fix(turn): warn on envelope growth and isolate default-off delegation

[huangruiteng]

Summary

• Treat TurnEnvelope size as a performance warning, not admission authority. Valid oversized packets continue through Turn plan and loop routing; schema, signature, identity, authorization and execution-quota gates remain unchanged.
• Measure final compact UTF-8 JSON, including diagnostics, with an additive seven-section breakdown and over-target section names. Preserve historical code-point metrics for v0 compatibility. Keep the 8 KiB target and delivery-time regression canaries.
• Compress repeated presentation: remove the unused detail_ref.contains inventory while preserving every cold-read command and the exact signed action projection.
• Remove unconditional proactive delegation instructions from the installed project skill. Only current-scope enabled capability context supplies delegation guidance; absence, disabled context or read failure preserves the existing single-agent workflow. Context never grants spawn authority.

中文：超预算应引起分析和优化，而不是让合法 Turn 挂掉。此次保留 8 KiB 目标，增加真实 UTF-8 分项诊断，先删除重复说明；默认关闭时不再从安装后的 skill 泄漏主动 delegation 指令。

Issue Or Task

Repairs the two findings from #4244:

• Final envelope budget overflow
• Default-off delegation guidance leak

Root causes: the shared Python Turn route treated a presentation metric as a hard validity gate, and static installed guidance activated delegation before the default-off dynamic provider could isolate it. Legacy *_json_bytes also counted code points rather than UTF-8 bytes.

Budget analysis and compatibility

Same synthetic registry and CLI invocation on baseline 87f7568b3598272c9bab37f6406a79e90873eca2 and this head; all six source action signatures are identical:

Fixture	Context	Baseline bytes / route	Candidate bytes / route
Normal	off	5,817 / ready	5,636 / ready
Normal	on	7,103 / ready	6,922 / ready
High water	off	8,742 / contract error	8,837 / ready + warning
High water	on	9,239 / contract error	9,337 / ready + warning
Unicode scopes	off	13,690 / contract error	13,787 / ready + warning
Unicode scopes	on	14,187 / contract error	14,286 / ready + warning

Normal packets shrink 181 bytes net. Overflow diagnostics cost approximately 276–280 bytes, so oversized samples grow 95–99 bytes net; that cost is disclosed, not counted as compression. Detailed diagnostics are absent from normal packets.

For the enabled high-water candidate, boundary is 3,513 bytes (37.6%), contracts 2,172 (23.3%), transport 1,840 (19.7%), and compact context 502 (5.4%). The pressure is not solely capability context. Review allocation targets total 8,192 bytes: action 800, boundary 2,000, writeback 600, scheduler 600, contracts 1,800, context 1,400, transport 992. These are investigation targets, not truncation caps. Preserve legal scope and execution arguments; optimize their owning projections when evidence supports a behavior-preserving change rather than silently raising the budget.

Default behavior changes for all Turn hosts: size overflow no longer returns contract_error or stops loop routing. JSON plan/host requests retain diagnostics and Markdown plan/envelope views display a warning. No signature version, authority rule, feature flag or provider lifecycle changes. Large legal synthetic inputs still exceed the target and warn; this PR does not claim every envelope is now under 8 KiB.

Placement/future-facing pass: measurements belong beside the existing typed quota envelope owner, with no new capability/provider. This extracts the cohesive diagnostic rule from the large builder, reuses shared rendering and removes duplicate guidance ownership; broader projection changes are intentionally not bundled.

Validation

• Tested revision: 3645d81b2d15a1871f17d5601631fe846664d0c3
• Run state: finished.
• Input classes: synthetic, public_fixture.

Check kind	Result	Public-safe evidence / limitation
unit / integration	passed	264 Python tests across envelope, real CLI, controller, context, executor and workflow installer; 18 TypeScript tests, including 300 Unicode accounting sizes.
static	passed	npm run typecheck:control-plane, repository-declared python -m mypy (22 files), changed-file Ruff, diff check and skill schema validation.
regression_parity	passed	examples/control_plane/cli-output-base-head-differential-smoke.py: 102 rows in each arm; seven intentional contains shape removals, no semantic drift. Six paired real CLI scenarios reproduce failure before/warning after and preserve action signatures.
real_entrypoint / real_backend	passed	Actual CLI with the managed TypeScript runtime; isolated synthetic registry and no source-state writes. Built wheel installed into an isolated target; installed CLI exercises oversized Turn plan successfully.
regression_parity	passed	Actual workflow installer on baseline and built wheel: baseline contains unconditional proactive delegation text; candidate contains the default-off gate instead. Dynamic provider off returns no context; on retains guidance.
static	passed	Public boundary scan and candidate-path credential/local-path scan; only public-safe product code, docs and durable tests included.
integration	passed	loopx canary premerge --from-git-diff --goal-id loopx-meta: 4 direct checks and all 16 selected checks executed; zero failures, warnings or manual holds. Exact quality receipt accepted.

