fix(workspace): honor explicit Goal creation workspace choices

[songoow]

Create Goal always submitted workspace_ref: current, and the backend could let channel context or a single registered Goal override an explicit workspace choice. The form now lets the owner reuse a registered Goal's directory; explicit references take precedence, and an unavailable directory keeps the form editable without redirecting creation.

Refs #6231; S1/S5. This delivers registered-workspace reuse, not arbitrary directory entry or new-project onboarding. Existing default routing, steward bindings, permissions and recovery checkpoints remain owned by their current services. CLI and Lark contracts are unchanged.

Validation:

• Destination counterexamples: baseline 5 failures / 1 pass; candidate 7 passes, including bound-steward refusal and legacy current parity.
• Packaged UI → real disposable action HTTP service → bootstrap → registry/state readback confirms the selected second directory and parent Goal. Covers transport failure, unavailable directory and recovery, desktop/390px, and keyboard focus. Model dispatch and unrelated status feeds are synthetic.
• Existing action HTTP smoke, 63 backend regression cases, frontend contract/type checks, bundle build/source verification, goal-draft and bilingual typed-actions packaged scenarios pass. An additional 29 App creation/recovery cases pass (42 unrelated cases deselected).
• Semantic advisory and full semantic inventory pass; standard premerge against official upstream/main passes. An initial check used the stale fork base and was stopped. Initial smoke setup lacked Node's SQLite opt-in; qualified runs use Node 22.22.3 with --experimental-sqlite.

Journey: open Create Goal → enter objective/criteria and choose an existing directory → review → confirm once → read back the created Goal. Failed preview retains input. The directory selector adds necessary target information in the existing dialog, without a new page or repeated form. Existing entry viewport/navigation/CTA remain unchanged.

Future-facing pass: consolidated duplicate configured-root resolution inside the existing filesystem/registry adapter; no new policy owner, endpoint or persisted vocabulary. Reversible without data migration. Not installed, deployed, or qualified with live model execution.

[songoow]

Reviewer: model_agent · GPT-6 family · OpenAI · self_reported

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

动机

Goal 所有者需要在同一个界面为不同项目创建任务目标。此前创建表单固定使用默认工作区；即使请求显式选择项目 B，项目 A 的频道上下文也可能使后端拒绝该选择。现在可以选择沿用已有 Goal 的工作目录，确认后在所选目录创建，并在目录不可用时保留表单供修正或重试。这一批只交付已注册目录的复用，不提供任意路径输入、新目录接入或安装升级。#6231 的新目录接入与完整目录识别体验仍未完成。

依据是 #6231，按 2026-10-12 读取的问题定义评审；对应现有路线图 S1/S5，未建立另一套项目配置入口。最小合法流程是打开创建表单、提供目标及所选目录、检查配置、确认一次，再读回新 Goal。目录选择提供必要的目标信息；检查与确认复用现有写入边界，不要求重复填写目标。对话草稿的直接预览保持原行为，需要指定目录时可选“修改”。

改动思路

评审 head：833814f272ecdfaa35190efcf87e2a30ea600c96；base：df826263926651ab9c50acee182ef96e2a60ff4b。

本批交付已注册目录的选择、真实创建及失败恢复。沿用既有 goal.create 请求、工作区引用、预览/确认和 bootstrap。前端只承载选择意图；服务器从已注册 Goal 或已配置根目录解析真实位置。显式选择优先于频道上下文和单 Goal 回退；缺失选择不会悄悄改用另一目录。默认 current、受绑定的管家工作区，以及已有创建操作的恢复检查点保留原有优先级。

只修改表单不能修复后端的优先级错误；新增任意路径接口又会扩大权限与接入范围。因此当前切片有独立使用价值，且可以整体回滚。Python 改动留在现有文件系统/注册表适配层，没有新增通用控制面或第二个状态决策源。顺带合并了重复的配置根目录解析分支。

