chore(release): prepare v0.5.4

[huangruiteng]

LoopX v0.5.4

At a Glance

Typed control-plane transactions, governed workflow completion, and safer host integrations for long-running Agent work.

Upgrade

Existing installs upgrade explicitly; fresh installs use the package-native path in ## Install / Update below.

loopx update check
loopx update apply
loopx --version && loopx doctor

Highlights

• More Todo, task-lease, quota, scheduler, Vision, and replan transactions now have one typed TypeScript owner, with replay and terminal settlement guarded by durable receipts. (#3702, #3715, #3720, #3724, #3832, #3840)
• Periodic Report now follows the durable post-writeback lifecycle through trigger, generation, review, approval, incremental delivery, and normalized readback; background work and external delivery remain explicit opt-ins. (#3691, #3748, #3749, #3750, #3751, #3754, #3755, #3757, #3857)
• The DSH plugin is one-step ready: it installs a private LoopX runtime and packaged skills before publishing readiness, while activation remains exact-Session and evidence-gated. (#3725, #3784, #3822)
• Personal Workspace, Chat, and Lark paths recover more reliably: Remote SSH uses the same-origin status source, Goal stop feedback is immediate, healthy Chat resumes return to ready, and collector routes gain preview/apply/readback. (#3732, #3745, #3773, #3816, #3817, #3855, #3858)
• Benchmark Toolkit adds public-safe study manifests, idempotent local upload simulation, dashboard projection, TraeX evidence reduction, and bounded continuation decisions without granting runner, score, network, or publication authority. (#3776, #3779, #3812, #3846, #3849, #3850)
• loopx todo list --thin provides a bounded projection without changing default list behavior, selection, ordering, quota, or lifecycle semantics. (#3679)

Replan Fixes

• Agent-lane continuation now prefers the selected Todo over shared Next Action prose, so one Agent does not inherit another lane's stale instruction. (#3693)
• Typed blocker and read-only autonomous replan outcomes now settle rather than leaving an ambiguous open turn. (#3734, #3746)
• Delayed scheduler ACKs remain attributable after autonomous replan, and semantic replans are fenced by the exact Turn guard. (#3742, #3840)

Contributors

This release includes work from @AetherX-Technologies, @Alicecooo, @BouwenZhou, @bubble66, @cocolord, @Danceiny, @Duang777, @hhyykk, @Jarad-z, @LIHUA919, @MohammedThowfiq, @NIU-123370, @now-ing, @ObVious55, @songoow, @steven-kid, @wchwawa, @xiaods, @yuefengw, and @zyaiire. Concrete attribution and first-time contributor highlights appear in ## Community Contributors.

Release Decision

Who should upgrade: Operators running long-lived Goals, periodic reports, Personal Workspace over Remote SSH, DSH, Lark collectors, or Benchmark Toolkit workflows should upgrade; users unaffected by those paths can remain on v0.5.3 until their normal maintenance window.

What this release solves: It removes split ownership from more control-plane transactions, closes replan and scheduler settlement gaps, completes governed report delivery, and makes optional host and research workflows easier to activate and verify safely.

Breaking changes: No. Existing local Goal, Todo, registry, and event state remain compatible; the dashboard's default status source is restored to same-origin, while shared-authority providers and every external-write workflow remain staged or opt-in rather than becoming a new default.

How to verify: After upgrading, package identity must report 0.5.4, doctor must complete for the active install owner, and the focused command for any enabled optional surface must return its documented typed readback.

