From 456b499eb1d6e2c2d5d981e9863d2535d1aad06f Mon Sep 17 00:00:00 2001 From: huangruiteng <14976749+huangruiteng@users.noreply.github.com> Date: Sun, 13 Sep 2026 21:41:05 +0800 Subject: [PATCH] docs(rfc): define cross-session restoration and handoff integration Signed-off-by: huangruiteng <14976749+huangruiteng@users.noreply.github.com> --- docs/architecture/rfcs/README.md | 4 +- .../capable-manager-semantic-handoff-v0.md | 71 +++++++++++++++++-- ...pable-manager-semantic-handoff-v0.zh-CN.md | 71 +++++++++++++++++-- .../rfcs/cross-session-memory-substrate-v0.md | 2 + ...cross-session-memory-substrate-v0.zh-CN.md | 2 + .../obelisk-session-evidence-provider-v0.md | 4 ++ ...lisk-session-evidence-provider-v0.zh-CN.md | 4 ++ 7 files changed, 147 insertions(+), 11 deletions(-) diff --git a/docs/architecture/rfcs/README.md b/docs/architecture/rfcs/README.md index 1339c5332f..bf3a985c93 100644 --- a/docs/architecture/rfcs/README.md +++ b/docs/architecture/rfcs/README.md @@ -156,8 +156,10 @@ changes. - **Current boundary:** Proposes ordinary host-tool autonomy, persistent scoped conversations, long-horizon semantic continuation and automatic result delivery. Includes an official Grok Bot study distinguishing availability from goal - continuation; M0–M4 and A1–A16 define delivery and acceptance, with explicit + continuation; M0–M4 and A1–A20 define delivery and acceptance, with explicit alignment, shared-authority and TS migration dependencies. + Cross-session restoration, execution takeover and automatic return are specified + separately, reusing #4094 with optional Obelisk gap recall under its own scope. Runtime-profile promotion and generic handoff migration have not shipped. - [Explicit Todo Continuation — Stage A](cross-session-memory-substrate-v0.md) diff --git a/docs/architecture/rfcs/capable-manager-semantic-handoff-v0.md b/docs/architecture/rfcs/capable-manager-semantic-handoff-v0.md index 95cebb39df..5b2a8f6b54 100644 --- a/docs/architecture/rfcs/capable-manager-semantic-handoff-v0.md +++ b/docs/architecture/rfcs/capable-manager-semantic-handoff-v0.md @@ -208,10 +208,62 @@ The receiver commits result/evidence links and audience-ready text. The manager ### 5.7 Session and product continuity -One manager identity has logical conversations scoped by audience/authority. Resume a compatible upstream thread in the same runtime home. Refresh current Core state and pending requests every turn; session memory is not current truth. On incompatible scope/tool changes or missing sessions, recover from durable context with a recorded reason, preserving unresolved work. Do not restart simply to reapply ordinary context; do not import runtime database rows across homes. +**Cross-session continuation is a first-class product journey, not transcript forwarding.** A user can ask “continue in another session/agent and report back here” once. Within existing authorization, the host prepares the context, selects the supported continuation path, presents it to the receiver and returns the conclusion automatically. The receiver reassesses the work; the user need not export JSON, repeat the background or approve routine restoration. This applies to manager and worker sessions alike. + +#### 5.7.1 Choose the continuation path + +Keep logical conversation/request, registered Agent, runtime home, executable session and turn/attempt identities distinct. A logical conversation remains audience/authority-scoped. A new executable session does not create a new user request or erase pending obligations. Resolve the actual binding through the runtime adapter; a session ID in prose is neither discovery nor authorization. + +| Situation | Restore context | Execution boundary | +| --- | --- | --- | +| Compatible session resumes in the same runtime home | Resume through the supported host API; refresh current work and pending requests | Retain the existing execution binding subject to current grants/claims; no ownership transfer | +| Same Agent replaces a missing, incompatible or exhausted session | Start through a supported host adapter with a scoped semantic brief and current work references | Reconcile the old instance before binding the replacement; Agent identity alone cannot fence a still-running session | +| Another registered Agent takes over | Deliver the same context contract; receiver assesses the requested scope | Consultation/delegation do not transfer existing ownership. Transfer intent uses the current work owner's qualified claim/lease path, including Stage A only inside its supported boundary (§5.13) | + +Model changes alone do not require replacement when the host supports compatible continuation. Ordinary context refresh and compaction use the existing context path. If resume/start is unsupported, retain the request and expose the exact adapter gap; do not pretend that storing an inbox item started a session. Cross-host continuation additionally resolves authorized artifacts and transport; never copy runtime database rows or rollout files across homes to impersonate a resumable session. + +#### 5.7.2 Prepare a dense, bounded continuation brief + +Compose §5.10 `SemanticContext` from current canonical work plus source-authored explanation. Do not introduce a parallel checkpoint database or embed a mutable copy of every Todo. The brief answers: + +- What outcome is owed, to whom, and which questions remain unresolved? +- Which constraints, accepted decisions