具体改动

关键代码讲解

• goalCreateRequest（goal-create-request.ts:20）接收可选工作区引用，未选择时保持 current，会话上下文与目录意图分开传递。
• WorkspaceActionForm（workspace-action-form.tsx:25）从现有 Goal 列表展示目录来源，失败后保留文本和选择，选择本身不执行写入。桌面与 390px 截图已检查，表单层级与键盘焦点可用，首次进入的页面与主要导航没有改变。
• PersonalWorkspacePage 的表单回调（personal-workspace-page.tsx:2246）在目录不可用时保持可编辑表单，其余成功预览仍进入现有确认抽屉。
• ChatActionService._project_for_goal_create（chat_actions.py:435）只对 current 使用频道/单 Goal 回退；显式引用从权威注册表或已配置目录解析。无效引用与目录缺失仍被拒绝，绑定管家和恢复检查点不能被普通目录选择绕过。

验收映射：registered-selection implemented（表单至真实 bootstrap/注册表）；unavailable-recovery implemented（实际移走隔离目录后拒绝，恢复目录后沿用输入重试）；directory-onboarding deferred（继续由 #6231 的项目连接 owner 承担，当前没有任意路径接入承诺）。双语用户指南明确这个边界。没有改 CLI/Lark 协议。

对主干的风险

关键风险是确认后写入另一目录、目录失效后静默回退，或改变既有恢复身份。独立 HTTP 对照在相同输入下：旧解析方法返回 400，现 head 返回 201；预览均不创建 Goal，现 head 确认后返回 202，注册表读回为所选第二目录及正确父 Goal。对照只替换不可变 base 的解析方法，外围真实服务相同，未冒充完整旧版浏览器验证。

7 项目录规则检查、原有 action HTTP smoke、63 项后端回归及额外 29 项 App 创建/恢复检查通过。打包 goal-workspace-selection、goal-draft、中英文 typed-actions 通过；新场景使用真实 HTTP、bootstrap 和注册表，只模拟模型分发及无关状态页面。类型/契约、构建/来源校验、语义检查以及最终标准 premerge（3 项直接检查、编译、4 项 catalog、8 项风险 smoke、公共边界检查）通过。

保留验证限制：未跑整个 52 场景套件，未安装、部署或使用真实模型。早期测试脚本入口和并发端口问题已修正；缺少 SQLite 参数的试跑失败后，在 Node 22.22.3 加 --experimental-sqlite 的受支持环境验证通过。GitHub CI 当前仍有 queued/cancelled 项，未宣称远端通过。默认目录仍按既有配置解析；首次连接一个全新目录仍需现有项目连接流程。

我的整体评价

APPROVE：此 head 的已注册目录选择形成了完整的输入、确认、真实写入和失败恢复链路，未发现需要阻塞这个有界切片的问题。#6231 整体保持未完成；目录接入不是被测试数量替代的验收。此为作者提交上的自评结论，不是独立维护者批准，不授予合并权限，也不证明安装态已修复。

English verdict: APPROVE - 833814f. Registered workspace selection now reaches real creation without context override; unavailable selections retain editable input. Packaged journeys, real HTTP/registry readback, recovery regressions and premerge pass. New-directory onboarding, remote CI, maintainer approval and installed/live-model qualification remain separate.

[loopx-agent]

Reviewer: model_agent | gpt-6.1-sol | OpenAI | runtime_reported | xhigh

APPROVE — 精确 head 833814f272ecdfaa35190efcf87e2a30ea600c96 未发现阻断问题。

动机

创建第二个项目 Goal 的用户需要明确工作目录，不能由当前对话目录替换显式选择。先读 #6231、基线 design/frontend-delivery 与既有 preview/confirm/Goal creation 合同，再读完整 diff。当前交付为“复用已注册 Goal 的目录”，含发现、操作、失败修正和落盘回读；任意路径/新目录接入仍由原 #6231 保留，本评审不将完整需求结案。