Contributors: Maintainer @huangruiteng prepared the release with the 20 community contributors named in ## Community Contributors.

loopx --version
loopx doctor
loopx todo list --thin --format json

State Kernel & Control Plane

The transaction-payoff phase moves complete behavior slices behind typed TypeScript owners instead of adding parallel helpers. Native task-lease acquire and lifecycle, host Todo settlement, Vision refresh, monitor-poll and void quota commits, scheduler follow-up, capability lifecycle validation, and settlement readback now share typed decisions, fenced effects, and replay receipts. (#3702, #3704, #3706, #3714, #3715, #3720, #3723, #3724, #3832)

Shared Control-Plane Authority gains a provider-neutral store contract and staged file, PostgreSQL, and NoKV candidates with CAS, lease fencing, idempotent settlement, ambiguous-commit recovery, tenant isolation, and conformance coverage. These providers are not the default runtime authority in v0.5.4; local Markdown/file projections remain authoritative until the RFC's separately reviewed promotion stages. (#3669, #3798, #3806, #3807, #3802, #3819, #3833, #3839)

Capabilities & Workflows

Periodic Report now turns committed completion facts into an intent-only post-writeback hook, consumes that intent through the governed generation/review path, reopens rejected drafts, records the actual work interval, publishes approved incremental progress through the enabled Goal Channel Bot, and verifies normalized delivery readback. It does not infer sink authority from a profile or report intent. (#3691, #3748, #3749, #3750, #3751, #3754, #3755, #3757, #3857)

Personal Workspace preserves startup error context, uses /status.json through the same-origin Vite proxy by default, projects completed Todo progress, makes Goal stop feedback immediate, and self-heals owned stale listeners across legacy and current launchers. Chat avoids closing sessions with pending turns and restores ready state after a healthy resume. (#3561, #3732, #3745, #3772, #3773, #3814, #3855, #3858)

Quality & Testing

The release pipeline now treats PyPI publication as a verified outcome: it builds wheel and sdist, publishes through Trusted Publishing, then installs the exact version from PyPI in a clean environment and checks loopx --version. Frontstage CI and public smoke boundaries are isolated more precisely, installed-runtime doctor checks vary by install kind, and release qualification can use the explicitly allowlisted doubao-seed-evolving rolling model alias while binding its receipt to the exact commit and observation time. (#3728, #3736, #3740, #3797)

Benchmarks & Integrations

The DSH plugin now bootstraps its private LoopX runtime and skills before readiness, then activates continuation only from typed evidence in the exact Session. Lark adds bounded new-message catch-up, safe collector-route reconciliation, structured mentions, and fresh-versus-recovery inbox reads. Codex provider routing adds Luna, Standard/Fast selector contracts, bounded account traversal, and a public-safe heartbeat transport diagnostic. (#3725, #3733, #3737, #3741, #3816, #3817, #3822, #3845, #3848, #3853)

Benchmark Toolkit adds reproducible study metadata, public-safe transport envelopes, a no-network local provider simulation, dashboard projections, TraeX evidence reduction, and bounded continuation decisions. The SWE-Marathon report and harness publish one reproducible 75-trial comparison in which LoopX Turn materially outperformed Codex /goal; the other treatment-arm differences are presented as study observations, not generalized product uplift. No release command launches a benchmark or uploads a result by default. (#3776, #3779, #3812, #3838, #3841, #3846, #3849, #3850)

Documentation & Compatibility

The release adds planner-worker guidance, hosted-doc navigation and locale parity, atomic-promotion failure guidance, reward-memory and governance walkthroughs, an Obelisk bounded-Replan-history RFC, and a shared-goal-alignment RFC. Default Todo listing remains unchanged unless --thin is supplied; same-origin Dashboard status fixes both local and Remote SSH use; optional extensions do not grant provider credentials or external-write authority; and no persisted-state migration is required. (#3630, #3632, #3633, #3657, #3659, #3679, #3793, #3810, #3837)