and later corrections govern the next step? +- What was tried, rejected or left uncertain, why, and with which evidence? +- What is already done, what may still be in flight, and where are the exact effect/result receipts? +- Which artifacts/worktree revisions are needed, how can this receiver read them, and what has not been verified? +- What does the source suggest next, and what must the receiver reconsider? + +Preserve the current request/brief digest, work basis, artifact references and return route. Source session/turn references provide provenance; they do not carry authority. Keep dated observations separate from current facts and suggestions separate from accepted commitments. Capture relevant dirty changes as authorized versioned artifacts when needed; a Git commit or path alone does not preserve uncommitted work, running terminals or a browser's execution state. Existing resource owners retain those execution facts. + +Use existing completion/context hooks at accepted plan/result changes and supported pre-compaction or explicit handoff boundaries. Persist the brief before acknowledging that preparation succeeded; link it to the accepted basis rather than inventing an atomic commit with independent work stores. Abrupt termination may leave only the last durable brief. Recover that version and disclose missing intervals; never require an unavailable source to generate a fresh note before any recovery can proceed. Large evidence stays behind scoped references with omissions visible, not a global TurnEnvelope size increase. + +#### 5.7.3 Restore, reassess and activate safely + +The adapter records the chosen path/reason and actual session/turn binding alongside existing request observations. These are proposed adapter projections, not a new work-state owner. The receiving turn performs one coherent continuation step: + +1. Read the latest request, current selected work authority and authorized brief/artifacts. Reconcile corrections, cancellation and already committed results before planning. Disclose unavailable or stale material. +2. Resolve decision-critical context gaps through §5.7.4 when admitted. Reassess accepted/deferred/rejected scope, preserve unresolved obligations and record the actual plan delta. Reading a packet is not this assessment. +3. Before affected execution, reconcile outstanding effects and satisfy the existing work/resource ownership boundary. For same-Agent replacement, reuse a real runtime execution-instance guard plus applicable work claim/lease. For cross-Agent transfer, obtain the exact owning transfer receipt. Neither a new session-binding revision nor a historical note creates a fence. +4. Perform the next justified step and link its evidence. Commit the owed result through the existing request/outbox relationship, addressed to the logical return route even if the initiating session no longer exists. + +If the old instance might still execute, quiesce it or use the supported fencing mechanism and verify readback before another conflicting writer starts. A runtime without enforceable fencing cannot advertise unattended effectful takeover; it may prepare context and perform independent reads while the conflict remains explicit. Do not add a second lease service to hide this limitation. An expired lease does not cancel an already submitted external action: uncertain effects require provider reconciliation, not replay. A source session that later returns must refresh ownership/binding before further controlled effects. A correction arriving during restoration causes a basis recheck, not duplicate execution under the old brief. + +#### 5.7.4 Fill historical gaps through the existing recall boundary + +[Xiaods' #4094](https://github.com/huangruiteng/loopx/pull/4094) supplies deliberate working-context export and revision-guarded ownership adoption. The [Obelisk RFC](obelisk-session-evidence-provider-v0.md) addresses a different failure: current state identifies the work but earlier reasons or failed attempts were never preserved. Its research supports evaluating targeted longitudinal recall, not assuming that importing more transcripts improves outcomes. Reuse both, without reviving the retired general memory-substrate store. + +Recovery first reads canonical work and its referenced brief. Only a remaining decision-relevant gap creates an existing `agent-turn-recall` situation with `resume_or_handoff_gap`: for example, “why was this route rejected at the referenced revision?” Derive bounded query terms from that gap, not the full conversation. When the provider and caller stage are qualified and enabled, consume its typed historical-evidence result with source, scope, revision/freshness and omissions. The receiver verifies applicability against current facts; retrieval does not adopt a plan, settle work or promote Reward Memory. + +The initial Obelisk pilot remains optional, default-off and **same Agent, same project/repository**. A replacement session of that Agent may qualify; a different receiver does not inherit the source's archive access. For cross-Agent work, the source may explicitly include authorized evidence excerpts in the handoff brief. Searching its archive as the target requires the separately configured and qualified broader scope; do not impersonate the source or infer permission from a handoff. Raw hits remain private; a channel receives only the audience-appropriate brief/result