test(control-plane): restore stale CI contracts

loopx/semantics/project_registry_io_manifest_v1.json

@@ -189,6 +189,14 @@
       "api": "load_registry",
       "classification": "codec_api"
     },
+    {
+      "site": "loopx/capabilities/manager_context/discovery.py::<module>.agent_page::codec_read:decode_registry_snapshot#1",
+      "line": 38,
+      "column": 20,
+      "kind": "codec_read",
+      "api": "decode_registry_snapshot",
+      "classification": "codec_api"
+    },
     {
       "site": "loopx/capabilities/manager_context/evidence_export.py::<module>.export_page::codec_read:load_registry#1",
       "line": 12,
@@ -639,7 +647,7 @@
     },
     {
       "site": "loopx/cli_commands/quota.py::<module>._dispatch_quota_turn_start_hooks::codec_read:load_registry#1",
-      "line": 264,
+      "line": 267,
       "column": 37,
       "kind": "codec_read",
       "api": "load_registry",
@@ -879,8 +887,8 @@
     },
     {
       "site": "loopx/control_plane/coordination/runtime_shadow.py::<module>.build_runtime_shadow_source_snapshot::codec_read:load_registry#1",
-      "line": 362,
-      "column": 16,
+      "line": 301,
+      "column": 20,
       "kind": "codec_read",
       "api": "load_registry",
       "classification": "codec_api"
@@ -1023,79 +1031,79 @@
     },
     {
       "site": "loopx/control_plane/goals/deletion_service.py::<module>._execute_deletion::codec_transaction:project_registry_transaction#1",
-      "line": 597,
+      "line": 596,
       "column": 21,
       "kind": "codec_transaction",
       "api": "project_registry_transaction",
       "classification": "codec_api"
     },
     {
       "site": "loopx/control_plane/goals/deletion_service.py::<module>._load_locked_payloads::direct_json_read:read_json#1",
-      "line": 433,
+      "line": 432,
       "column": 9,
       "kind": "direct_json_read",
       "api": "read_json",
       "classification": "global_registry_io"
     },
     {
       "site": "loopx/control_plane/goals/deletion_service.py::<module>._load_locked_payloads::codec_read:load_registry#1",
-      "line": 435,
+      "line": 434,
       "column": 14,
       "kind": "codec_read",
       "api": "load_registry",
       "classification": "codec_api"
     },
     {
       "site": "loopx/control_plane/goals/deletion_service.py::<module>._load_locked_payloads::direct_json_read:read_json#2",
-      "line": 439,
+      "line": 438,
       "column": 22,
       "kind": "direct_json_read",
       "api": "read_json",
       "classification": "global_registry_io"
     },
     {
       "site": "loopx/control_plane/goals/deletion_service.py::<module>._resolve_route::codec_read:load_registry#1",
-      "line": 264,
+      "line": 263,
       "column": 22,
       "kind": "codec_read",
       "api": "load_registry",
       "classification": "codec_api"
     },
     {
       "site": "loopx/control_plane/goals/deletion_service.py::<module>._resolve_route::direct_json_read:read_json#1",
-      "line": 265,
+      "line": 264,
       "column": 22,
       "kind": "direct_json_read",
       "api": "read_json",
       "classification": "global_registry_io"
     },
     {
       "site": "loopx/control_plane/goals/deletion_service.py::<module>._restore_locked_registry::direct_json_write:atomic_write_json#1",
-      "line": 571,
+      "line": 570,
       "column": 5,
       "kind": "direct_json_write",
       "api": "atomic_write_json",
       "classification": "global_registry_io"
     },
     {
       "site": "loopx/control_plane/goals/deletion_service.py::<module>._write_deletion::codec_read:load_registry#1",
-      "line": 511,
+      "line": 510,
       "column": 27,
       "kind": "codec_read",
       "api": "load_registry",
       "classification": "codec_api"
     },
     {
       "site": "loopx/control_plane/goals/deletion_service.py::<module>._write_deletion::direct_json_read:read_json#1",
-      "line": 525,
+      "line": 524,
       "column": 24,
       "kind": "direct_json_read",
       "api": "read_json",
       "classification": "global_registry_io"
     },
     {
       "site": "loopx/control_plane/goals/deletion_service.py::<module>._write_locked_registry::direct_json_write:atomic_write_json#1",
-      "line": 558,
+      "line": 557,
       "column": 5,
       "kind": "direct_json_write",
       "api": "atomic_write_json",