Community Contributors

• First-time contributor @AetherX-Technologies moved fenced journal recovery and terminal-writeback semantics into the typed settlement boundary (#3074).
• @Alicecooo hardened TypeScript Todo projection and settlement readback (#3688, #3723).
• First-time contributor @BouwenZhou contributed the SWE-Marathon five-arm report and reproducible harness (#3838).
• First-time contributor @bubble66 restored projected Goal progress in Personal Workspace (#3561).
• @cocolord contributed delivery verification, benchmark lifecycle and TraeX contracts, DSH readiness, and Frontstage CI isolation (#3558, #3565, #3725, #3728, #3776, #3779).
• First-time contributor @Danceiny repaired scheduler and autonomous-replan settlement paths (#3729, #3742).
• @Duang777 hardened provider routing, settlement facades, periodic reports, Chat lifecycle, CLI performance, and effect-runtime behavior (#3667, #3709, #3714, #3752, #3772, #3773, #3803, #3825).
• First-time contributor @hhyykk migrated task-lease, scheduler, Vision, Todo, quota, capability validation, and CLI ownership slices into typed boundaries (#3702, #3704, #3705, #3706, #3715, #3717, #3720, #3724, #3726, #3832).
• @Jarad-z improved install and activation recovery documentation (#3810).
• @LIHUA919 added the bounded Todo list projection and fixed Agent-scoped cadence advisory behavior (#3679, #3843).
• First-time contributor @MohammedThowfiq repaired governance links to their canonical policies (#3851).
• @NIU-123370 strengthened public documentation and compatibility coverage (#3603).
• @now-ing improved Dashboard progress, Periodic Report hooks, and selected-Todo-aware replan projection (#3689, #3690, #3691, #3693).
• @ObVious55 unified Turn recovery on journal inspection (#3719).
• First-time contributor @songoow improved installed-runtime doctor checks, DSH host failures, and runtime boundaries (#3736, #3771, #3822).
• @steven-kid refined Desktop workspace language and host experience (#3594).
• @wchwawa established provider-neutral shared-authority foundations and NoKV stage decisions (#3669, #3802, #3819, #3833).
• @xiaods fixed the Lark CLI environment boundary (#3738).
• @yuefengw migrated local task-lease lifecycle into its native TypeScript transaction owner (#3806).
• First-time contributor @zyaiire contributed the planner-worker guide, hosted-doc parity, atomic-promotion guidance, public-smoke fixes, reward-memory and governance walkthroughs, and host parity coverage (#3630, #3631, #3632, #3633, #3650, #3651, #3653, #3654, #3655, #3657, #3658, #3659, #3661, #3662, #3663).

Optional Capability Activation & Use

DSH Native LoopX Plugin

Activation: Install the versioned plugin in the DSH web profile and start DSH; one exact Session activates continuation only after a typed loopx skill invocation.

Validation: Resolve the live DSH Session and require one exact status=bound Goal/Agent pair.

Disable / rollback: Remove dsh-loopx-plugin from the web profile and restart DSH.

Authority boundary: Installation grants no model-provider credential, Goal binding, Todo, quota, or external-write authority; the plugin's HTTP carrier remains loopback-only.

Docs: https://github.com/huangruiteng/loopx/blob/v0.5.4/packages/dsh-loopx-plugin/README.md

dsh plugin --profile web add "https://github.com/huangruiteng/loopx/releases/download/dsh-loopx-plugin-v0.1.1-beta.3/dsh-loopx-plugin-0.1.1-beta.3.tgz"
dsh --profile web --port 0
loopx --registry .loopx/registry.json --format json resolve-agent-thread --host-surface deepseek-harness-native --thread-id "$DSH_SESSION_ID"
dsh plugin --profile web remove dsh-loopx-plugin

Periodic Report Governed Lifecycle

Activation: An explicit request to generate the current project report activates one provider-free run; unattended reports additionally require an enabled project profile and a matching host Automation.

Validation: Inspect the built-in weekly profile and require active=true, generation_allowed=true, and no external-write grant.

Disable / rollback: Stop requesting one-shot reports; for scheduled runs, pause the host Automation and set the project profile's enabled field to false.

Authority boundary: A trigger or generated artifact grants no archive, Lark delivery, provider credential, or publication authority; every sink remains independently enabled, approved, and read back.