and retrieval coverage permitted by the provider contract. + +Missing provider, stale/incomplete index, timeout or zero hits leaves a typed gap and continues on available evidence. It is not proof that no earlier work exists, nor a new routine user gate. Pause only an action whose necessary precondition genuinely remains unknown; pursue independent work. Basic continuation must pass with no history provider. Operator-only pilot admission stays operator-only until Obelisk's later cold-path stage qualifies; M2/M3 does not silently enable automatic indexing, license/packaging changes or broader retrieval. + +#### 5.7.5 Show continuity and close the original exchange Frontend and Lark share request/result identity and authorized facts. Equivalent authorized surfaces may show the same conversation; other groups must not receive private history. The frontend shows conversation, worker, brief, current work/result and delivery status. A saved answer not delivered to Lark is visible as such and is recoverable without rerunning work. Lark shows timely receipt, substantive result and necessary next action; multi-part output or a readable attachment preserves lengthy content. It must not force the user to ask where every handoff went. +Show “restoring context”, “receiver reassessed”, “execution taken over” and “conclusion delivered” only with their corresponding observations. In the frontend, expose the actual continuation mode, replacement reason, relevant missing context and expandable evidence; Lark automatically reports a meaningful takeover, unresolved actionable problem and final conclusion without flooding every internal transition. CLI/managed Turn consumes the same projection. A mere inbox read cannot appear as a successful takeover, and changing sessions cannot orphan a pending result. + Keep protocol effects separate from visible text. Reuse host tool/function calls and typed receipts for actions where supported; a compatibility decoder must quarantine malformed control envelopes while recovering independently valid display text. Never infer or execute an effect from a recovered answer. Formatting failure is a transport incident, not new work for the model. ### 5.8 One concrete exchange across several messages @@ -392,6 +444,10 @@ The following IDs are durable acceptance anchors for engineering Todos and PRs. | A14 | Handoff includes a relevant image/document and reaches a different configured host through a text-only channel | Receiver observation ties actual read/extraction to the artifact revision and its effect on obligations/plan, or gives an explicit no-read reason; no false read receipt, private disclosure or sender-local-path assumption | | A15 | Same handoff fixture against unpromoted and explicitly configured promoted Goal sources; provider outage and crash between request/work commits | Exactly one selected work-state writer; no fallback on canonical empty/failure; original work receipt is recovered and linked without duplicate effects; a pending request relation remains distinguishable from a committed work change | | A16 | Receiver lane replan versus shared amendment, stale basis and peer-held work | Lane edits stay inside intent and authority; proposal admission changes no Goal; unsupported commit is explicit; a supported amendment requires the qualified Stage 3 `GoalAmendmentAuthority` commit owner's exact receipt and peer rebase/lease disposition, never just manager or verifier prose | +| A17 | Abrupt loss before a fresh brief; replace the same Agent session with no recall provider, after an external action with uncertain outcome | Same Agent/new-session fixture preserves the work owner and does not fabricate a cross-Agent transfer grant or mutate the note merely to restore context; read back the actual claim/lease disposition. Last durable context and missing interval are explicit; reconcile uncertain effects, perform a justified next step and return without the old session | +| A18 | Old session stays live or returns; concurrent replacement, cancellation and a late correction | Make the stale executor actually attempt a conflicting Core and external effect after replacement: reject at the owning enforceable boundary, or withhold replacement execution where fencing is failed/unsupported. Reconcile already submitted effects; test late return/correction/cancellation and read back current binding/claim; no duplicate effect or false cancellation | +| A19 | Decision-gap recall with same-Agent replacement versus another Agent; disabled provider, stale index, timeout and zero hits | Stage 1 never auto-calls; Stage 2 requires qualified admission/readback. Reject out-of-scope returned rows; another Agent receives only explicitly authorized source-authored context, not raw private provider hits or archive access. No source impersonation; zero hits preserve unknown; no-provider continuation works; revalidate historical facts | +| A20 | Context compaction and bounded projection omit a material rejected approach or unresolved question | Coverage exposes the omission; authorized drill-down restores required context or records a real gap; no unbounded TurnEnvelope, lost obligation or false completed handoff; frontend/Lark/CLI show the same actual restoration and result | Run deterministic transition/compatibility tests, real installed-runtime qualification, then real frontend/Lark roundtrips with synthetic safe tasks and an authorized