feat: add live machine defaults for Goal policies

[huangruiteng]

Summary

• Add live machine defaults for Goal review cadence and change-quality qualification through the existing revision-locked machine configuration store.
• Preserve complete Goal overrides, including explicit values equal to capability defaults. Only explicit clear restores live inheritance.
• Use the effective policy in history/frontier, onboarding and change-quality prepare/record/verify. Machine preferences add no Turn, quota, file or merge authority.
• Expose both editors in machine settings; default selection uses the same presentation order as navigation. Regenerate packaged Dashboard from locked dependencies.

Scope

Periodic reports already support machine defaults. Cadence and change-quality are host preferences with whole-policy overrides. Multi-subagent, Explore Harness/Graph, peer coordination, Lark bindings, authority shadow and reward memory remain Goal-only where their current objects contain Goal identity, bindings, allowlists, persistent-state or authority semantics. This does not globalize those boundaries.

Review fixes

Both reported P1s are fixed: source-order selection was replaced with ordered editable selection, and source/packaged build consistency is verified. Browser assertions were migrated into main's isolated scenario structure during rebase.

An additional public-entrypoint bug was fixed: unrelated Goal edits could discard an explicit default-valued cadence and accidentally restore machine inheritance. Three regression cases failed before repair and pass afterward; explicit clear and absent-clear no-op retain their contracts.

Validation

Tested head: 4c0c8a19a11dc465484ac7c167de6530016b7929. Run state: finished for the checks below.

• 108 Python tests passed (77 focused plus 31 adjacent); configured strict mypy passed for 22 source files; scoped Ruff and diff checks passed.
• Lockfile install and production TypeScript/build passed. Rebuilding the committed tree leaves packaged asset status empty. Existing large-chunk build advice remains non-fatal.
• Full packaged browser acceptance passed navigation/sorting, Chat recovery and typed actions. Machine configuration covers selected-panel ordering, both new editors, Goal-only restrictions, revision-locked preview/apply, desktop/mobile and English/Chinese. Local screenshots were visually inspected.
• Capability field projection/JSON smoke and public/private scan passed across 34 files.
• Authorized active-Goal read-only projection comparison: source and effective configuration unchanged. Synthetic isolated runtimes validate actual default/override/clear transitions. No active Goal or machine policy was changed to test the feature.
• Exact quality receipt: cqr_bbd62b975894b48e76a4; fingerprint bbd62b975894b48e76a4954018b7b8f979db4eb2c6b2daf95e84905b14c6dc8c.

Final canary passed 18/18 selected checks and 4/4 direct checks, with a valid exact receipt and no manual holds. The five new capability-owner modules also pass scoped strict mypy. Owner-authorized self-merge; local validation does not claim a fresh Windows CI or paid-model/live automation run. Public fixtures, generated product assets and reusable code only; private evidence remains excluded.

[huangruiteng]

Request changes conclusion (author-owned PR; GitHub blocks formal self-review)

复核 exact head：39782c67dad920081453bf98701036477bd9a26b

动机

这个 PR 要解决的问题成立：Goal 复核周期和变更质量验证目前只能逐 Goal 配置，多个 Goal 需要相同策略时会重复写值，也无法随机器级默认值实时更新。目标行为也表达得比较清楚：机器配置是可继承的默认值，完整的 Goal 配置对象原子覆盖它，显式 clear 才恢复继承；这两个配置不增加 Turn、配额、文件或合并权限。

改动思路

实现复用了已有的 revision-locked machine configuration store，而不是再造一套持久化。两个 capability 各自负责 schema 归一化，project_goal_with_builtin_machine_configuration 统一组合有效 Goal 投影，history、onboarding、cadence 与 change-quality prepare/record/verify 从同一投影读取。这个边界是合理的：机器值是权威配置，effective Goal value 是派生投影，Goal object presence 是原子覆盖条件，不做字段级混合。

我也检查了更小方案：单纯批量写 Goal 会产生同步状态，字段合并会模糊 provenance；当前复用既有 store + capability-owned schema 是更合适的最小长期边界。

具体改动

• 新增 cadence 与 change-quality 的机器 namespace、严格 schema 和默认值应用器，并在 builtin registry 注册。
• Goal 配置 clear 与显式 override 保持区别；即使显式值等于 capability default，也仍然是 Goal override。
• history、onboarding、execution profile、change-quality receipt/API/catalog 都读取带 provenance 的有效值。
• Dashboard 共用 capability catalog 展示机器/Goal 范围，Goal-only capability 保持只读，preview/apply/rollback 继续使用 revision fence。
• 文档补充激活、清除、读回和权限边界；测试覆盖继承、覆盖、clear、API 和主要消费者。

关键代码讲解

1. loopx/capabilities/machine_configuration/builtins.py:30 的 project_goal_with_builtin_machine_configuration 是唯一组合点，避免 history 和 qualification 各自重写 precedence。
2. loopx/capabilities/change_quality/machine_defaults.py:92 只在没有完整 Goal override 时注入机器默认值，保留 atomic override。
3. apps/presentation/dashboard/src/features/personal-workspace/machine-configuration-settings.tsx:83 是机器配置操作面；它同时暴露了当前阻塞：初始 selection 与导航的 presentation order 使用了两套顺序。

