feat(reliability-diagnostics): compare harnesses and expose combined readback

docs/architecture/rfcs/desktop-execution-frontends-v0.md

@@ -452,6 +452,11 @@ disconnected and does not silently launch a managed runtime.
 
 ## Mode B: Managed Agent Runtime
 
+The [DSH/Pi assessment](./harness-selection-dsh-pi-v0.md) separates the first
+passive event source from managed-runtime selection and defines the remaining
+lifecycle, readback and measurement gates. Combined diagnostic CLI readback is
+available; the managed panel and supervisor are not delivered by that increment.
+
 ### Product flow
 
 The managed desktop path is end to end:

docs/architecture/rfcs/desktop-execution-frontends-v0.zh-CN.md

@@ -380,6 +380,10 @@ Agent 进程或第二个上游会话。
 
 ## 模式 B：托管 Agent 运行时
 
+[DSH/Pi 评估](./harness-selection-dsh-pi-v0.zh-CN.md) 区分首个被动事件源与 managed runtime
+选型，列出生命周期、读取及测量门槛。诊断 CLI 已支持组合读取，但这个增量不交付
+managed 面板或 supervisor。
+
 ### 产品流程
 
 托管桌面路径是端到端的：

docs/architecture/rfcs/harness-selection-dsh-pi-v0.md

@@ -0,0 +1,146 @@
+# DSH / Pi: L1 Observation and Managed Runtime Selection
+
+Status: evidence-backed implementation assessment, not a runtime promotion.
+Scope: the shared goals of [Reliability Diagnostics](./long-running-agent-reliability-diagnostics-governed-delivery-v0.md)
+and [Desktop Execution Frontends](./desktop-execution-frontends-v0.md).
+[中文](./harness-selection-dsh-pi-v0.zh-CN.md)
+
+## Decision
+
+Keep **DSH as the first L1 event source**. Do not infer that DSH is already the
+preferred production Mode B runtime. Retain Pi as a managed-runtime candidate.
+The first choice minimizes the cost of qualifying an existing passive observer;
+the second requires lifecycle, provider, crash-recovery and outcome evidence
+that a plugin event fixture cannot supply. No quantitative winner is claimed.
+
+## Evidence Baseline
+
+LoopX was inspected at `bf217e1e01bec79f357c9ecbd580cf2dfa73db8b`.
+The implementation paths below are repository-relative:
+
+- `packages/dsh-loopx-plugin/src/observer.ts`: pinned activation, session event
+  compaction, first-append safety, bounded buffering and flush isolation.
+- `loopx/capabilities/reliability_diagnostics/{receipt,projection}.py`: independent
+  validation, integrity classification and authority-free diagnostic readback.
+- `loopx/dsh_goal_mode/turn_host_adapter.py`: a bounded Turn connector, opaque
+  session lineage, SDK calls and failure translation, not a desktop outer loop.
+- `loopx/pi_goal_mode/{loopx-goal.ts,pi-goal-loop-runtime.mjs}`: a visible-host
+  integration with bindings and continuation behavior; not a passive observer.
+- `apps/desktop/loopx-control-plane/src-tauri/src/services.rs`: service process
+  management must not be mistaken for the complete managed Agent lifecycle.
+
+Upstream references were inspected on 2026-09-06, pinned independently of the
+versions validated by LoopX:
+
+- [DSH README at d347e703](https://github.com/deepseek-ai/deepseek-harness/blob/d347e703908d0406b7a7ef80e3a0e594d86b2215/README.md):
+  Cordis/plugin architecture and explicit developer-preview compatibility risk.
+- [Pi SDK at 9767ba27](https://github.com/earendil-works/pi/blob/9767ba275f3e9a5ee0f5c5342249b629ab1b2282/packages/coding-agent/docs/sdk.md):
+  event subscription, session operations and runtime replacement APIs.
+- [Pi extensions at 9767ba27](https://github.com/earendil-works/pi/blob/9767ba275f3e9a5ee0f5c5342249b629ab1b2282/packages/coding-agent/docs/extensions.md):
+  event hooks with context-injection, tool-blocking and result-modification power.
+
+The historical Pi repository URL now redirects to `earendil-works/pi`; the
+inspected SDK uses `@earendil-works/pi-coding-agent`. This is an upgrade-check