Docs: https://github.com/huangruiteng/loopx/blob/v0.5.4/loopx/capabilities/periodic_report/README.md

loopx periodic-report inspect-profile --preset weekly --format json
loopx periodic-report --help

Benchmark Toolkit Study and TraeX Contracts

Activation: Invoke the explicit loopx benchmark subcommand for a public-safe manifest, envelope, local simulation, TraeX observation, or bounded continuation decision; preview is the default.

Validation: Validate the study manifest, preview the local transport, and read back only after an explicit --execute to a caller-selected simulation store.

Disable / rollback: Omit --execute; there is no resident service or global enablement. A caller that executed against a simulation store owns retaining or replacing that local test artifact.

Authority boundary: These commands grant no runner, model, task-source, credential, network, score, upload, submission, or publication authority, and raw tasks or trajectories have no upload schema slot.

Docs: https://github.com/huangruiteng/loopx/blob/v0.5.4/loopx/capabilities/benchmark_toolkit/README.md

loopx benchmark study-validate --manifest-json "$STUDY_MANIFEST" --format json
loopx benchmark upload-local --envelope-json "$UPLOAD_ENVELOPE" --store "$SIMULATION_STORE" --format json
loopx benchmark continuation-decision --help

Lark Dynamic Collector Routes

Activation: Install and doctor the bundled Lark extension, preview one additive collector route, then repeat with --execute after reviewing the exact inputs.

Validation: Repeat the same request and require the typed already_applied zero-write result; restart or reinstall the collector separately and verify runtime readback before treating the route as live.

Disable / rollback: Disable or roll back the loopx-lark extension; route removal is a separate owner-authorized lifecycle operation.

Authority boundary: Route reconciliation grants no chat membership, Bot scopes, credentials, runtime reload, message send, route removal, or rebind authority.

Docs: https://github.com/huangruiteng/loopx/blob/v0.5.4/loopx/extensions/lark/README.md

loopx extension install --bundled loopx-lark --execute --format json
loopx extension doctor loopx-lark --execute --format json
loopx lark-inbox collector-route-reconcile --project . --config "$COLLECTOR_CONFIG" --route-key "$ROUTE_KEY" --chat-id "$CHAT_ID" --event-inbox-config "$INBOX_CONFIG"
loopx extension disable loopx-lark --execute --format json

Codex Provider Routing Qualification

Activation: Install the co-located extension package, register its manifest explicitly, and run only content-free catalog, selector, runtime, or heartbeat qualification inputs.

Validation: Doctor the enabled extension and run the versioned public example through its managed lifecycle.

Disable / rollback: Disable or roll back loopx-codex-provider-routing; restore the operator-owned CPA/App configuration independently.

Authority boundary: The extension reads no credentials or prompts and grants no CPA installation, account access, routing mutation, App restart, config write, or model-provider authority.

Docs: https://github.com/huangruiteng/loopx/blob/v0.5.4/packages/loopx-codex-provider-routing/README.md

python3 -m pip install packages/loopx-codex-provider-routing
loopx extension install --manifest packages/loopx-codex-provider-routing/extension.toml --execute --format json
loopx extension doctor loopx-codex-provider-routing --execute --format json
loopx extension run loopx-codex-provider-routing --input-json packages/loopx-codex-provider-routing/examples/heartbeat-transport.json --execute --format json
loopx extension disable loopx-codex-provider-routing --execute --format json

Install / Update

New PyPI users and existing PyPI users use the same package-native path:

python3 -m pip install --upgrade loopx
loopx workflow-skills --install
loopx slash-commands --install
loopx doctor

All existing installs use explicit update intent; the command preserves the active pip, pipx, or archive owner:

loopx update check
loopx update plan
loopx update apply
loopx doctor

中文摘要

LoopX v0.5.4 将更多长程 Agent 控制面事务收敛到 typed TypeScript owner，补齐受治理工作流，并强化可验证、可回退的 Host 集成。