private canary. Record runtime/source versions and emitted receipts. Include mobile Lark and packaged frontend render/readback; backend tests alone do not pass A10. Provider receipt ambiguity and offline failure cases are required, not optional happy-path add-ons. @@ -411,8 +467,8 @@ Implement coherent end-to-end slices, not one PR per incidental field. The manag | --- | --- | --- | --- | | M0 — reconcile direction | Manager capability owner inventories current restrictions, grants, sessions and pending exchanges; closes superseded #4306 path and maps surviving fixes | Existing fixtures + public decision link + no orphaned request; no runtime claim | Documentation/proposal only | | M1 — useful host agent | Manager capability + runtime adapter use ordinary tools/skills and persistent owner grant; frontend exposes effective profile/session, supported tool activity and actionable failures | A1–A3, A12 on real installed runtime; qualify shared-resource coordination; portfolio remains reusable; no per-resource wrapper required | Restore restricted profile, preserve requests | -| M2 — semantic continuation | Core collaboration replaces manager-specific request transitions; reuses alignment and selected work authority; supports pre-Todo/cross-Goal requests and receiver planning; both consumers qualify the same contract | A4–A7, A11, A13–A16 at the supported boundary; old/new parity and crash reconciliation; TS migration economics review artifact (§5.12) | Disable new producer, retain compatible readers and pending results; do not switch Goal authority | -| M3 — automatic complete exchange | Receiver conclusion + existing outbox + frontend/Lark visibility, safe rich output and restart recovery | A8–A10 plus A13–A14 return-path qualification; failure injection and live readback; user receives conclusion without querying | Keep result store, switch transport/profile without replay | +| M2 — semantic continuation | Core collaboration replaces manager-specific request transitions; reuses alignment and selected work authority; supports pre-Todo/cross-Goal requests and receiver planning; both consumers qualify the same contract | A4–A7, A11, A13–A20 at the supported boundary; A19 requires honest disabled/unqualified behavior and does not mandate Obelisk promotion; old/new parity and crash reconciliation; TS migration economics review artifact (§5.12) | Disable new producer, retain compatible readers and pending results; do not switch Goal authority | +| M3 — automatic complete exchange | Receiver conclusion + existing outbox + frontend/Lark visibility, safe rich output and restart recovery | A8–A10 plus A13–A14/A17/A20 return-path qualification; failure injection and live readback; user receives conclusion without querying | Keep result store, switch transport/profile without replay | | M4 — promotion and retirement | Three heterogeneous active Goals, owner + shared-scope and configured SSH journeys pass; obsolete manager restrictions/compatibility seams removed | All acceptance rows, permission regression and measured SLO/cost; document remaining unqualified hosts | Scoped rollback with schema-aware drain/export | M1 need not wait for a generic handoff refactor. M3's independent format/delivery fixes may ship early using the existing inbox. M2 promotion needs the second consumer; it must not hold a useful manager-only improvement hostage. No milestone creates an extra user confirmation for routine research or normal delegation. @@ -427,8 +483,11 @@ Each implementation Todo declares target capability, repository, write scope, va | M2 request transaction replacement | TS T0 caller/source inventory within the implementation PR; characterized current request/receipt behavior; one writer and lossless migration | A new daemon, PostgreSQL service, D3 cutover, shared Goal amendments | Request identity/assessment/result in one typed domain; old request writer retired at the bounded cutover; unchanged external work owners | | M2 receiver and authority integration | Existing alignment/admission and current Todo/Vision/lease commands; request effect/recovery seam; each affected command's supported transaction contract | Closing unrelated T1/T2/T3 consumers or promoting every provider | A15 on disposable legacy/canonical fixtures; A16 proves lane/admission boundaries; unsupported work effects remain explicit | | M3 complete exchange | Committed result and exact request/work receipt relationships; supported runtime and Lark/frontend adapters | M2 completion for independent format/retry fixes | Generic producer integration follows M2; early fixes preserve the existing owner and cannot claim the new schema shipped | +| M2 session restoration (§5.7) | Existing host resume/start API, scoped brief references, actual runtime binding/resource guard and applicable work authority | Historical indexing, Obelisk installation, Goal-wide storage promotion | A13/A17/A18/A20 on supported same-Agent replacement; source loss and a returning old executor included; unsupported takeover cannot be advertised | +| M2 worker takeover + M3 return (§5.13) | Shared request/assessment contract, qualified transfer owner where needed, scoped artifact resolution and existing outbox | Broader archive search; consultation needs no claim transfer | A5/A6/A7/A14/A18/A20 through the real CLI and frontend/Lark adapters; execution takeover and answer delivery have separate receipts | +| Optional