tests/control_plane/test_acceptance_restoration.py

@@ -17,11 +17,23 @@
 @pytest.mark.parametrize("provider", ["file", "sqlite"])
 def test_cli_restore_then_reacquire_preserves_acceptance_and_exact_retry(tmp_path, monkeypatch, provider):
     isolate_sqlite_runtime(tmp_path, monkeypatch)
-    runtime, state, registry = tmp_path / "runtime", tmp_path / "state.md", tmp_path / "registry.json"
+    project = tmp_path / "project"
+    project.mkdir()
+    subprocess.run(["git", "init", "--quiet"], cwd=project, check=True)
+    subprocess.run(["git", "remote", "add", "origin",
+                    "https://github.com/example/acceptance-restoration-fixture.git"],
+                   cwd=project, check=True)
+    subprocess.run(["git", "-c", "user.name=LoopX Test",
+                    "-c", "user.email=loopx-test@example.invalid", "commit",
+                    "--quiet", "--allow-empty", "-m", "fixture"], cwd=project, check=True)
+    delivery = tmp_path / "delivery-worktree"
+    subprocess.run(["git", "worktree", "add", "--quiet", "--detach", str(delivery)],
+                   cwd=project, check=True)
+    runtime, state, registry = project / "runtime", project / "state.md", project / "registry.json"
     goal, target = "acceptance-restoration", "todo_artifact"
     state.write_text("---\nstatus: active-read-only\nowner_mode: goal\nobjective: Validate a bounded artifact\n---\n# Goal\n\n## Agent Todo\n")
     registry.write_text(json.dumps({"common_runtime_root": str(runtime), "goals": [{
-        "id": goal, "repo": str(tmp_path), "state_file": state.name,
+        "id": goal, "repo": str(project), "state_file": state.name,
         "domain": "acceptance-restoration", "status": "active-read-only",
         "adapter": {"kind": "read_only_project_map_v0", "status": "connected-read-only"},
         "quota": {"compute": 1.0, "window_hours": 24, "allowed_slots": 2},
@@ -45,7 +57,7 @@ def test_cli_restore_then_reacquire_preserves_acceptance_and_exact_retry(tmp_pat
     def cli(*args, expected=0):
         proc = subprocess.run([sys.executable, "-m", "loopx.cli", "--registry", str(registry),
                                "--format", "json", *args, "--goal-id", goal],
-                              capture_output=True, text=True, timeout=60)
+                              cwd=delivery, capture_output=True, text=True, timeout=60)
         assert proc.returncode == expected, proc.stdout + proc.stderr
         return json.loads(proc.stdout)
 
@@ -61,7 +73,7 @@ def inspect():
     assert first["acquired"]
     turn_binding = ["--agent-id", "agent-a", "--todo-id", target,
                     "--turn-instance-id", "turn-restore-acceptance"]
-    guard = cli("quota", "should-run", "--codex-app", *turn_binding, "--scan-path", str(tmp_path))
+    guard = cli("quota", "should-run", "--codex-app", *turn_binding, "--scan-path", str(delivery))
     assert guard["heartbeat_receipt"]["settlement_identity"]["todo_id"] == target
     cli("todo", "update", "--todo-id", target, "--agent-id", "agent-a", "--clear-resume-when",
         "--task-lease-idempotency-key", "execution-one", "--task-lease-expected-version", "1")
@@ -114,8 +126,9 @@ def turn_holds():
                   "--delivery-batch-scale", "single_surface", "--delivery-outcome", "outcome_progress",
                   "--no-global-sync", "--suppress-external-sinks")
     assert refresh["ok"]
+    assert refresh["delivery_workspace"]["workspace_kind"] == "independent_git_worktree"
     spend_args = ["quota", "spend-slot", *turn_binding, "--slots", "1", "--source", "heartbeat",
-                  "--execute", "--scan-path", str(tmp_path)]
+                  "--execute", "--scan-path", str(delivery)]
     first_spend = cli(*spend_args)
     assert first_spend["settlement_result"]["ok"]
     assert cli(*restore)["status"] == "replayed"

tests/control_plane/test_canonical_lease_renew.py

@@ -105,7 +105,6 @@ def forbidden_legacy_path(*args, **kwargs):
             raise AssertionError("canonical renew used a legacy capture/write path")
         with monkeypatch.context() as guard:
             guard.setattr(task_lease_acquire_adapter, "task_lease_acquire_authority_facts", forbidden_legacy_path)
-            guard.setattr(task_lease_acquire_adapter, "_attach_local_authority_shadow", forbidden_legacy_path)
             third = renew_task_lease(registry_path=registry, runtime_root=runtime, goal_id=goal,
                 todo_id="todo_renew", owner="agent-a", idempotency_key="execution-a", expected_version=3, ttl_seconds=600)
         assert third["lease"]["version"] == 4