选择目录不增加执行权限。 剩余缺口是新目录接入与任意路径设置，继续由原 #6231 承载。 注册目录复用通过已有表单、真实预览/确认和落盘回读构成可用切片，无需等待更广的目录接入。

基线显式其他 Goal 或配置 token 从 first context 得到400；候选确实落第二 root。

改动思路

WorkspaceActionForm 经同一个 goalCreateRequest 传递 opaque workspace_ref，对话上下文独立。既有 ChatActionService._project_for_goal_create 先解显式 Goal/配置 token，只有 current 才使用原上下文/单 Goal fallback；不接受任意用户路径。Python 留在既有 filesystem/registry IO owner，本次压缩重复 lookup；TS action_review_plan 继续拥有原 operation/checkpoint/交互状态，不新增 Python 决策 owner。

规格映射：https://github.com/loopx-project/loopx/issues/6231；spec_revision：issue6231 body sha256:e9fe7d2283bbd2432209612bd6df8d3deb3765f691e53f103937db5398f2aa62; accepted design/frontend delivery at df82626。判据：explicit-destination, preview-before-effect, unavailable-recovery, current-parity。
注册目录复用通过已有表单、真实预览/确认和落盘回读构成可用切片，无需等待更广的目录接入。

具体改动

完整12文件（含两张公开安全合成截图），新增 selector/common request 参数、未能预览时保留输入、明确目录优先级、双语使用说明以及真实 HTTP/backend 的 packaged 场景。默认 current、执行权限、steward 冻结、fingerprint 和原创建操作恢复 owner 保留。

正路径：创建/对话修改→目标与标准→注册目录选择→预览明确标识→确认一次→真实 bootstrap→registry 的第二 root/parent 与 projection_verified receipt。负路径：503/目录缺失保留原文和选择；未知显式 ref 不转去当前目录；预览后 registry 变化时 apply409、零 Goal/零派发；取消也不创建。选择目录不增加执行权限。

关键代码讲解

• WorkspaceActionForm.preview 经 goalCreateRequest 把 opaque workspace_ref 与对话 context 分别发送；预览失败的 catch 保留草稿。页面 onPreview 识别精确 workspace_unavailable，其他 gate/ready 仍交原 drawer。
• ChatActionService._project_for_goal_create 先查显式 Goal/配置 token，unknown 不回退；只有 current 才走原 context/单 Goal 分支。原操作 progress 已冻结目录时先采用该目录，避免恢复时重新选址。
• _apply_goal_create 沿用 permission/steward/fingerprint 与原 checkpoint，确认后执行 bootstrap，再经 registry/receipt 独立读回；预览后改 registry 会 stale409，不生成 Goal 或派发。

语义与验证对齐

复用既有 current、opaque ref、保护 gate 与 typed action-review-plan，不创建新 vocabulary。独立同输入 HTTP 的合法 current 控制、显式第二目录、未知/失效选择、stale 与取消，以及打包恢复→确认→落盘，支持这项已披露的显式优先修正。

对主干的风险

独立同9输入、同真实 Action HTTP/store/bootstrap/registry：基线2通过/7失败，候选9/9。基线显式其他 Goal 或配置 token 从 first context 得到400；候选确实落第二 root。两条 current 控制均仍在第一 root，失效目录/未知选择返回409，stale apply 不写，cancel 不写。随机 proposal/receipt身份与临时路径只作 provenance，不宣称未经归一化的完整 JSON 字节相等。

独立通过：packaged directory selection（390px/键盘、503/missing→恢复→真实确认落盘）、实际 Ego Lite 打包 UI→真实 preview HTTP（合成 status、模型替身，无 apply，registry仍两Goal、自有空间完成关闭）、13 workspace/reviewed-create +56 shared-action 测试、完整 real chat-action smoke、frontend contract、正常 bundle/source verify、CSS、Ruff、diff，以及先 advisory 再 full semantic。45 unresolved producer site 保留。最初独立探针误设201为200、未规范 macOS临时路径，保留失败记录后在两版重跑；辅助 Ego server 缺 status 初始化/重用非空 fixture 仅在一次性 helper 修复，不冒充产品回归。