+input, not permission to replace LoopX's installed package or assume API parity.
+
+## Comparison by Product Requirement
+
+| Requirement | DSH evidence | Pi evidence | Selection consequence |
+| --- | --- | --- | --- |
+| Passive observation | LoopX ships a separate observer entry, three session publication hooks and pre-append rejection | SDK offers `session.subscribe`; extensions also offer interception hooks | DSH has a qualified contract slice; a Pi adapter must choose subscription over intervention and prove isolation |
+| Session identity / resume | Existing Turn connector derives session lineage; observer separately requires exact goal/session/run identity | SDK separates AgentSession from AgentSessionRuntime replacement/resume operations | Test identity after restart/fork for each adapter; method availability is not durable recovery proof |
+| One bounded attempt | LoopX already has a DSH Turn host with timeout and failure mapping | Existing Pi goal mode includes continuation and pause behavior | Neither native loop may silently become the Desktop scheduler; avoid two outer loops |
+| Packaging | Dedicated observer export/bundle and packed smokes exist | Extension discovery is part of SDK resource loading | Verify the actually loaded package/profile, not just source imports; neither boundary is OS isolation |
+| Provider profiles | SDK connector/version constraints are explicit | SDK exposes runtime/model construction | Qualify the same route, model, tools and budget; harness choice does not establish provider compatibility |
+| Public safety | Producer and Python consumer independently validate; shared counterfactuals exist | Tool/context hooks can expose or change raw content | A Pi observer needs first-append redaction and negative fixtures, not transcript copying |
+| Performance | Buffer/count/flush accounting exists; no matched real overhead result established here | Subscription is available; no LoopX observer measurement established here | Reject numeric rankings until identical workloads and revisions are measured |
+| Maintenance | DSH upstream explicitly warns of breaking changes; LoopX pins its validated connector surface | Current upstream package/runtime APIs differ from historical integration assumptions | Pin upgrades separately; do not compare an installed DSH against an unqualified latest Pi |
+
+These are integration-cost and contract observations, not claims that Pi lacks
+events or DSH cannot support other models. Both expose control-capable APIs;
+passivity is a property of the selected adapter and its loaded dependencies.
+
+## Data and Authority Flow
+
+The operator needs to distinguish missing evidence, unhealthy execution and
+an invalid observation treatment before deciding what to do:
+
+```text
+native session publication
+  -> isolated observer: compact, validate, count, append
+  -> independent ledger validation
+  -> integrity receipt + diagnostic projection
+  -> operator presentation only
+
+canonical eligibility -> Desktop supervisor -> bounded Turn -> validation/writeback
+```
+
+There is no arrow from diagnostics back to eligibility. `valid` means the
+observation contract passed, not that a task succeeded. A stall signal is not
+permission to retry. Observer errors must not become worker failures.
+
+## Implemented Readback Increment
+
+The existing CLI now supports an explicit combined read:
+
+```bash
+loopx reliability-diagnostics status --goal-id <goal-id> --with-receipt --format json --as-of "$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+```
+
+The POSIX-shell example evaluates age against the current UTC time. Other
+clients must supply a timezone-aware current timestamp. Omit `--as-of` only