• Todo、task-lease、quota、scheduler、Vision 与 replan 的更多完整事务已迁入单一 TypeScript 语义权威；
• Periodic Report 打通 post-writeback trigger、生成、审核、批准、投递与规范化读回，后台执行和外部写入仍需显式授权；
• DSH 插件可在 ready 前完成私有 LoopX runtime 与 skills 引导，且只在精确 Session 出现 typed activation evidence 后自动续跑；
• Dashboard 默认恢复同源 /status.json，同时加强 Chat、Lark collector 与 listener 自愈；
• Benchmark Toolkit 新增 study manifest、本地无网络 upload simulation、dashboard projection、TraeX evidence 与有界 continuation；默认不启动 benchmark，也不上传结果；
• loopx todo list --thin 是显式有界投影，不改变默认 list 行为。

Replan 方面，Agent lane 会优先使用 selected Todo，typed blocker 与只读 autonomous replan 可闭环 settlement，delayed scheduler ACK 与 semantic replan 均绑定精确 Turn guard。

本版本包含 @AetherX-Technologies、@Alicecooo、@BouwenZhou、@bubble66、@cocolord、@Danceiny、@Duang777、@hhyykk、@Jarad-z、@LIHUA919、@MohammedThowfiq、@NIU-123370、@now-ing、@ObVious55、@songoow、@steven-kid、@wchwawa、@xiaods、@yuefengw 与 @zyaiire 的贡献；具体归因见下方“社区贡献者”。

升级决策

**谁需要升级：**运行长程 Goal、Periodic Report、Remote SSH Personal Workspace、DSH、Lark collector 或 Benchmark Toolkit 工作流的 operator 建议升级；未涉及这些路径的用户可按正常维护窗口从 v0.5.3 升级。

**解决了什么：**本版本继续消除控制面事务的双重语义 owner，修复 replan 与 scheduler settlement 缺口，补齐受治理报告投递，并让可选 Host 和研究工作流更容易安全启用、验证与回退。

**是否有破坏性变更：**无。已有本地 Goal、Todo、registry 与 event 状态保持兼容；Dashboard 默认状态源恢复为同源路径，shared-authority providers 与所有外部写入工作流仍是 staged 或 opt-in，不会成为新默认。

**如何验证：**升级后 package identity 应为 0.5.4，doctor 应针对当前安装 owner 完成；启用任一可选 surface 时，再运行其下方 focused readback 命令。

**贡献者：**Maintainer @huangruiteng 与“社区贡献者”一节列出的 20 位贡献者共同完成本版本。

loopx --version
loopx doctor
loopx todo list --thin --format json

状态内核与控制面

Native task-lease acquire/lifecycle、host Todo settlement、Vision refresh、monitor-poll 与 void quota commit、scheduler follow-up、capability lifecycle validation 和 settlement readback 进一步迁入 typed TypeScript transaction owner。Shared Control-Plane Authority 同时形成 provider-neutral contract、staged file/PostgreSQL/NoKV candidates，并补上 PostgreSQL tenant isolation；但 v0.5.4 不切换默认权威源，仍须经过 RFC 规定的独立 promotion 阶段。

能力与工作流

Periodic Report 已从 durable post-writeback facts 连到 generation/review/approval/delivery/readback，且 sink authority 不能从 profile 或 intent 隐式继承。Personal Workspace 修复 Remote SSH 同源 status、进度投影、Goal stop 即时反馈和 owned listener 自愈；Chat 的 pending-turn close 与 healthy resume 也得到修复。

质量与测试

Release workflow 会构建 wheel/sdist、通过 Trusted Publishing 发布 PyPI，再在干净环境从 PyPI 安装精确版本并验证 loopx --version。本版本还改进 Frontstage/public smoke 隔离、按 install kind 的 doctor deep checks，并允许 exact-commit model-behaviour qualification 显式选择 doubao-seed-evolving；该 receipt 只证明运行时刻观察到的 rolling alias，不声称 immutable model revision。