recall-assisted restoration (§5.7.4) | Obelisk's own packaging/privacy/structured-result qualification and admitted caller stage under `agent-turn-recall` | M2/M3 basic continuation; no-provider path ships independently | A19 plus matched continuation tasks showing reduced reconstruction/repeated failure without correctness or scope regressions; operator-only remains so until cold-path promotion | | Governed shared-amendment integration | Alignment Stage 3's qualified commit class, policy/verifier, lease impact and exact-basis receipt | Unrelated manager UX improvements | Conditional follow-up owned jointly with alignment; no implementation of a second `GoalAmendmentAuthority` | -| M4 manager promotion | Qualified M1–M3 and A1–A16 for advertised profiles, including unsupported-amendment negative cases | Provider-wide migration, ten-day storage soak for an unchanged existing profile, or a PostgreSQL rollout | Promote only manager/handoff behavior. New storage/default/shared-amendment capabilities retain their separate gates | +| M4 manager promotion | Qualified M1–M3 and applicable A1–A20 for advertised profiles, including disabled/unqualified recall and unsupported-amendment negative cases | Provider-wide migration, ten-day storage soak for an unchanged existing profile, or a PostgreSQL rollout | Promote only manager/handoff behavior. New storage/default/shared-amendment capabilities retain their separate gates | If this program changes a provider, retention or authority-source profile, its affected D1/D2/D3 requirements become hard dependencies; manager acceptance cannot waive the required ten-day soak or cutover approval. A13's continuation test and D2's storage soak measure different things. An existing profile used unchanged does not acquire a new ten-day gate merely because a manager reads it. @@ -436,11 +495,13 @@ If this program changes a provider, retention or authority-source profile, its a 1. **Start M1; finish baseline reconciliation in that PR.** Record the exact source head and actual runtime/entrypoint call sites. Fix the owner-private profile and existing readback/feedback. Run A1–A3/A12. Do not deliver a standalone inventory framework. 2. **Replace one complete M2 request transaction, then attach receivers.** Begin from `manager_context` request/tracking/return producers and both real consumers, including the shipped #4094 CLI continuation adapter (§5.13). Publish the before/after ownership map, migration mapping and the migration economics review artifact (§5.12). Preserve accepted work state through existing commands; qualify crash-between-commits and legacy/promoted sources before widening producer rollout. Use existing alignment source-basis reads, not a copied classifier. -3. **Close M3 automatic return and user visibility.** Independent reply recovery can ship in parallel with steps 1–2. Integrate the generic producer only after its receipt contract is stable; exercise A8–A10 and A13–A16 across the actual entrance/receiver/return paths. Update packaged frontend, Lark and CLI from the same projection. +3. **Close M3 automatic return and user visibility.** Independent reply recovery can ship in parallel with steps 1–2. Integrate the generic producer only after its receipt contract is stable; exercise A8–A10, A13–A16 and A17/A20 across the actual entrance/receiver/return paths. With the source session gone, verify the same committed result/outbox identity, reconnect recovery and audience isolation through packaged frontend, Lark and CLI readback. 4. **Promote a named M4 cohort and remove the replaced paths.** Keep provider default, Goal-intent authority and capability qualifications explicit. Shared-amendment commit integration follows its upstream readiness; until then the UI says proposal/admission or unsupported commit, never “Goal changed.” Provider source migration follows the shared-authority program rather than this release. At every PR handoff, report: base/head; this RFC's milestone/acceptance IDs; relevant TS T-card and authority D-card if affected; alignment stage consumed; exact owner/command/receipt and source mode; callers deleted; tests/real-runtime evidence; unresolved holds; and one next executable step. Link the existing canonical engineering Todos rather than copying a live task list into this document. If upstream ownership moves, resolve the new symbol and update both language versions before implementing; do not restore the old module just to satisfy this plan. +Cross-session sequencing inside these milestones is explicit: first qualify same-Agent replacement with history retrieval disabled; then cross-Agent continuation through the existing transfer adapter; then qualify optional gap recall under its own rollout. Each slice includes the affected CLI/managed Turn, packaged frontend and Lark readback/feedback, rather than deferring product entry points to a later backend-only release. Measure time to the first valid continuation step, retained material obligations, avoided repeated failures, duplicate effects and context cost. More restored tokens or a successful `resume` response alone is not improvement. + ## 12. Open decisions 1. **Trusted-host profile defaults:** maintainers own promotion. Recommend using the effective owner runtime profile with explicit resource/audience binding, not a new manager ACL language. Before M1, qualify actual read/write/network/approval behavior and migration from existing grants. diff --git a/docs/architecture/rfcs/capable-manager-semantic-handoff-v0.zh-CN.md b/docs/architecture/rfcs/capable-manager-semantic-handoff-v0.zh-CN.md index 6802ab8de4..9a480cb812 100644 --- a/docs/architecture/rfcs/capable-manager-semantic-handoff-v0.zh-CN.md +++ b/docs/architecture/rfcs/capable-manager-semantic-handoff-v0.zh-CN.md @@ -208,10 +208,62 @@ LoopX 不是只有任务队列。