+for historical replay: it defaults to the last event time, producing zero
+last-event age, not a live liveness check. Display the observation and evaluation
+times separately; advancing the evaluation clock does not change integrity.
+
+The receipt and projection derive from the same in-memory ledger reading,
+avoiding two CLI calls observing different append states. Omitting the flag
+preserves the original response. This does **not** make concurrent file append
+atomic: a partial last line remains an invalid-input signal rather than being
+silently dropped. The command does not activate an observer, discover a binding,
+write a ledger, call a model, or change a Goal/Todo/lease.
+
+This is an executable readback seam, **not a shipped Mode B panel or supervisor**.
+A future panel must bind exact goal/session/run identity, show observation age
+and integrity independently of task status, and refuse to label a multi-run or
+stale goal ledger as the current session's health. It must remain operator-only,
+with no diagnostic input passed into prompts or scheduler decisions. Existing
+CLI ledger reads are unbounded; do not put this command on an automatic polling
+loop before adding an owner-reviewed read budget/snapshot strategy.
+
+## Qualification Plan and Stop Conditions
+
+1. **C0 adapter fidelity:** compare native execution with the managed adapter,
+   observer disabled. Pin model, route, tool definitions, prompts, environment,
+   budget, package/adapter revisions and initial session state. Account for all
+   retries and interruptions. Reject comparisons with unequal treatments.
+2. **C1 passive arm:** enable only the observer on that qualified adapter. Record
+   eligible run identity, persisted/accepted/rejected/drop counts, receipt status,
+   endpoint/worker-context/scheduler influence and all failed runs. Fixture success
+   does not establish this gate; non-valid receipt is not eligible C1 evidence.
+3. **Overhead:** measure baseline and observer wall time, process CPU, peak RSS,
+   bytes written, event throughput and flush latency using paired repeated runs.
+   Report sample count, distributions, uncertainty and warm/cold conditions.
+   Declare acceptance thresholds before running; no threshold is invented here.
+4. **Retention/deletion:** owner chooses maximum age/bytes, active-writer handling,
+   export/support access, backup scope and delete verification. Dry-run inventory
+   must precede deletion; never truncate an active ledger to meet a size cap.
+5. **Mode B acceptance:** separately exercise start/resume/interrupt/close,
+   process crash, stale session identity, duplicate completion, timeout and
+   provider failure in a disposable runtime. Verify one Turn at a time and
+   canonical validation/writeback before spending quota or requesting another.
+
+Keep raw logs and credentials owner-local. Public evidence should contain only
+generalized methodology, pinned revisions, aggregate results and safe references.
+No live model execution or retention deletion is authorized by this document.
+
+## Delivery Sequence
+
+This comparison plus combined CLI readback can be reviewed now. A Mode B panel
+requires the exact-session read contract and bounded refresh path first; it must
+not be a second generic monitoring subsystem. Run C0/C1 and overhead experiments
+as separately budgeted work, then submit only reusable fixes and safe evidence.
+Implement deletion only after the owner selects the retention profile. Revisit
+runtime preference if Pi satisfies the same isolation/lifecycle tests at lower
+measured integration and operational cost, or DSH fails them. Do not introduce
+L2 advice, retry control or a new scheduler to make an L1 experiment pass.