基准与集成

DSH、Lark 与 Codex provider-routing 获得更完整的 activation/readback/failure contracts。Benchmark Toolkit 提供 public-safe study/transport/dashboard/TraeX/continuation contracts；SWE-Marathon 75-trial 研究中 LoopX Turn 显著优于 Codex /goal，其余 treatment arm 差异作为该研究的观察保留，不泛化成稳定产品 uplift。默认不启动或上传 benchmark。

文档与兼容性

新增 planner-worker、hosted-doc parity、atomic promotion、reward-memory、governance、Obelisk bounded Replan history 与 shared Goal alignment 资料。默认 Todo list 不变；Dashboard 同源状态源覆盖本机与 Remote SSH；可选 extension 不继承 provider credential 或外部写入权限；无需迁移持久状态。

社区贡献者

• 首次贡献者 @AetherX-Technologies 将 fenced journal recovery 与 terminal writeback 语义迁入 typed settlement 边界（#3074）。
• @Alicecooo 强化 TypeScript Todo projection 与 settlement readback（#3688、#3723）。
• 首次贡献者 @BouwenZhou 贡献 SWE-Marathon 五臂报告与可复现 harness（#3838）。
• 首次贡献者 @bubble66 修复 Personal Workspace 的 Goal progress 投影（#3561）。
• @cocolord 贡献 delivery verification、benchmark lifecycle/TraeX contracts、DSH readiness 与 Frontstage CI isolation（#3558、#3565、#3725、#3728、#3776、#3779）。
• 首次贡献者 @Danceiny 修复 scheduler 与 autonomous-replan settlement（#3729、#3742）。
• @Duang777 强化 provider routing、settlement facade、Periodic Report、Chat lifecycle、CLI performance 与 effect runtime（#3667、#3709、#3714、#3752、#3772、#3773、#3803、#3825）。
• 首次贡献者 @hhyykk 将 task-lease、scheduler、Vision、Todo、quota、capability validation 与 CLI ownership 切片迁入 typed boundary（#3702、#3704、#3705、#3706、#3715、#3717、#3720、#3724、#3726、#3832）。
• @Jarad-z 完善安装与 activation recovery 文档（#3810）。
• @LIHUA919 增加 bounded Todo list projection，并修复 Agent-scoped cadence advisory（#3679、#3843）。
• 首次贡献者 @MohammedThowfiq 修复 governance 到 canonical policies 的链接（#3851）。
• @NIU-123370 强化公开文档与 compatibility coverage（#3603）。
• @now-ing 改进 Dashboard progress、Periodic Report hooks 与 selected-Todo-aware replan projection（#3689、#3690、#3691、#3693）。
• @ObVious55 将 Turn recovery 统一到 journal inspection（#3719）。
• 首次贡献者 @songoow 改进 installed-runtime doctor、DSH host failure 与 runtime boundary（#3736、#3771、#3822）。
• @steven-kid 优化 Desktop workspace language 与 Host 体验（#3594）。
• @wchwawa 建立 provider-neutral shared-authority 基础与 NoKV stage decisions（#3669、#3802、#3819、#3833）。
• @xiaods 修复 Lark CLI environment boundary（#3738）。
• @yuefengw 将 local task-lease lifecycle 迁入 native TypeScript transaction owner（#3806）。
• 首次贡献者 @zyaiire 贡献 planner-worker guide、hosted-doc parity、atomic-promotion guidance、public-smoke fixes、reward-memory/governance walkthroughs 与 Host parity coverage（#3630、#3631、#3632、#3633、#3650、#3651、#3653、#3654、#3655、#3657、#3658、#3659、#3661、#3662、#3663）。