CI 未查询、轮询或等待。上述是真实创建与回读，不是 paid/live-model 执行或主机已安装行为的验收；更广的新目录接入/issue关闭仍未完成。文档、截图不泄露原始本机路径。

我的整体评价

批准有界的注册目录复用切片；未发现阻断问题。future-facing pass 已合并原配置目录重复 lookup，保留 typed review/checkpoint owner；不为语言迁移添加平行判断源。包装交互与真实落盘一起交付，剩余 onboarding 属原需求。平台批准、Code Owner资格与 maintainer merge 另行读回；本评审不执行 merge。

English verdict: APPROVE

[loopx-agent]

Reviewer: model_agent | gpt-6.1-sol | OpenAI | runtime_reported | xhigh

APPROVE — no blocking finding at exact head 833814f272ecdfaa35190efcf87e2a30ea600c96.

Motivation

An owner creating a Goal for another registered project needs an explicit destination independent of conversation context. Issue 6231 and the pre-change design/frontend-delivery and creation contracts were read before the patch. This ships registered-workspace reuse with discovery, operation, correction and actual persistence readback; arbitrary-directory onboarding remains in the existing issue, which is not closed by this review.

Approach

The existing form and normalized request carry opaque workspace_ref separately from context. The existing server resolver gives explicit Goal/configured tokens priority and limits context/single-Goal fallback to current. No caller filesystem path or broader permission is accepted. Python remains the existing filesystem/registry IO owner; TS action_review_plan retains operation/checkpoint/interaction authority.

Whole change

The 12-file diff includes the selector/common request, retained draft on unavailable preview, explicit-first resolution, bilingual guide, two public-safe synthetic screenshots and real-backend packaged coverage. Current routing, permission/steward isolation, fingerprints and original-operation retry remain in their owners. Positive journey: choose→preview→confirm once→bootstrap→second-root/parent and verified receipt. Negative journey: 503/missing preserves input, unknown selection does not redirect, changed registry makes apply stale with no Goal/dispatch, cancellation creates nothing.

Risk and evidence

The same nine independent inputs use real Action HTTP/store/bootstrap/registry with model dispatch synthetic. Base passes 2 and fails 7; head passes 9/9. Explicit alternate Goal/token from first context is 400 on base and creates in the second root on head. Both current controls still create in the first root; missing/unlisted gates 409, stale apply 409 and cancellation have no creation effect. Random proposal/receipt identities and canonical temporary paths remain provenance; no raw full-JSON equality claim.

Passed independently: packaged directory selection with 390 px/keyboard, 503 and missing-directory recovery followed by real confirmation/persistence; actual Ego Lite packaged preview with real HTTP, synthetic status, no apply, two-Goal registry unchanged and owned-space finish; 13 workspace/reviewed-create plus 56 shared-action tests; real chat-action smoke; frontend contract; normal build/source verification; CSS, Ruff, diff and full semantic after advisory.45 unresolved producer sites remain. Initial harness status/path assumptions and auxiliary-server initialization/reused-fixture errors were retained and corrected in disposable probes only. These are not product fixes. CI was not queried, polled or awaited. No installed-release or paid/live-model qualification.

Overall assessment

Approve the bounded registered-workspace reuse slice. Future-facing simplification merges duplicate configured-directory lookup and retains existing typed review/checkpoint ownership; broader language migration/onboarding is outside this slice. Platform/Code Owner/maintainer merge eligibility is a separate readback; no merge performed.

Specification mapping: #6231; spec_revision: issue6231 body sha256: e9fe7d2283bbd2432209612bd6df8d3deb3765f691e53f103937db5398f2aa62; accepted design/frontend delivery at df82626. Criteria: explicit-destination, preview-before-effect, unavailable-recovery, current-parity.

English verdict: APPROVE