docs/architecture/rfcs/harness-selection-dsh-pi-v0.zh-CN.md

@@ -0,0 +1,123 @@
+# DSH / Pi：L1 观察与 Managed Runtime 选型
+
+状态：有证据的实现评估，不是运行时晋级声明。
+范围：[Reliability Diagnostics](./long-running-agent-reliability-diagnostics-governed-delivery-v0.zh-CN.md)
+与 [Desktop Execution Frontends](./desktop-execution-frontends-v0.zh-CN.md) 的共同目标。
+[English](./harness-selection-dsh-pi-v0.md)
+
+## 决策
+
+保留 **DSH 作为 L1 首个事件源**，但不据此宣布它已成为生产 Mode B 的最终首选。
+Pi 保留为 managed runtime 候选。前者利用已存在的被动 observer 降低验证成本；后者
+必须证明生命周期、provider、崩溃恢复和真实结果，插件事件 fixture 不能替代这些证据。
+本评估不提供缺乏测量依据的评分或性能排名。
+
+## 证据基线
+
+LoopX 检查基线为 `bf217e1e01bec79f357c9ecbd580cf2dfa73db8b`：
+
+- `packages/dsh-loopx-plugin/src/observer.ts`：完整身份激活、事件压缩、首次落盘安全、
+  有界 buffer 和 flush 隔离。
+- `loopx/capabilities/reliability_diagnostics/{receipt,projection}.py`：独立验证、
+  integrity 分类和无控制权限的诊断输出。
+- `loopx/dsh_goal_mode/turn_host_adapter.py`：有界 Turn、session lineage、SDK 调用和
+  失败映射，并不是完整 Desktop 外循环。
+- `loopx/pi_goal_mode/{loopx-goal.ts,pi-goal-loop-runtime.mjs}`：有绑定及 continuation
+  行为的可见宿主集成，不是被动 observer。
+- `apps/desktop/loopx-control-plane/src-tauri/src/services.rs`：已有服务进程管理不等于
+  RFC 所要求的完整 managed Agent 生命周期。
+
+2026-09-06 独立检查的上游版本，不等同于 LoopX 已验证的安装版本：
+
+- [DSH d347e703 README](https://github.com/deepseek-ai/deepseek-harness/blob/d347e703908d0406b7a7ef80e3a0e594d86b2215/README.md)：
+  Cordis/plugin 架构，明确处于可能不兼容升级的 developer preview。
+- [Pi 9767ba27 SDK](https://github.com/earendil-works/pi/blob/9767ba275f3e9a5ee0f5c5342249b629ab1b2282/packages/coding-agent/docs/sdk.md)：
+  subscribe、session 操作及 runtime replacement API。
+- [Pi 9767ba27 extensions](https://github.com/earendil-works/pi/blob/9767ba275f3e9a5ee0f5c5342249b629ab1b2282/packages/coding-agent/docs/extensions.md)：
+  部分 hook 可以注入上下文、阻止工具调用、修改结果。
+
+历史 Pi 仓库地址目前跳转至 `earendil-works/pi`，本次 SDK 文档使用
+`@earendil-works/pi-coding-agent`。这是升级时要核对的差异，不是立即替换本地依赖
+或假定新旧 API 兼容的理由。
+
+## 按产品要求对比
+
+| 要求 | DSH 证据 | Pi 证据 | 对选型的影响 |
+| --- | --- | --- | --- |
+| 被动观察 | 已有独立 observer entry、三个 session publication hook、首次落盘拒绝 | SDK 提供 subscribe，extensions 还提供干预型 hook | DSH 已有可验证切片；Pi 应优先订阅而非拦截，并证明隔离 |
+| 身份与恢复 | Turn connector 派生 lineage；observer 另外要求精确 goal/session/run | SDK 将 AgentSession 与负责 replacement/resume 的 AgentSessionRuntime 分开 | 两边都要测重启、fork 后身份；有 API 不等于恢复可靠 |
+| 单次有界执行 | 已有 timeout 和失败映射 | 当前 Pi Goal 集成含 continuation/pause | 不允许 native loop 与 Desktop supervisor 同时充当外循环 |
+| 打包 | 独立 export/bundle、packed smokes | SDK resource loading 会发现 extensions | 检查实际加载的包及 profile；二者都不是 OS 进程隔离 |
+| Provider | connector 版本与 SDK 约束明确 | SDK 暴露 runtime/model 构造 | 同 route/model/tools/budget 验证，harness 选择不代表 provider 兼容 |
