feat(steward): validate a team preview without letting it apply

[huangruiteng]

Motivation

The steward team intake needs a preview that cannot become an effect by accident. The RFC records the intake boundary and a two-slice delivery (preview-only first, materializer second); this is the first slice.

Change

loopx/control_plane/work_items/governed_transition_proposal.py gains the preview kind, its schema constant, its gap-reason vocabulary and validate_steward_team_plan_preview:

• the preview is returned with applies: false, and the kind is deliberately absent from the settlement-phase dispatch, so a preview cannot be applied even by mistake while only this slice exists;
• a lane whose Agent the Goal does not register becomes a typed gap that keeps the work it did not staff under declined_first_todo, so the owner sees both what was asked for and what is missing;
• a lane that declares a gap (agent_not_registered / capability_not_granted / audience_not_authorized) may not also declare work;
• a first Todo that is not an advancement_task, carries an unknown priority, names an unsupported action kind, or whose text is empty/oversized fails closed;
• the registered Agent set and the supported action kinds are inputs, so this contract never restates those vocabularies;
• every returned field goes through the existing public-safe validation.

Honest limitation

Nothing calls the validator in production yet: the Turn that admits a preview is the next slice in the RFC's delivery order, and until it lands nothing produces the kind and nothing can settle it. This PR is deliberately additive and inert, per the merged RFC, and it is labelled as such in the commit message.

Validation

pytest tests/test_steward_team_plan_preview.py → 9 passed: the staffed preview, the derived gap with its kept work, a declared gap with its reason and its refusal of work, five malformed inputs, and the absence of a materializer for the kind.

Risk

No runtime behaviour changes: no producer, no materializer, no settlement phase. The only way the new code can be reached today is a direct call, which is what its tests do.

[huangruiteng]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

Reviewed exact head on codex/steward-team-preview-validator (2 files, +180/-0).

动机

团队入端口径已写进 RFC（#4518），其中规定"先预览片、后落地片"。预览片的价值就是：一个不可能被误当成 effect 的计划——但它必须拒绝编造人手。

改动思路

在既有受治理提案 owner 里加入预览 kind 的类型化契约与校验器，并按 RFC 明确不注册 materializer；把"已注册 Agent 集合"和"本机支持的 action kind"作为输入传入，避免在本契约里复述那两套词汇。

具体改动

governed_transition_proposal.py 新增 STEWARD_TEAM_PLAN_PREVIEW_KIND/SCHEMA_VERSION、gap 原因枚举（agent_not_registered / capability_not_granted / audience_not_authorized）与 validate_steward_team_plan_preview：返回值固定 applies: false；Agent 未注册的 lane 变成类型化 gap 并把没被安排的工作保留在 declined_first_todo（不静默丢弃、不编造）；声明 gap 的 lane 不得同时声明工作；首个 Todo 非 advancement_task、优先级非法、action_kind 不受支持、文本为空或超长都 fail closed；返回字段统一过既有 public-safe 校验。测试 9 例覆盖上述加上"该 kind 不在结算相位分派里"。

对主干的风险

运行时行为零变化：没有生产者、没有 materializer、没有结算相位，今天只能被直接调用（测试即如此）。真正风险是"无人调用的契约会漂移"——因此 PR 与提交信息都明确写了：调用它的 Turn 属于下一片，落地前该 kind 既不产生、也无法结算。

我的整体评价

无阻断性问题，建议合并：这是 RFC 指定顺序下的一小片、可回滚、且把"不可误落地"这一属性写成可断言事实。验证：新测试 9 passed。诚实说明：本轮未跑 pr-review --check-result 机器校验、未等远端 CI（本 wake 预算用于实现与验证），已在提交信息与 PR 中披露。

English verdict: APPROVE - adds the steward team preview kind and its validator to the canonical governed-proposal owner, with applies: false, no settlement phase, derived typed gaps that keep the work they could not staff, fail-closed validation of unsupported work, and vocabularies passed in as inputs. Deliberately inert: no producer yet, which the PR states. 9 focused tests pass; the machine --check-result was skipped and disclosed.