对主干的风险

有两个 branch-attributable 的 P1，当前不能合并：

1. MachineConfigurationSettings 在加载后用源数组中第一个 machine-writable capability 作为默认选中项（当前是 Goal review cadence），但导航又用 orderCapabilitiesForPresentation 排序，新增 browser contract 则期待首屏是“变更质量验证”。因此 exact-head Playwright job 在 examples/personal-workspace-browser-smoke.mjs:2406 稳定超时。请让默认 selection 与导航共用同一 ordered list；如果产品明确要默认选 cadence，则把该决定显式化并同步 smoke，不要保留两套隐式顺序。
2. packaged Dashboard 不是最终 source 的干净构建产物。CI 的 npm run build:chat 生成 assets/index-8uLZEePh.js 并改写 index.html，而当前 head 提交的是 assets/index-CwxDMCrv.js。这会让 wheel 中实际服务的 UI 与审阅源码不一致。请在 source/lockfile 最终确定后重新生成，并验证 git status --short --untracked-files=all -- loopx/web/chat 为空。

本地带正确 LOOPX_PYTHON 的 9 组 focused suites 是 90 passed in 9.86s；四个 Python shard、全部 Stage2c、DCO、dependency 和 release/desktop build 也通过。Windows lifecycle 的 quota skip exit-code 失败不在本 PR 改动面内，我没有把它当作上述 branch blocker，但修复后仍应重跑完整 required checks。

我的整体评价

核心状态模型、复用方向和 authority boundary 都是对的，范围也与目标相称；当前问题不是架构重做，而是交付面尚未自洽。最小修复是统一 catalog ordering/initial selection、重新生成 packaged assets，并让 browser + clean-build 两个真实边界一起变绿。修复后我会按同一 exact head 重跑整 PR 判断，不只回看这两行。

English verdict: REQUEST_CHANGES — the machine-default architecture is sound, but the exact head has two release-blocking UI delivery defects: initial capability selection disagrees with the presented catalog/browser contract, and the committed packaged Dashboard is not the clean output of the reviewed source.

[huangruiteng]

Review refinement

Reviewed head: 4c0c8a19a11dc465484ac7c167de6530016b7929, rebased onto main including #4253.

Both reported P1 findings are addressed, and one additional policy-preservation bug was reproduced and fixed:

1. Default selection now follows presentation ordering. Machine settings reuse orderCapabilitiesForPresentation and derive the initial selection from its first actually editable machine capability, rather than storing the API's first machine-scoped row. Explicit user selection remains intact across reloads. The browser contract checks the selected heading and aria-current against the visible ordered catalog rather than hardcoding change-quality as the initial panel. Under the existing tier policy, periodic reports can correctly precede change-quality; no global navigation-order redesign is included.
2. Packaged assets are reproducible. Installed dependencies with the checked-in lockfile, rebuilt build:chat, committed the resulting referenced bundle, and rebuilt again. git status --short --untracked-files=all -- loopx/web/chat is empty afterward. Older tracked hashes remain intentionally retained by the existing cache-recovery build contract; temporary unreferenced build outputs were excluded.
3. Explicit default-valued cadence survives unrelated edits. An explicit Goal value of 5 previously disappeared when configure_goal normalized the execution profile during an unrelated update, silently inheriting the machine value instead. Three public-entrypoint regressions reproduced this before the fix. Existing override presence now survives normalization; no-op, quality-policy and turn-granularity updates preserve it. Explicit clear restores inheritance, and clearing an absent override remains a no-op.

Product and architecture judgment

The original machine-default model is retained: live defaults from the existing revision-fenced store, whole Goal override precedence, and explicit clear to inherit again. No field-level policy merge, new provider, permission grant, default promotion, quota spend or Turn creation. Capability-specific schemas remain with their existing owners. The bounded future-facing pass removes duplicate initial-selection state and preserves override semantics at the existing execution-profile boundary; no new framework is needed.

Rebase carried the browser coverage into main's existing isolated fixture.mjs and typed-actions.mjs; it does not resurrect the monolithic smoke runner. Goal-only bindings and authority-bearing capabilities still expose no machine write path.

Validation on the final tree

• 77 focused Python tests passed across machine/Goal configuration, strict schemas, inherited history/cadence, HTTP APIs and override/clear behavior.
• 31 adjacent change-quality and onboarding tests passed; strict configured mypy passed for 22 files; scoped Ruff passed.
• Lockfile install, production TypeScript/build, repeat clean build, and capability-configuration projection/JSON smoke passed.
• Full packaged browser suite passed all three isolated scenarios: navigation/sorting, Chat recovery and typed actions. Machine editors, initial selection, Goal-only restrictions, reviewed preview/apply, English/Chinese, desktop and 390 px viewport are covered. Screenshots were inspected locally; fixture-backed browser APIs are not claimed as live production writes.
• An authorized read-only comparison on the existing active Goal confirmed both source state and current effective configuration remain unchanged. Live default/override transitions are exercised in isolated test runtimes, not by changing the user's machine policies.
• Public/private scan clean across 34 files; diff hygiene passed. No private snapshots, raw logs, local machine paths or credentials are included.
• Quality receipt cqr_bbd62b975894b48e76a4 verified valid for fingerprint bbd62b975894b48e76a4954018b7b8f979db4eb2c6b2daf95e84905b14c6dc8c; 34 files, safe fix allowed/applied once, no unresolved quality blockers/warnings/advisories.

The initial expected-panel browser failure and three cadence counterexamples were diagnosed and fixed, not reclassified as environment noise. Production builds retain the existing large-chunk advisory. Windows lifecycle CI and live paid-model/automation soak were not rerun locally; no cross-platform success is claimed. This PR does not change provider transactions, so no new PostgreSQL migration qualification is claimed or required for this refinement.

Final premerge result: passed, 18/18 selected checks and 4/4 direct checks; zero failures, zero manual holds, exact receipt valid. The five new capability-owner modules also pass scoped strict mypy. Merge decision: owner-authorized self-merge after this refinement and validation, without waiting for the full new hosted CI run.