Coverage and gaps: tests cover changed entrypoints and real typed backend, not only mocks. No live model child spawn or external host execution was launched; installed guidance is validated as an artifact, not claimed as a model-behavior evaluation. Storage backends and UI are untouched. Optional expanded mypy diagnostics on the CLI rendering module find the same 23 pre-existing errors on baseline and candidate, outside the repository-declared strict file set; no new diagnostic remains. Whole-repository CI is not implied by the focused results.

Exact-scope qualification: 13 files, fingerprint 51567bee1154346ad39c1ead4212b50b887e8910a6c8196e8d07ef21e028b9a7; receipt cqr_51567bee1154346ad39c verified valid. One allowed safe-fix pass narrowed the new renderer input; zero unresolved quality blockers/warnings/advisories. Aggregate premerge gate passed. This PR is for review, not self-merge.

Type / Area / Direction

• Bug fix, intentional runtime behavior change, documentation and tests.
• Control plane; capability guidance; host integration.
• Core control-plane hardening. Target base: main.
• Shared-authority RFC fixture impact: N/A; no storage promotion, state-provider routing or authority migration.

Boundary Checklist

• No private state, credentials, raw traces, internal links or local machine paths in this diff or PR.
• No duplicated benchmark work, new benchmark jobs or unrelated cleanup.
• Scoped to the two linked findings and the explicitly requested warning semantics.
• Every commit includes a DCO sign-off.

[huangruiteng]

动机

该 PR 解决 TurnEnvelope 超预算时把可诊断信息变成阻断的问题，并隔离默认关闭的 delegation 上下文泄漏。目标是让热路径继续运行，同时把超限原因、各区段占用和压缩方向暴露给维护者。

改动思路

预算检查保留为观测告警而非流程失败；编码后的 UTF-8 大小作为实际边界，按区段汇总诊断。delegation 只在显式启用且有授权上下文时进入共享渲染路径，关闭态维持原有输出。

具体改动

关键代码讲解

• turn_envelope_budget.ts 计算真实字节预算并生成 warning。
• turn_envelope.ts 传递区段计数和诊断上下文，不再让 warning 改变 turn 结果。
• turn_envelope_markdown.py 在启用门控后渲染 delegation，并移除重复 detail 引用。
• test_turn_envelope_budget_warning.py 覆盖基线、超限、关闭态和差分预算。

对主干的风险

预算超限现在不会中断 turn，监控方必须消费 warning；若下游只依赖异常，需迁移到结构化诊断。关闭态与开启态分别验证，未授予权限不会激活 delegation。重点测试、Ruff、diff 检查及 canary 均通过。

我的整体评价

APPROVE。该改动直接覆盖已观察到的预算累积和默认关闭泄漏，范围集中，保留了兼容输出并提供可操作的区段证据。审阅 head: 3645d81b2d15a1871f17d5601631fe846664d0c3。

English verdict: APPROVE — head 3645d81. Warning-only budget semantics and default-off isolation are covered by focused tests and canary validation.