交接应让接收方结合权威状态和持 ### 5.7 会话与产品连续性 -一个管家身份拥有按受众/授权划分的逻辑对话；兼容时在同一 runtime home 恢复 upstream thread。每轮刷新当前 Core 与未解决请求，不能把会话记忆当当前事实。scope/tool 不兼容或 session 丢失时，从持久上下文恢复并记录原因，保留未完成工作。普通上下文更新不应总重建线程；不跨 home 搬 runtime 数据库行。 +**跨 session 续接是明确的产品旅程，不是转发聊天记录。** 用户只需说一次“换个会话/Agent 继续，结果还回这里”。在现有授权内，宿主准备上下文、选择可用续接路径、呈现给接收方并自动回报结论。接收方重新判断工作；用户不用导出 JSON、重复背景或批准常规恢复。管家和干活 Agent 都遵循此契约。 + +#### 5.7.1 选择续接路径 + +区分逻辑对话/请求、注册 Agent、runtime home、执行 session、turn/attempt 身份。逻辑对话仍按受众/授权隔离。换执行 session 不创建新的用户请求，也不清空未结义务。实际绑定由 runtime adapter 解析；正文中的 session ID 不等于发现结果或授权。 + +| 情况 | 上下文恢复 | 执行边界 | +| --- | --- | --- | +| 同一 runtime home 内恢复兼容会话 | 用宿主正式 API resume，刷新当前工作和未结请求 | 保留现有执行绑定，仍检查当前授权/claim；不转移所有权 | +| 同一 Agent 替换丢失、不兼容或耗尽的会话 | 用受支持宿主 adapter 启动，带入有范围的语义 brief 和当前工作引用 | 绑定新实例前对账旧实例；Agent 身份本身不能隔离仍运行的旧 session | +| 另一个注册 Agent 接手 | 投递同一上下文契约，由接收方判断所需范围 | 咨询/委托不转移既有所有权。转移意图走当前工作 owner 已验收的 claim/lease 路径；Stage A 仅用于其支持边界（§5.13） | + +宿主支持兼容续接时，不因换模型就重建会话。普通上下文刷新、压缩复用已有路径。若不支持 resume/start，保留请求并说明准确 adapter 缺口，不能把 inbox 落盘说成会话已启动。跨主机另需有权限的工件解析与传输；不能跨 home 复制 runtime 数据库行或 rollout 文件来冒充可恢复会话。 + +#### 5.7.2 准备稠密、有界的续接 brief + +用当前 canonical 工作和来源说明组合 §5.10 `SemanticContext`，不新增平行 checkpoint 数据库，不嵌入所有 Todo 的可编辑副本。brief 回答： + +- 欠谁什么结果，哪些问题还没解决？ +- 哪些约束、已接受决策和后续纠正约束下一步？ +- 试过什么、否决什么、哪里不确定，原因和证据是什么？ +- 哪些已完成、哪些效果可能仍在执行，准确回执在哪里？ +- 需要哪些工件/worktree 版本，接收方怎么读，哪些尚未核验？ +- 来源建议下一步做什么，哪些需要接收方重新判断？ + +保留当前请求/brief digest、工作基线、工件引用和返回路径。source session/turn 是来源，不携带权限。历史观察与当前事实分开，建议与已接受承诺分开。必要时将未提交修改保存为有权限的版本化工件；单个 Git commit 或路径不能保住 dirty work、运行终端或浏览器执行状态，这些事实仍归既有资源 owner。 + +在接受计划/结果变化、受支持的压缩前或显式交接边界，复用既有 completion/context hook。brief 持久化后才确认准备成功，关联已接受基线，不虚构与独立工作存储的原子提交。突然退出可能只剩上次持久 brief；恢复该版本并说明缺失区间，不能要求已不可用的源 Agent 必须先生成新 note 才允许一切恢复。大证据放在有权限引用后，显式展示遗漏，不整体放大 TurnEnvelope。 + +#### 5.7.3 恢复、重新判断、安全接管 + +adapter 在既有请求 observation 旁记录所选路径/原因和真实 session/turn 绑定。这是拟议的 adapter 投影，不是新工作状态 owner。接收 turn 完成一个连贯的续接步骤： + +1. 读取最新请求、所选当前工作 authority、有权限的 brief/工件。规划前对账纠正、取消和已提交结果，说明不可读或过期材料。 +2. 必要且准入时按 §5.7.4 补决策相关缺口。重新判断接受/延后/拒绝范围，保留未结义务，记录真实计划变化。读到包不等于完成判断。 +3. 受影响的执行前，对账未结效果并满足既有工作/资源所有权边界。同 Agent 替换复用真实 runtime 执行实例 guard 及适用 claim/lease；跨 Agent 转移取得实际 owner 的准确回执。新的 session-binding 版本或历史 note 都不能自行产生 fence。 +4. 执行有根据的下一步并关联证据，通过既有请求/outbox 关系提交应回报的结果。即使发起 session 消失，仍发往逻辑返回路径。 + +若旧实例可能仍执行，先经受支持机制停止其相关执行或施加 fencing，读回核实后才启动冲突 writer。没有可强制执行 fencing 的 runtime，不能宣称无人值守的有副作用接管；它可以准备上下文、独立只读取证，同时明确冲突。不为掩盖此限制另建 lease 服务。lease 过期不取消已提交的外部动作，不确定效果必须对 provider 对账而非重放。旧会话若后来恢复，下一次受控效果前必须刷新 ownership/binding。恢复期间的新纠正要求重核基线，不能按旧 brief 重复执行。 + +#### 5.7.4 经已有 recall 边界补历史缺口 + +[Xiaods 的 #4094](https://github.com/huangruiteng/loopx/pull/4094) 提供主动导出工作上下文和 revision-guarded 所有权接续。[Obelisk RFC](obelisk-session-evidence-provider-v0.zh-CN.md) 处理另一种缺失：当前状态能定位工作，却没保存早期原因或失败尝试。其调研支持评估定向纵向召回，不能预设导入更多 transcript 会提升效果。两者复用，不复活已退役的通用 memory-substrate 存储。 + +恢复先读 canonical 工作与引用的 brief。只有剩下会影响决策的缺口，才产生已有 `agent-turn-recall` 的 `resume_or_handoff_gap` situation，例如“该版本为什么否决这条路线”。从缺口生成有界检索词，不传整段对话。provider 与调用阶段都已验收并启用时，消费带来源、scope、revision/freshness、遗漏的 typed historical-evidence result。接收方结合当前事实核对适用性；检索本身不采纳计划、不结算工作、不晋级 Reward Memory。 + +Obelisk 初始试点仍可选、默认关闭，限定**同 Agent、同项目/仓库**。该 Agent 的替换 session 可在范围内准入；另一个接收者不继承源 Agent 的 archive 读取权。跨 Agent 交接时，来源可以明确将有权限的证据摘录纳入 brief；接收者检索来源的 archive 则需要独立配置并验收更广 scope，不能冒充来源或从交接推导权限。原始命中留私有；渠道只收到受众允许的 brief/结果，以及 provider 契约允许的召回覆盖说明。 + +provider 缺失、索引过期/不完整、超时、零命中，保留 typed gap 并用已有证据继续。这不证明从未做过，也不新增常规人工门禁。只暂停确实仍缺必要前提的动作，独立工作继续。没有历史 provider 时也必须通过基础续接。operator-only 试点在 Obelisk 后续 cold-path 阶段验收前仍只能显式调用；M2/M3 不悄悄开启自动索引、改变许可/打包或扩大检索。 + +#### 5.7.5 展示续接并闭合原交互 前端和飞书共享请求/结果身份与已授权事实；等价授权入口可展示同一对话，其他群不能收到私人历史。前端展示会话、worker、brief、当前工作/结果和投递状态。保存了但未送达飞书的答案，明确显示并可恢复，不重跑工作。飞书提供及时收到反馈、实质结论和必要下一步；长内容通过分段或可读附件保留，不要求用户追问每次交接去哪了。 +“正在恢复上下文”“接收方已判断”“已接管执行”“结论已送达”都必须对应真实 observation。前端显示实际续接方式、替换原因、相关上下文缺口和可展开证据；飞书自动报告有意义的接管、需处理的未结问题和最终结论，不逐个内部状态刷屏。CLI/managed Turn 消费同一投影。只读 inbox 不能显示接管成功，换 session 也不能让 pending 结果失去去向。 + 协议效果与可见正文分离。宿主支持时，用工具/函数调用和 typed receipt 承载操作；兼容解码器隔离异常控制 envelope，只恢复独立有效的正文。绝不能从恢复文本推导或执行控制效果。格式失败属于传输故障，不是让模型重新工作的理由。 ### 5.8 把多条消息作为一次真实工作来承接 @@ -392,6 +444,10 @@ M0 盘点真实字段和 producer；以下是迁移验收底线，不代表已 | A14 | 交接带相关图片/文档，经纯文本入口到另一已配置主机 | 接收方 observation 关联实际读取/提取、工件版本及对义务/计划的影响，或明确未读原因；不伪造读取回执、不泄露私人信息、不依赖发送方本地路径 | | A15 | 同一交接 fixture 对比未晋级与显式配置的已晋级 Goal source；provider 离线、请求/工作提交间崩溃 | 唯一所选工作状态 writer；canonical 空/失败不回退；恢复并关联原工作回执、不重复效果；请求 pending 关系与工作已提交分开 | | A16 | 接收方路线重规划与共享 amendment、过期基线、同伴持有工作 | 路线修改不越意图/权限；提案准入不改 Goal；未支持的 commit 明确；已支持 amendment 需要已验收 Stage 3 `GoalAmendmentAuthority` commit owner 精确回执及 peer rebase/lease 处置，不能只凭管家或 verifier 文本 | +| A17 | 新 brief 保存前突然退出；无 recall provider 下更换同 Agent session，存在结果不确定的外部动作 | 同 Agent/新 session fixture 保留工作 owner，不伪造跨 Agent transfer grant、不仅为恢复上下文修改 note；读回实际 claim/lease 处置。明确最后持久上下文和缺失区间；对账不确定效果，执行有根据的下一步，无旧 session 仍回原路径汇报 | +| A18 | 旧 session 仍活跃或后来恢复；并发替换、取消和迟到纠正 | 替换后让旧执行者真实尝试冲突 Core 及外部效果：在所属可强制边界拒绝；若 fencing 失败/不支持，则不得启动替换者的冲突执行。对账已提交效果，覆盖迟到恢复/纠正/取消，读回 binding/claim；不重复效果、不误报取消 | +| A19 | 同 Agent 替换与跨 Agent 的决策缺口召回；provider 关闭、索引旧、超时、零命中 | Stage 1 不自动调用；Stage 2 需已验收准入/读回；越 scope 返回行拒绝。