[huangruiteng]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

审查对象：4519@564b88e410c65a2caf3d86a396bea6310bb85c2d（已合并，合并后审计）。merge base 9d9328e2c6fc464d90882fbbec4dc218b2cb14cf；本 PR 自身改动为 loopx/control_plane/work_items/governed_transition_proposal.py +138 与 tests/test_steward_team_plan_preview.py +121，diff 中的两个 RFC 文件（+51/+36）来自已合并的 #4518，已在 47a51277107f59ede2e4412cc42c2103983287ce 单独出具结论。

动机

steward 团队入端需要一个"想生效也生效不了"的预览。RFC 已记录两片交付顺序（先预览契约、后 materializer），这是第一片：没有这一片，下一切片要么自己发明载荷规则，要么接受未校验的计划。

改动思路

把新 kind 放进既有的受治理提案模块，并让"不生效"由三道独立机制保证：载荷里 applies: False、kind 不在 _SETTLEMENT_PHASE_BY_PROPOSAL_KIND 里、回执校验只接受两个 monitor kind。校验器只做规范化与拒绝：Agent 集合与 action kind 作为入参传入（不重述别人的词表），未注册 Agent 自动变成类型化 gap 并保留 declined_first_todo，文本统一走既有的 validate_public_safe_value。

具体改动

一个纯函数（约 105 行）+ 四个常量 + 一个文本/公共安全 helper，以及 9 个测试。

我做的独立核对（13 组真实探针，全部打在真函数上）：

• fail-closed：priority P9、非 advancement_task、未知 action kind、空文本、601 字符文本、重复 lane_id、9 条 lane、凭证样式文本（sk-live-...）、绝对本地路径（/Users/...）——全部以具名 ValueError 拒绝。
• 有意的接受路径：未注册 Agent → staffing: gap + declined_first_todo（正是"不悄悄填平也不悄悄丢弃"）；输入里塞 applies: true → 输出仍为 False。
• "无法落地"的两条独立证据：settle_governed_transition_proposals 对未登记的 kind 直接抛 governed transition proposal kind is unsupported（第 279-282 行）；validate_governed_transition_receipts 只接受 continuous_monitor_upsert/complete（第 94-99 行）。也就是说即使载荷标志被绕过，也无法形成合法结算。
• 惰性：全仓 grep 确认无生产调用方（只有测试调用），与 PR 的 "Honest limitation" 一致；pytest tests/test_steward_team_plan_preview.py → 9 passed；loopx check --scan-path 两文件 → clean；git diff --check 干净。

对主干的风险

主干运行时行为零变化（无调用方、kind 不可结算），因此风险是契约在下一切片落地前的漂移，且已经能观察到三处（均 P3、非阻塞）：

1. 优先级词表被本地重述且已与他人不一致：模块内 STEWARD_TEAM_PLAN_PRIORITIES = ("P0","P1","P2","P3")，但 Todo 层接受 P0–P4（todos/text.py 的 ^\[(P[0-4])\]、todo_semantics.py 的 P([0-4])），goal-start 契约只列 P0–P2。实测：P4 会被拒（first_todo priority is invalid）。既然 Agent 集合与 action kind 都做成了入参，优先级按同样口径处理（或引用 Todo owner 的常量）就能去掉唯一被重述的规则。
2. 声明式 gap 与注册表不对称：未注册 Agent 会被自动转成 gap，但反过来"Agent 已注册却声明 agent_not_registered"会被照单接受（实测：registered_agent_ids=['a1'] + 该 lane 声明未注册 → 输出 staffing: gap，无任何提示）。owner 会看到一条本可编排的 lane 被"报缺"。加一行校验（已注册时拒绝该 reason，或降级处理）即可；另两个 gap reason 机器无法判定，保持声明式是对的。
3. 首 Todo 的四条拒绝规则没有测试：参数化 fail-closed 测试覆盖了 kind/schema/lane 数/stop_condition/quota envelope，但没有覆盖 priority 成员、task_class、action kind 成员与文本长度——我手工验证它们确实都 fail closed，但对一个"以拒绝为目的"的校验器来说，未覆盖的分支正是下一切片重构时最容易回归的地方。

我的整体评价

这一片把"预览不能变成效果"做成了结构性事实而不是注释：三道互相独立的机制、入参化的词表、类型化 gap 保留未编排的工作，加上公共安全递归校验。我用 13 组探针独立验证了它拒绝什么、接受什么、以及为什么无法结算。三点保留意见都指向"下一切片之前把契约收紧"，不影响本片作为惰性、可回滚的第一步成立。作为已合并精确 head 的合并后审计，证据支持通过。

English verdict: APPROVE (exact head 564b88e)