tests/control_plane/test_reviewed_terminal_actions.py

@@ -95,16 +95,21 @@ def interrupted(*args, **kwargs):
     state.unlink()
     declaration_path = completion_validation_declaration_path(runtime_root=tmp_path / "runtime", goal_id="goal-a", todo_id=todo_id)
     saved_declaration = declaration_path.read_bytes()
+    declaration_digest = json.loads(saved_declaration)["declaration_sha256"]
+    prepared_blob_path = declaration_path.parent / "blobs" / f"{declaration_digest}.json"
+    saved_prepared_blob = prepared_blob_path.read_bytes()
     declaration_path.unlink()
+    prepared_blob_path.unlink()
     service = ChatActionService(store=ChatActionStore(tmp_path / "actions"), registry_path=registry)
     result = service.apply(proposal["proposal_id"])["proposal"]
     assert result["status"] == "failed"
     assert result["failure"]["error_code"] == "canonical_update_projection_pending"
     assert result["failure"]["details"]["canonical_committed"] is True
     assert marker.read_text() == "x"
     # The business receipt needs no argv; lossless Markdown still needs the
-    # original private declaration. Restore it, never invent a replacement.
-    declaration_path.write_bytes(saved_declaration)
+    # canonical digest's original private declaration. The per-Todo copy and
+    # immutable prepared blob are alternate reads of the same declaration.
+    prepared_blob_path.write_bytes(saved_prepared_blob)
     result = service.apply(proposal["proposal_id"])["proposal"]
     assert result["status"] == "applied"
     assert marker.read_text() == "x"

tests/control_plane/test_shadow_observable_e2e.py

@@ -309,22 +309,16 @@ def test_monitor_successor_retains_caller_routing(caller: Caller) -> None:
     assert successor['action_kind'] == 'validate_release_head' and successor['required_capabilities'] == ['network']
 
 
-def test_observation_remains_independent_of_runtime_capture(caller: Caller) -> None:
+def test_retired_observation_request_preserves_runtime_capture(caller: Caller) -> None:
     w = caller
     before = w.primary()
-    args = ('configure-goal', '--local-authority-shadow-file')
-    assert w.call(*args)['ok'] is True
-    assert w.primary() == before
-    assert w.call(*args, '--execute')['ok'] is True
+    for extra in ((), ('--execute',)):
+        rejected = w.call('configure-goal', '--local-authority-shadow-file', *extra)
+        assert rejected['ok'] is False and 'local_authority_shadow_retired' in rejected['error'], rejected
+        assert w.primary() == before
+    assert not (w.root / 'authority-shadow' / 'file' / 'observable').exists()
     todo = w.add('Independent observation contract')
     assert w.read(todo)['text'] == 'Independent observation contract'
-    retained = sorted((w.root / 'authority-shadow' / 'file' / 'observable').glob('authority-store-*.json'))
-    assert len(retained) == 1
-    snapshot = retained[0].read_bytes()
-    assert w.call('configure-goal', '--clear-local-authority-shadow', '--execute')['ok'] is True
-    assert retained[0].read_bytes() == snapshot
-    if w.mode != 'enabled':
-        assert not (w.root / 'authority-shadow' / 'file-v0').exists()
 
 
 def test_turn_input_rejection_has_no_host_or_primary_effect(caller: Caller) -> None:

tests/control_plane/test_shared_goal_alignment.py

@@ -391,7 +391,7 @@ def test_appending_one_event_rotates_the_projection_into_frontier_behind(
             goal_id=GOAL_ID,
             event_type=TODO_ADDED,
             actor_agent_id="agent-b",
-            refs={"todo_id": "todo_lane_a"},
+            refs={"todo_id": "todo_new_peer_work"},
             payload={"text": "Fixture event that moves the state event basis head."},
         )
     )

tests/control_plane/test_vision_checkpoint_runtime.py

@@ -120,6 +120,7 @@ def call(method: str, params: dict[str, object]) -> dict[str, object]:
         "todo_id": "todo_current001",
         "completion_todo_id": None,
         "autonomous_replan_recorded": False,
+        "blocked_retry": None,
     }