[huangruiteng]

动机

重新按当前 policy revision 3、exact head 3645d81b2d15a1871f17d5601631fe846664d0c3 审阅。目标是让合法但超出 8 KiB 目标的 TurnEnvelope 保持可执行，同时把增长变成结构化诊断；并确保默认关闭的 delegation 不因安装了 skill 或工具可用而被激活。

改动思路

TS 侧在既有 TurnEnvelope owner 中计算最终 UTF-8 字节数和七段分解，warning 只承担性能诊断；Python route 继续校验 schema、签名、动作和授权，不再把 within_budget=false 当作 contract error。安装后的 project skill 改为只有当前 scope 的 enabled capability context 才提供 delegation guidance，缺失、禁用或读取失败都保持单 Agent 路径。

具体改动

• turn_envelope_budget.ts 提供稳定的 UTF-8 计量、超标量和 section breakdown，并保留旧 code-point 指标兼容性。
• driver.py / loop_controller.py 去除预算作为 admission gate，但保留签名漂移和 action gate 的 fail-closed 行为。
• Markdown/CLI plan 输出 warning 和 remediation；移除 detail_ref.contains 的重复 inventory，不删 cold-read 命令。
• skills/loopx-project/SKILL.md 与 context provider 对齐 default-off 语义；测试覆盖 enabled/disabled、Unicode、状态无写入和签名负例。

对主干的风险

我用 baseline 87f7568b3598272c9bab37f6406a79e90873eca2 与当前 head 做了六组真实 CLI 对比：正常包保持 ready，超预算从 contract_error 变为 ready + warning 是本 PR 明确的行为变化；action signatures 保持一致。exact-head focused suite 178 项通过，PR 28/28 checks 通过，canary 16/16 通过，public boundary 通过。未启动外部 host 或 child model，也未触碰 storage/UI。

有一个非阻塞的 P2 后续：当前 route 已把 compaction 视为诊断元数据，建议补一个“缺失/形状异常 compaction”的 characterization，明确它是可选诊断还是需要 shape-only 校验；不要恢复大小 admission gate。它不影响本 head 的既定 warning-only 语义。

我的整体评价

当前 exact head 的实现、范围和验证与目标一致，默认关闭隔离和 warning-only 路由均有正反例与真实 CLI 覆盖，建议通过。

English verdict: APPROVE — exact head 3645d81b2d15a1871f17d5601631fe846664d0c3; policy-v3 evidence is complete, 178 focused tests and 28/28 PR checks pass, with one non-blocking P2 characterization follow-up.

[huangruiteng]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

评审对象：#4268，exact head 3645d81b2d15a1871f17d5601631fe846664d0c3。
本轮按 policy revision 3 重新核对了完整 diff、公共调用路径、关闭/开启反事实以及远端检查；head 未变化。

动机

PR 解决两个相互关联的问题：合法但体积较大的 Turn envelope 不应因为预算诊断而被硬拒绝；默认关闭的 delegation guidance 不能因为工具或 skill 已安装就泄漏到普通单 Agent 流程。

改动思路

把 UTF-8 envelope 计量和 warning 留在现有 TypeScript envelope owner；Python 只继续负责 schema/signature/action 的入口适配。预算从 admission gate 降为诊断信号，显式 enabled 的 current-scope context 才能投影 delegation guidance。没有新增 provider、存储或 host 执行框架。

具体改动

• turn_envelope_budget.ts 计算 section/UTF-8 字节并生成结构化 warning，避免截断 authority-bearing 字段。
• Turn route 保留 schema、signature、action 的硬门禁，不再把 within_budget=false 当作 contract error。
• agent context 与安装后的 loopx-project skill 共同保持 default-off：availability、安装或工具存在本身不激活 delegation。
• 协议文档、Markdown/rendering、focused tests 和 boundary coverage 同步更新。

正向路径是 oversized-but-valid envelope → warning + ready；反向路径是 signature/schema/action 不合法仍拒绝，context 缺失仍不生成 delegation guidance。

对主干的风险

• 预算超限现在会继续进入 host，transport/诊断成本由 warning 暴露，不能再依赖旧的“超限即停止”语义。
• 仍建议后续补一个 malformed/absent compaction 的 shape characterization，明确它是可选诊断 metadata，而不是恢复成 size admission gate。
• 本轮没有发现 provider、authority、持久化或 default-off 隔离的未覆盖分支。

验证：精确 head focused Python suite 178 passed；远端 required checks 28/28 success，包括 dashboard-acceptance、kernel-static-checks、stage2c、windows-powershell 和 merge-gate；canary premerge 的 direct/catalog/risk/boundary 分组均通过。只保留上述 P2 follow-up，不阻塞合并。

我的整体评价

APPROVE（公开结论，非 GitHub 正式 self-approval）。改动仍在既有 envelope/context owner 内，语义变化已在文档和测试中披露，exact head 当前可合并。

English verdict: APPROVE — #4268 exact head 3645d81b2d15a1871f17d5601631fe846664d0c3; 178 focused tests, 28/28 required checks, and canary boundary checks pass. Only a non-blocking malformed-compaction characterization follow-up remains.

