss, an effect-owning fenced commit, or a hard Host duration bound) before admission instead of leaving it as a Stage 5 hold, and how a canary Goal's authority provider is bound through a registry record instead of an argv guard selector. Both questions were raised by the review of #3820 and must be settled before that canary is re-cut. Signed-off-by: wchwawa <wch19961116@gmail.com>
|
Closing this draft. Its goal (qualifying Turn ownership against NoKV) has been overtaken by the merged TS AuthorityStore direction and the Stage 2C work in #4167, #4287 and #4358, and the 52-file diff from a 2026-09-02 base would need a rewrite rather than a rebase (#4677 lists it in the RFC-ledger conflict group). Follow-up NoKV changes will arrive as separate minimal PRs: helper routing-capability detection, the ladder gate / live-matrix extension for the NoKV |
check_rfc_ledger_entries accepted only the literal heading "Appendix A: Execution ledger", so an RFC already using Appendix A for other evidence could not adopt per-file entries without renumbering its appendices across both language files -- a mechanical diff that itself forces rework on the branches the convention exists to spare. The heading is now matched for any appendix letter, and the READMEs stop hardcoding how many RFCs carry one. shared-goal-authority-state-provider-v0 records each delivery as a dated subsection at the end of one large file, which is why loopx-project#3820, loopx-project#4061 and loopx-project#4672 all collided there per loopx-project#4677. New records move to ledger/shared-goal-authority-state-provider-v0/ as dated files with Chinese mirrors; existing dated subsections stay as append-only history. Refs loopx-project#4677 Signed-off-by: DJC1412 <108855841+DJC1412@users.noreply.github.com>
check_rfc_ledger_entries accepted only the literal heading "Appendix A: Execution ledger", so an RFC already using Appendix A for other evidence could not adopt per-file entries without renumbering its appendices across both language files -- a mechanical diff that itself forces rework on the branches the convention exists to spare. The heading is now matched for any appendix letter, and the READMEs stop hardcoding how many RFCs carry one. shared-goal-authority-state-provider-v0 records each delivery as a dated subsection at the end of one large file, which is why loopx-project#3820, loopx-project#4061 and loopx-project#4672 all collided there per loopx-project#4677. New records move to ledger/shared-goal-authority-state-provider-v0/ as dated files with Chinese mirrors; existing dated subsections stay as append-only history. Refs loopx-project#4677 Signed-off-by: DJC1412 <108855841+DJC1412@users.noreply.github.com>
check_rfc_ledger_entries accepted only the literal heading "Appendix A: Execution ledger", so an RFC already using Appendix A for other evidence could not adopt per-file entries without renumbering its appendices across both language files -- a mechanical diff that itself forces rework on the branches the convention exists to spare. The heading is now matched for any appendix letter, and the READMEs stop hardcoding how many RFCs carry one. shared-goal-authority-state-provider-v0 records each delivery as a dated subsection at the end of one large file, which is why #3820, #4061 and #4672 all collided there per #4677. New records move to ledger/shared-goal-authority-state-provider-v0/ as dated files with Chinese mirrors; existing dated subsections stay as append-only history. Refs #4677 Signed-off-by: DJC1412 <108855841+DJC1412@users.noreply.github.com>
2 participants
Summary
LOOPX_SHARED_AUTHORITY_TEST_ONLY=1switch.@huangruiteng This is PR 3 of the stack and remains a Stage 4 TEST ONLY qualification surface.
Stack: #3818 -> #3819 -> this PR.
Issue Or Task
Validation
npm run typecheck:control-plane; Ruff check/format; diff checkloopx canary premerge --from-git-diff --git-diff-base codex/stage4-authority-canary(18/18 selected checks, no warnings or holds)mainwas read-only; its full Rust workspace tests and clippy passed at the qualified revisionSupplementary EchoJournal/Codex rehearsal was not used as merge evidence: three NoKV authority races each admitted exactly one CLI identity, but the sole winner stopped at Codex CLI authentication/compatibility. This PR therefore does not claim a completed real-model chain.
Type of Change
LoopX Area
Technical Direction
Core control-plane hardening
Shared Goal Authority and cross-host coordination
Target base branch:
codex/stage4-authority-canaryDirection tracker or promotion unit: Stage 4 TEST ONLY Turn/provider qualification
Scheduler evaluation/projection is covered; wake delivery and ACK are not. Inbox is only an urgency signal and cannot grant authority. Production promotion still requires an effect-owning fenced commit for arbitrary Host mutations plus lease keepalive/cancellation; this stack does not weaken those Stage 5 holds.
Boundary Checklist
.loopx/,.codex/goals/, liveACTIVE_GOAL_STATE.md, credentials, private benchmark traces, verifier output, raw agent sessions, internal document links, or local machine paths.Signed-off-bytrailer (git commit -s).