可选能力启用与使用

DSH Native LoopX Plugin

**启用：**把版本化插件安装进 DSH web profile 并启动 DSH；只有精确 Session 出现 typed loopx skill invocation 后才激活自动续跑。

**验证：**解析当前 DSH Session，要求唯一 status=bound Goal/Agent pair。

**停用 / 回退：**从 web profile 移除 dsh-loopx-plugin 并重启 DSH。

**权限边界：**安装不会授予模型凭证、Goal binding、Todo、quota 或外部写入权限；HTTP carrier 仅限 loopback。

**文档：**https://github.com/huangruiteng/loopx/blob/v0.5.4/packages/dsh-loopx-plugin/README.md

dsh plugin --profile web add "https://github.com/huangruiteng/loopx/releases/download/dsh-loopx-plugin-v0.1.1-beta.3/dsh-loopx-plugin-0.1.1-beta.3.tgz"
dsh --profile web --port 0
loopx --registry .loopx/registry.json --format json resolve-agent-thread --host-surface deepseek-harness-native --thread-id "$DSH_SESSION_ID"
dsh plugin --profile web remove dsh-loopx-plugin

Periodic Report Governed Lifecycle

**启用：**显式要求生成当前项目报告可激活一次 provider-free run；无人值守报告还需 enabled project profile 与匹配的 host Automation。

**验证：**检查内置 weekly profile，要求 active=true、generation_allowed=true，且没有 external-write grant。

**停用 / 回退：**停止发起一次性报告；定时路径需暂停 host Automation，并把项目 profile 的 enabled 设为 false。

**权限边界：**trigger 或 artifact 不授予 archive、Lark delivery、provider credential 或 publication 权限；每个 sink 必须独立启用、批准并读回。

**文档：**https://github.com/huangruiteng/loopx/blob/v0.5.4/loopx/capabilities/periodic_report/README.md

loopx periodic-report inspect-profile --preset weekly --format json
loopx periodic-report --help

Benchmark Toolkit Study and TraeX Contracts

**启用：**对 public-safe manifest、envelope、本地 simulation、TraeX observation 或 bounded continuation 显式调用对应 loopx benchmark 子命令；默认只 preview。

**验证：**先验证 study manifest，再 preview 本地 transport；只有对 caller-selected simulation store 显式 --execute 后才执行 readback。

**停用 / 回退：**不传 --execute 即保持只读；不存在 resident service 或全局开关，已执行的 simulation artifact 由 caller 管理。

**权限边界：**不授予 runner、model、task source、credential、network、score、upload、submission 或 publication 权限；raw task/trajectory 不在 upload schema 中。

**文档：**https://github.com/huangruiteng/loopx/blob/v0.5.4/loopx/capabilities/benchmark_toolkit/README.md

loopx benchmark study-validate --manifest-json "$STUDY_MANIFEST" --format json
loopx benchmark upload-local --envelope-json "$UPLOAD_ENVELOPE" --store "$SIMULATION_STORE" --format json
loopx benchmark continuation-decision --help

Lark Dynamic Collector Routes

**启用：**安装并 doctor bundled Lark extension，先 preview additive collector route，再在核对输入后以 --execute 应用。

**验证：**重复同一请求并要求 typed already_applied zero-write 结果；另行重启或重装 collector 并验证 runtime readback 后，才能视为 live。

**停用 / 回退：**disable 或 rollback loopx-lark extension；route removal 是独立的 owner-authorized lifecycle operation。

**权限边界：**route reconcile 不授予群成员身份、Bot scope、credential、runtime reload、消息发送、route 删除或 rebind 权限。

**文档：**https://github.com/huangruiteng/loopx/blob/v0.5.4/loopx/extensions/lark/README.md

loopx extension install --bundled loopx-lark --execute --format json
loopx extension doctor loopx-lark --execute --format json
loopx lark-inbox collector-route-reconcile --project . --config "$COLLECTOR_CONFIG" --route-key "$ROUTE_KEY" --chat-id "$CHAT_ID" --event-inbox-config "$INBOX_CONFIG"
loopx extension disable loopx-lark --execute --format json