另一 Agent 只收明确授权的来源撰写上下文，不收原始私有 provider 命中或 archive 权限。不冒充来源；零命中保留未知；无 provider 续接可用；采用历史事实前重核 | +| A20 | 压缩和有界投影遗漏重要否决路线或未结问题 | 覆盖说明暴露遗漏；有权限下钻恢复必要上下文或记录真实缺口；不无限放大 TurnEnvelope、不丢义务、不误报交接完成；前端/飞书/CLI 展示同一真实恢复和结果 | 先跑确定性转移/兼容测试，再真实安装 runtime 验证，再用无副作用合成任务和已授权私人 canary 做前端/飞书回环。记录源码/runtime 版本和回执。包含移动端飞书、打包前端渲染/读回；后端单测不等于 A10。provider 送达不确定、离线失败必须验，不只有成功路径。 @@ -411,8 +467,8 @@ M0 盘点真实字段和 producer；以下是迁移验收底线，不代表已 | --- | --- | --- | --- | | M0：统一方向 | manager capability owner 盘点限制、授权、session、待结交互；关闭过时 #4306 路线并关联保留修复 | 基线 fixture、公开裁决链接、不丢请求；不宣称 runtime 变化 | 仅文档/提案 | | M1：真正能干活的本机 Agent | manager capability + runtime adapter 使用普通工具/skill、持续授权；前端显示有效 profile/session、受支持的工具活动和可处理失败 | 真实 runtime A1–A3、A12；核验共享资源协调；复用 portfolio，不新建逐资源包装 | 回受限 profile，保留请求 | -| M2：语义续接 | Core collaboration 替换管家专用请求转移；复用 alignment 与所选工作 authority；支持先于 Todo/跨 Goal 请求和接收方规划；两种消费者验证同一契约 | 受支持边界上的 A4–A7、A11、A13–A16；旧/新等价、崩溃对账、TS migration economics 审阅工件（§5.12） | 关新 producer，保兼容 reader、pending 结果；不切换 Goal authority | -| M3：一次完整交互 | 接收方结论、已有 outbox、前端/飞书可见、富文本与重启恢复 | A8–A10 与 A13–A14 回传验收；故障注入和真实读回；不用再追问便收到结论 | 保结果存储，换传输/profile 不重放 | +| M2：语义续接 | Core collaboration 替换管家专用请求转移；复用 alignment 与所选工作 authority；支持先于 Todo/跨 Goal 请求和接收方规划；两种消费者验证同一契约 | 受支持边界上的 A4–A7、A11、A13–A20；A19 要求如实处理关闭/未验收状态，不强制 Obelisk 晋级；旧/新等价、崩溃对账、TS migration economics 审阅工件（§5.12） | 关新 producer，保兼容 reader、pending 结果；不切换 Goal authority | +| M3：一次完整交互 | 接收方结论、已有 outbox、前端/飞书可见、富文本与重启恢复 | A8–A10 与 A13–A14/A17/A20 回传验收；故障注入和真实读回；不用再追问便收到结论 | 保结果存储，换传输/profile 不重放 | | M4：晋级并退役旧路径 | 三个异构活跃 Goal、主人/共享受众、配置 SSH 旅程通过；删旧限制和过渡兼容层 | 全验收、权限回归、实测 SLO/成本；列出未验证宿主 | 按 scope 回滚、schema-aware drain/export | M1 不必等通用 handoff 重构。M3 独立的格式/投递修复可先用已有 inbox 上线。M2 的通用晋级需要第二消费者，但不能因此拖住已经有用的管家局部改善。各里程碑不新增常规研究或普通委托的人工确认。 @@ -427,8 +483,11 @@ M1 不必等通用 handoff 重构。M3 独立的格式/投递修复可先用已 | M2 请求事务替换 | 实现 PR 内完成 TS T0 caller/source 盘点；现有请求/回执 characterization；唯一 writer 与无损迁移 | 新 daemon、PostgreSQL 服务、D3 切换、共享 Goal amendment | 请求身份/评估/结果归一个 typed domain；有界切换时退役旧请求 writer；外部工作 owner 不变 | | M2 接收方与 authority 衔接 | 已有 alignment/admission 和 Todo/Vision/lease 命令；请求 effect/recovery 接缝；受影响命令的可用事务契约 | 关闭无关 T1/T2/T3 消费者、晋级全部 provider | disposable legacy/canonical fixture 上 A15；A16 验证路线/准入边界；未支持工作效果明确 | | M3 完整交互 | 已提交结果和准确请求/工作回执关系；受支持 runtime 与飞书/前端 adapter | 独立格式/重试修复不等 M2 完成 | 通用 producer 集成在 M2 后；早期修复保留既有 owner，不能宣称新 schema 已交付 | +| M2 session 恢复（§5.7） | 既有宿主 resume/start API、有范围 brief 引用、真实 runtime binding/resource guard 和适用工作 authority | 历史索引、安装 Obelisk、全 Goal 存储晋级 | 受支持同 Agent 替换上 A13/A17/A18/A20；含来源消失与旧执行者返回；不宣传未支持的接管 | +| M2 worker 接管 + M3 回传（§5.13） | 共享请求/判断契约、必要时已验收 transfer owner、有权限工件解析、既有 outbox | 更广 archive 检索；咨询不需转 claim | 真实 CLI 与前端/飞书 adapter 上 A5/A6/A7/A14/A18/A20；接管执行与答案送达各有回执 | +| 可选 recall 辅助恢复（§5.7.4） | Obelisk 自身打包/隐私/结构化结果验收，以及 `agent-turn-recall` 下已准入 caller 阶段 | M2/M3 基础续接；无 provider 路径独立交付 | A19 加配对续接任务，证明降低重建/重复失败且不退化正确性或 scope；cold-path 晋级前维持 operator-only | | 受控共享 amendment 衔接 | 对齐 Stage 3 已验证 commit class、policy/verifier、lease 影响与精确基线回执 | 无关管家体验改进 | 与 alignment owner 共管的条件式后续，不另建 `GoalAmendmentAuthority` | -| M4 管家晋级 | 已验证 M1–M3，以及所宣传 profile 的 A1–A16，含不支持 amendment 的负例 | 全 provider 迁移、不变既有 profile 的重新十日 soak、PostgreSQL 部署 | 仅晋级管家/handoff 行为；新存储/默认/shared-amendment 能力保留独立门槛 | +| M4 管家晋级 | 已验证 M1–M3，以及所宣传 profile 适用的 A1–A20，含关闭/未验收 recall 和不支持 amendment 的负例 | 全 provider 迁移、不变既有 profile 的重新十日 soak、PostgreSQL 部署 | 仅晋级管家/handoff 行为；新存储/默认/shared-amendment 能力保留独立门槛 | 若本计划改变 provider、保留规则或 authority-source profile，受影响的 D1/D2/D3 就成为硬前置；管家验收不能豁免十日 soak 或切换批准。A13 续接测试和 D2 存储 soak 衡量不同问题。不变地使用既有 profile，不因管家读取它就新加十日门槛。 @@ -436,11 +495,13 @@ M1 不必等通用 handoff 重构。M3 独立的格式/投递修复可先用已 1. **启动 M1，在该 PR 内完成基线对齐。** 记录精确 source head、真实 runtime/入口 caller；修主人私人 profile 和已有读回/反馈；验 A1–A3/A12。不单独交付盘点框架。 2. **替换一个完整 M2 请求事务，再接接收方。** 从 `manager_context` request/tracking/return producer 和两种真实消费者开始，提交前后 owner 图、迁移映射、migration economics 审阅工件（§5.12）。工作状态继续走已有命令；扩大 producer 上线前验提交间崩溃和 legacy/promoted source。复用 alignment source-basis 读取，不复制分类器。 显式纳入已交付 #4094 CLI 接续 adapter（§5.13）。 -3. **收口 M3 自动回传和用户可见性。** 独立正文恢复可与前两步并行；通用 producer 待回执契约稳定再接。沿真实入口/接收方/返回路径验 A8–A10、A13–A16；同一投影更新 packaged frontend、飞书、CLI。 +3. **收口 M3 自动回传和用户可见性。** 独立正文恢复可与前两步并行；通用 producer 待回执契约稳定再接。沿真实入口/接收方/返回路径验 A8–A10、A13–A16、A17/A20；在来源 session 已消失时，通过 packaged frontend、飞书、CLI 读回核实同一已提交结果/outbox 身份、重连恢复和受众隔离。 4. **晋级指定 M4 cohort，并删除被替换路径。** 明确 provider 默认、Goal-intent authority、capability 资格。共享 amendment commit 待上游就绪；此前 UI 只能说提案/准入或不支持提交，不能说“Goal 已修改”。provider source 迁移按 shared-authority 计划，不夹进本次发布。 每次 PR 交接记录：base/head、本 RFC 里程碑/验收 ID、受影响的 TS T-card 与 authority D-card、消费的 alignment stage、确切 owner/command/receipt 与 source mode、删除 caller、测试/真实 runtime 证据、保留门槛、一个可执行下一步。链接已有 canonical 工程 Todo，不在本文复制动态任务清单。上游 owner 移动时，先解析新符号并同步双语，再实施；不为迁就计划恢复旧模块。 +里程碑内明确跨 session 顺序：先在历史检索关闭时验收同 Agent 替换，再经既有 transfer adapter 验跨 Agent 续接，最后按独立 rollout 验收可选缺口召回。每个切片都包含受影响的 CLI/managed Turn、打包前端、飞书读回/反馈，不推迟到后续 backend-only 版本。衡量首次有效续接动作耗时、重要义务保留、避免的重复失败、重复效果和上下文成本。恢复更多 token 或 `resume` 返回成功，本身不是改进。 + ## 12. 待定决策 1. **可信主机默认 profile：** 维护者负责晋级。推荐复用主人 runtime 的实际 profile，绑定资源/受众，不发明管家 ACL 语言。M1 前核验读/写/网络/approval 行为与旧授权迁移。 