[huangruiteng]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

动机

这个 PR 处理的是两个相互关联、但边界不同的问题：TurnEnvelope 的最终紧凑 JSON 超过预算时，旧路径把性能信号当成 admission gate，导致签名和结构都有效的 turn 被停止；同时 loopx-project 的静态 delegation 指引在 capability 未启用时仍可能进入普通 agent 的指令面。前者会把“需要压缩哪一段”的监控问题变成运行中断，后者会把可选能力的安装/可见性误当成启用。改动把最终 UTF-8 wire size、七个 section 的分摊和超目标 section 变成可读诊断，并只在当前 scope 明确 enabled 的 agent_context 下展示 delegation guidance。它没有改变 schema、签名、身份、授权或 execution-quota 的硬门禁，也没有新增持久化状态。

改动思路

入口仍是现有 TypeScript buildTurnEnvelope，新增的 measureTurnEnvelope 在最终 compact payload 上计算真实 UTF-8 字节数；action、boundary、writeback、scheduler、contracts、context、transport 七个 section 的目标合计 8192 bytes，warning 记录 excess、section_bytes 和 over_target_sections。Python driver._typed_route 不再把 within_budget=false 当作拒绝条件，因而 warning 只影响可观测性，schema/signature/identity/authorization 仍在既有边界内决定 contract_error。CLI/Markdown 复用现有 renderer 消费这个结构。技能侧沿用已有 managed loader 和 agent_context，仅在当前 scope 的 enabled gate 通过时给出 delegation guidance；安装、注册、可发现性和读取失败都不授予 spawn 权限。这个拆分保持了 TypeScript 对 envelope 语义的单一所有权，Python 仍只是 adapter，没有平行的预算或授权规则。

具体改动

• turn_envelope_budget.ts 新增纯测量函数，按最终 wire bytes 计数并保留历史 code-point 指标。
• turn_envelope.ts 将测量结果接入 compaction.warning；driver.py、loop_controller.py 和 CLI/Markdown 渲染 warning，但不放宽其它 hard gates。
• turn-envelope-v0.md 明确 overflow 是性能 warning 而非 admission authority，并解释七段预算。
• skills/loopx-project/SKILL.md 将 delegation 文本绑定到当前 scope enabled context，默认关闭、缺失或 read-fail 时保持 single-agent 行为。
• 验证：Python focused suite 178 passed（48.10s），TypeScript envelope suite 10 passed，Ruff 与 diff check 通过，GitHub 28/28 checks 成功。复现了 signature mismatch 仍然 contract_error，以及 feature-off 不泄漏 guidance。
• 我发现一个非阻塞 P2：turn_envelope_budget_warning_lines 假定 warning、section_bytes 和 over_target_sections 已是正确 dict/list；若跨版本或外部 payload 传入 list/非字符串，会抛 AttributeError/TypeError，而同一 renderer 的其它输入较防御式。建议在该 owner 增加 shape guards 和 malformed-warning regression；这不影响当前 typed producer 的正常路径。

对主干的风险

主要风险是下游消费者若只识别旧的 within_budget 或不展示 warning，可能错过压缩信号；协议文档和 additive 字段已披露这一变化。另一个风险是 malformed diagnostic payload 触发上述 renderer P2，修复范围局限在渲染器输入保护。最终 envelope 的计量覆盖未知 top-level keys 到 transport，warning 不产生状态写入、重试、claim、delegation 或 quota side effect。没有运行真实 host/model，但本地 managed TS/Python 路径和远程必需检查均通过。

我的整体评价

整体设计把性能监控与 admission authority 正确分离，并在共享 instruction surface 上证明 default-off 隔离；改动集中在既有 envelope、adapter、renderer 和 skill owner，新增状态只是可重算的 diagnostic projection。没有阻塞性发现，我对 exact head 3645d81b2d15a1871f17d5601631fe846664d0c3 给出批准结论（GitHub 因作者身份只能使用本评论形式）。建议后续补齐 renderer malformed-shape 防护后继续观察 warning 的实际压缩反馈。

English verdict: APPROVE