Codex Provider Routing Qualification

**启用：**安装 co-located extension package，显式注册 manifest，并只提交 content-free catalog、selector、runtime 或 heartbeat qualification input。

**验证：**doctor enabled extension，并通过 managed lifecycle 运行版本化 public example。

**停用 / 回退：**disable 或 rollback loopx-codex-provider-routing；CPA/App 配置由 operator 独立恢复。

**权限边界：**extension 不读取 credential 或 prompt，也不授予 CPA 安装、账号访问、routing mutation、App restart、config write 或模型 Provider 权限。

**文档：**https://github.com/huangruiteng/loopx/blob/v0.5.4/packages/loopx-codex-provider-routing/README.md

python3 -m pip install packages/loopx-codex-provider-routing
loopx extension install --manifest packages/loopx-codex-provider-routing/extension.toml --execute --format json
loopx extension doctor loopx-codex-provider-routing --execute --format json
loopx extension run loopx-codex-provider-routing --input-json packages/loopx-codex-provider-routing/examples/heartbeat-transport.json --execute --format json
loopx extension disable loopx-codex-provider-routing --execute --format json

发布验证

• Package version and public tag: 0.5.4 / v0.5.4.
• Tag target: TARGET_COMMIT_SHA.
• Exact-commit Python, TypeScript, release, install/update, public/private, premerge, and Doubao Evolving model-behaviour qualification passed with failures and skips reported in the final release receipt.
• GitHub Release assets and PyPI wheel/sdist are verified remotely after publication; a clean environment installs loopx==0.5.4 from PyPI and reads back loopx --version plus loopx doctor.

Compare: v0.5.3...v0.5.4

[huangruiteng]

No blocking findings in the exact release diff.

Product / architecture judgment

• Motivation: publish one coherent v0.5.4 boundary for the typed control-plane, governed workflow, host-integration, and release-reliability work already merged since v0.5.3.
• Solved: the diff keeps runtime scope narrow—an explicit Doubao Evolving allowlist plus shared quota-first actor guidance—and updates package/book/release baselines without introducing a second decision owner.
• User impact: release qualification can exercise the actual rolling model alias, and users receive aligned package identity and bilingual versioned documentation.
• Main risk: release artifacts, the final tag target, stable, and PyPI must all resolve to the eventual merge commit; this PR does not itself claim those publication effects are complete.
• Design: the provider allowlist and quota-first instruction are each single-sourced and reused across actors. The bounded future-facing pass found no justified adjacent TypeScript refactor in this release-only diff.

Exact-head validation (92831854efc758c614fcfc173cf0451e3eb68144)

• Python: 5,211 passed, 12 declared skips, 0 failures; Ruff clean; strict mypy clean.
• TypeScript: 456 tests, 455 passed, one PostgreSQL integration environment-gated skip; typecheck passed.
• Full public fleet: 510/510 passed, 0 failures, 0 timeouts, no tracked side effects.
• Model behavior: doubao-seed-evolving, 19 scenarios × 2 repeats = 38 calls, 4/4 contrasts passed, 0 failures, 0 skips.
• Package: wheel and sdist passed Twine metadata, checksum, clean Python 3.11 installation, loopx --version, Effect runtime, workflow-skill install/readback/uninstall, and doctor --deep.
• Public boundary: 187 files scanned, 0 violations.
• Change Quality: receipt cqr_5ac122bdc305e72ef7db, exact scope valid, 0 blockers/warnings/advisories, one bounded safe fix recorded.
• Premerge: 18 selected checks passed, 0 failures, 0 manual holds; self-merge eligible after required GitHub checks complete.

Merge decision: hold only for required GitHub CI. After merge, the eventual merge commit will be requalified from scratch before tagging, moving stable, publishing the GitHub Release, and accepting PyPI as complete.