diff --git a/docs/architecture/rfcs/cross-session-memory-substrate-v0.md b/docs/architecture/rfcs/cross-session-memory-substrate-v0.md index 09b5a838bb..8298fa68f2 100644 --- a/docs/architecture/rfcs/cross-session-memory-substrate-v0.md +++ b/docs/architecture/rfcs/cross-session-memory-substrate-v0.md @@ -6,6 +6,8 @@ Stage A shipped in [#4094](https://github.com/huangruiteng/loopx/pull/4094), mer Reuse rich/legacy context and the existing note validator/claim transfer boundary. Receiver acceptance of a suggestion is distinct from `handoff adopt` ownership mutation. Stage A's note is replaceable current Todo state, not a private immutable history. The successor maps authorized context to a recoverable brief, references current work, and supplies general assessment/result/automatic-return relations without adding a memory ledger or copying claim authority. CLI `prepare/inspect/adopt` remains usable during migration; frontend/Lark and automatic host continuation must be qualified separately. Same-host, registered-agent, lease-free restrictions continue to apply to this adapter, not every general request. See successor §5.13 for mappings, migration conditions and retained negative cases. +The successor [§5.7](capable-manager-semantic-handoff-v0.md#57-session-and-product-continuity) now distinguishes same-session resume, same-Agent session replacement and cross-Agent takeover. Only the last may require this adapter’s ownership mutation. Automatic brief capture, source-loss recovery, executable-session fencing and original-route result return are explicit future integration work; optional Obelisk recall supplies missing historical evidence, not a replacement transfer grant. + Language mirror: [中文版](cross-session-memory-substrate-v0.zh-CN.md). Status: a bounded local CLI workflow. The former general memory-substrate diff --git a/docs/architecture/rfcs/cross-session-memory-substrate-v0.zh-CN.md b/docs/architecture/rfcs/cross-session-memory-substrate-v0.zh-CN.md index a46db20ad3..1103bab86c 100644 --- a/docs/architecture/rfcs/cross-session-memory-substrate-v0.zh-CN.md +++ b/docs/architecture/rfcs/cross-session-memory-substrate-v0.zh-CN.md @@ -6,6 +6,8 @@ Stage A 已在 [#4094](https://github.com/huangruiteng/loopx/pull/4094) 以 `2eb 复用 rich/legacy context、既有 note validator 与 claim transfer 边界。接收方接受建议不同于 `handoff adopt` 修改所有权。Stage A note 是可覆盖的当前 Todo 状态，不是私有不可变历史。后继方案将有权限的上下文映射为可恢复 brief，引用当前工作，补齐通用 assessment/result/自动回传关系，不新增 memory ledger 或复制 claim authority。迁移期间 CLI `prepare/inspect/adopt` 保持可用；前端/飞书及自动宿主续接单独验收。同机、注册 Agent、无 lease 限制继续适用于此 adapter，不约束所有通用请求。映射、迁移条件和保留负例见后继 §5.13。 +后继 [§5.7](capable-manager-semantic-handoff-v0.zh-CN.md#57-会话与产品连续性) 明确区分原会话恢复、同 Agent 换 session、跨 Agent 接管，只有后者可能需要本 adapter 的所有权变更。自动 brief 捕获、来源消失恢复、执行 session fencing、回原入口报结论是明确的后续集成工作；可选 Obelisk recall 只补缺失历史证据，不替代 transfer grant。 + 语言镜像：[English](cross-session-memory-substrate-v0.md)。 本阶段替代原通用 memory substrate 方案，基于 canonical Todo authority diff --git a/docs/architecture/rfcs/obelisk-session-evidence-provider-v0.md b/docs/architecture/rfcs/obelisk-session-evidence-provider-v0.md index 8f088ab579..2318dc42cb 100644 --- a/docs/architecture/rfcs/obelisk-session-evidence-provider-v0.md +++ b/docs/architecture/rfcs/obelisk-session-evidence-provider-v0.md @@ -120,6 +120,10 @@ Reward Memory. A later second caller, such as Decision Context or Explore, may reuse the provider-neutral historical-evidence contract only after a concrete need and independent admission policy exist. +### 3.2 Cross-session continuation caller + +The [capable-manager/semantic-handoff RFC §5.7](capable-manager-semantic-handoff-v0.md#57-session-and-product-continuity) proposes an explicit restoration caller for `resume_or_handoff_gap`. It first restores current work and the available deliberate continuation brief, including [Stage A](cross-session-memory-substrate-v0.md) context where applicable, then requests only missing decision evidence. This is a proposed integration, not a shipped caller or a promotion of this provider. Same-Agent replacement can satisfy the initial scope; a different receiver cannot search the source Agent's archive by inheriting a handoff. Authorized source excerpts may travel in the brief without granting archive search. The provider stages, default-off behavior, scope, private result/public receipt boundary and qualification requirements below remain unchanged. Basic continuation must work without Obelisk. + ## 4. Admission policy The provider is not called on every Turn. A typed policy admits retrieval only diff --git a/docs/architecture/rfcs/obelisk-session-evidence-provider-v0.zh-CN.md b/docs/architecture/rfcs/obelisk-session-evidence-provider-v0.zh-CN.md index 81382bf1ab..54a8b6dc7c 100644 --- a/docs/architecture/rfcs/obelisk-session-evidence-provider-v0.zh-CN.md +++ b/docs/architecture/rfcs/obelisk-session-evidence-provider-v0.zh-CN.md @@ -100,6 +100,10 @@ Obelisk Hit 是历史观察，不是 `reward_memory_active_record_v0`，不得 Memory。未来如果 Decision Context 或 Explore 出现第二个真实 Caller，应在其拥有独立 Admission Policy 后复用 Provider-neutral Historical Evidence Contract，而不是提前抽象。 +### 3.2 跨 session 续接 caller + +[强能力管家/语义交接 RFC §5.7](capable-manager-semantic-handoff-v0.zh-CN.md#57-会话与产品连续性) 提议明确的 `resume_or_handoff_gap` 恢复 caller：先恢复当前工作和已有主动续接 brief（包括适用时的 [Stage A](cross-session-memory-substrate-v0.zh-CN.md) 上下文），再只查询缺失的决策证据。这是拟议集成，不代表 caller 已交付或本 provider 晋级。同 Agent 更换 session 可满足初始 scope；另一接收者不能从 handoff 继承来源 Agent 的 archive 检索权。有权限的来源摘录可随 brief 传递，不同时授予 archive 搜索。下文 provider 阶段、默认关闭、scope、私有结果/公开回执边界及验收要求不变。基础续接必须在没有 Obelisk 时成立。 + ## 4. Admission Policy Provider 不在每个 Turn 调用。只有以下类型化 Situation 才允许检索：