+| 数据安全 | producer/consumer 独立校验，共享反事实 | 工具/context hook 可接触和修改原文 | Pi 需补首次落盘安全及负向测试，不能复制 transcript |
+| 开销 | 已有 buffer/count/flush 统计，没有本次匹配实测 | 有订阅接口，没有本次 LoopX observer 测量 | 未实测前不作数字排名 |
+| 维护 | 上游明确可能 breaking，LoopX connector 有固定验证版本 | 当前包名与 runtime API 不能直接套用旧集成假设 | 两边升级分别固定版本，不拿已安装 DSH 对比未验证最新 Pi |
+
+这是接入成本和合同差异，不是说 Pi 没有事件，或 DSH 不能使用其他模型。
+两个 harness 都有控制 API；“被动”是具体 adapter 和实际加载依赖的性质。
+
+## 数据流与权限
+
+用户需要区分“没有证据”“执行有异常”“观察过程不可信”，而不是只得到一个绿灯：
+
+```text
+native session publication
+  -> isolated observer: compact / validate / count / append
+  -> independent ledger validation
+  -> integrity receipt + diagnostic projection
+  -> 仅供操作者展示
+
+canonical eligibility -> Desktop supervisor -> bounded Turn -> validation/writeback
+```
+
+诊断不得反向进入 eligibility。`valid` 只代表观察合同通过，不代表任务成功；stall
+信号不是重试授权，observer 故障也不能被当成 worker 故障。
+
+## 本次落地的读取增量
+
+```bash
+loopx reliability-diagnostics status --goal-id <goal-id> --with-receipt --format json --as-of "$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+```
+
+上述 POSIX shell 示例使用当前 UTC 时间评估年龄；其它客户端应传入带时区的当前时间。
+仅在历史重放时省略 `--as-of`：默认使用最后事件时间，因此最后事件年龄为零，不能
+作为实时存活检查。分别显示观察时间和评估时间；推进评估时钟不改变 integrity。
+
+显式选项让 receipt 与 projection 来自同一次 ledger 读取的内存结果，避免分别执行
+两次 CLI 时观察到不同追加状态。不加选项保持原输出。这不提供文件并发追加的原子
+快照；末尾半行仍按无效输入报告，不能悄悄丢掉。命令不激活 observer、不发现绑定、
+不写 ledger、不调用模型，也不改变 Goal/Todo/lease。
+
+这是可执行的读取接口，**不是已交付的 Mode B 面板或 supervisor**。未来面板必须
+绑定精确 goal/session/run，分别展示观察时间、integrity 与任务状态；多 run 或过期
+goal ledger 不得被标成当前 session 健康。输出只供操作者，不得进入 prompt 或调度。
+现有 CLI 全量 ledger 读取没有大小上限，在引入经过评审的读取预算／快照策略之前，
+不能直接拿这个命令做自动轮询。
+
+## 验收方案与停止条件
+
+1. **C0 保真**：比较 native 与 observer 关闭的 managed adapter。固定 model、route、
+   tools、prompt、环境、预算、包／adapter 版本及起始 session，计入失败和重试；
+   treatment 不一致则不采纳比较结果。
+2. **C1 被动观察**：在通过 C0 的 adapter 上只开启 observer。记录完整身份、
+   accepted/persisted/rejected/drop 数、receipt、endpoint 和 worker/scheduler influence。
+   fixture 通过不等于 C1；非 valid receipt 不作为 eligible C1。
+3. **开销**：成对重复测 baseline/observer 的 wall time、CPU、peak RSS、写入字节、
+   吞吐、flush latency；报告样本数、分布、不确定性、冷／热启动条件。预算及验收
+   阈值在运行前约定，本次不虚构阈值或性能结果。
+4. **保留／删除**：owner 选择最大年龄／字节、活跃 writer 处理、支持访问、备份范围
+   和删除验证。先 dry-run 盘点再删除，不能为满足大小限制截断活跃 ledger。
+5. **Mode B**：在可丢弃 runtime 验证 start/resume/interrupt/close、进程崩溃、过期身份、
+   重复完成、超时及 provider 失败；同一时间一个 Turn，canonical validation/writeback
+   通过后才扣 quota 或请求下一 Turn。
+
+原始日志、凭据留在 owner-local；公共材料只保留通用方法、固定版本、聚合结果和
+安全引用。本文件不授权真实模型执行或删除现有记录。
+
+## 后续交付次序
+
+先评审对比结论和 CLI 读取增量；Mode B 面板必须先具备精确 session 读取与有界刷新，
+而不是新造一套通用监控。C0/C1 与开销作为单独预算实验，仅把复用修复和安全证据
+提交仓库。删除功能等 retention profile 决定后再做。若 Pi 在相同隔离及生命周期
+验收下具有更低的实测接入／运维成本，或 DSH 无法通过，再调整偏好。
+不得为了让 L1 实验通过而加入 L2 建议、重试权限或新 scheduler。