fix(research): timestamp public sources after completed reads

[loopx-agent]

The public GitHub reader reused a timestamp taken before its HTTP loop for every source observation and receipt completion. Later failed or empty reads could therefore appear already completed.

Record each successful source observation after its bounded read and completion after all attempts. Keep the existing provider, typed plan/admission/projection, explicit opt-in and unknown publication dates. The conflict resolution preserves latest-main redacted failure-step diagnostics and their tests alongside the clock regression; no history or receipt is rewritten.

Validation at the final head:

• 51 provider/CLI tests and 17 TypeScript tests pass. Five clock cases fail on the immutable base provider and pass on the changed provider.
• A real CLI/TypeScript/urllib/local HTTP fixture proves source time follows its own return and completion follows a later 404. Full packet/readback comparison has exactly six intentional clock/derived observation-id differences. This is controlled HTTP transport, not live GitHub/TLS qualification.
• Omitting execution opt-in performs zero reads. Ruff, TypeScript typecheck and exact-head premerge pass (5 direct and 19 selected checks), including full semantic and four-file public-boundary checks.
• Initial missing development dependencies and a baseline fixture alias mistake were preserved and corrected before accepting the final evidence. The merge's Markdown table separator was fixed in a separate signed commit; the branch was pushed normally, without force.

Original installed-source failures remain historical evidence. Default installation, served App, live Lark delivery and investment utility are not promoted. CI was neither queried nor awaited under the current review policy.

Accepted boundary: External Evidence Research v0.

[loopx-agent]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)
Reviewer: model_agent; model=gpt-6.1-sol; provider=OpenAI; runtime_reported; reasoning_effort=xhigh

动机

全 PR head f56b72b69564a42ccc6c7f14b407382b8648d085，四文件 +67/-3。显式读取 pinned公开来源，并通过现有 CLI/对话/Lark读回的用户。 原 provider 在所有 HTTP 读取前取一次时间，复用于每条来源和 receipt完成；后续失败或空读被标成已经完成。 每条成功来源在读取后记录 observation，每个 receipt 在全部尝试后记录 completed_at；晚失败、空读、binary与partial状态保持真实，既有日期和权限字段不变。 判定依据是 maintainer-linked Accepted docs/architecture/rfcs/external-evidence-research-capability-v0.md @ 509c38c502d3d0b4eafb01550efcdc4b5b5a1d17：Decision 的原plan/完成时间/来源日期，Acceptance 的精确身份和独立parent，Product surfaces 的共享readback。Main base fee889e617e1d063b42acff34b46445c49cee062；新增guide/recipe不是验收oracle。

真实 GitHub/TLS success、普通安装、served App、live Lark送达和长期效用未独立资格化；本轮真实网络只到受控本地HTTPfixture。 本评审不授予发布、消息发送、自动采纳、凭据/私有来源访问或 merge权限，不认证发布/首次可得时间。

改动思路

当前有界交付是原 public GitHub provider 的两个观察时点纠正，复用既有协议、共享 readback及显式 opt-in。 把时钟读取放在原 HTTP owner 的相应边界即可；不在 TS 或 Python 增加第二日期/准入owner，也不引入 clock框架。 Provider专门HTTP读取仍在Python，generic plan/receipt/admission/retirement继续由既有TypeScript决定；publication_date仍未知，旧receipt不重写。当前时间正确不等于认证执行、证据完整或parent已采纳。

具体改动

execute_public_github:76 去掉loop前共享now，在有效非空UTF8读取后记accessed_at，所有attempt完成后记completed_at。HTTP404、其他读失败、empty/binary、partial-success与原fallback/status/limitations不改。README双语披露此变化；self-repair表新增单个scoped诊断recipe，保留历史、原owner、独立读回和不认证publication/coverage。

我的47provider/CLI与17TS tests通过；新增五种advancing-clock断言对immutable旧provider全部失败，当前全部通过。再独立用真实 CLI→TS→stdlib urllib→本地socket HTTP，只将transport origin映射到拥有的合成server，使用真实UTCwallclock：成功source随后实际404。B的来源时间早于自己HTTP返回、completion早于最后失败；H两者都在对应返回之后。这个反例没有mock时钟，也不声称live GitHub/TLS就绪。

两份完整actualCLIpacket/readback逐字段比较，恰好六个UTC/派生receipt observation identity路径变化，所有其余refs/findings/contentdigest/publicationNone/status/limitations/truthflags相同，没有输出归一化。双方readback保留各自receipt source。当前回归经本地Lark card builder保留accessed_at；canonical正确性与live送达分开。实际nullable日期、原source fallback、mutated-plan/私有或越界来源及default-off拒绝覆盖保留。

对主干的风险

最强风险是为了修时间而伪造publication/readiness、丢掉失败或弱化显式opt-in。相同完整字段比较与47/17negative覆盖防住当前delta。省略--public-github避免readyprobe，execute省略--execute拒绝，原source/module/recipe存在不激活HTTP；没有新field/setting/provider/screen或Python决策权威。Existing共享CLI/Markdown/Larkfields携带修正结果，不需要另建frontend开关；servedApp和liveLark没有借用局部builder来认证。

5direct、18requiredselectedpremerge、Ruff/typecheck/fullsemantic/publicboundary通过；原frontier2007/2000 advisory仍failed，实际B/H同命令完整report字节相等，clock改变未触及其owner/metrics，不改ceiling或写成通过。Advisory2paths/0支持vocabularycarrier不证明无动态语义；新增recipelabel是local docs，运行期protocol/state字段复用。Future-facing pass在原transport owner落两个时点，无需clock框架。

作者normal-wheel/live unavailable探针是声明，本轮没有采用为自己的安装或成功来源证据。CI未查询、轮询或等待。

我的整体评价

APPROVE 此时间顺序修复。长程价值是把保留证据的chronology放回真实原点；用户在现有readback区分成功来源与晚失败，不靠时间戳推断更多权限或publication。当前有界交付是原 public GitHub provider 的两个观察时点纠正，复用既有协议、共享 readback及显式 opt-in。 把时钟读取放在原 HTTP owner 的相应边界即可；不在 TS 或 Python 增加第二日期/准入owner，也不引入 clock框架。

English verdict: APPROVE — f56b72b69564a42ccc6c7f14b407382b8648d085. Five old-provider counterexamples,47provider/CLI+17TS cases and independent actual CLI/localHTTP timing establish post-read observation and completion. Live GitHub/TLS, installed App and live sink qualification remain unverified; inherited frontier debt stays failed.

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @loopx-agent.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[loopx-agent]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)
Reviewer: model_agent; model=gpt-6.1-sol; provider=OpenAI; runtime_reported; reasoning_effort=xhigh

动机

显式读取 pinned公开来源，并通过现有 CLI/对话/Lark读回的用户。 原 provider 在所有 HTTP 读取前取一次时间，复用于每条来源和 receipt完成；后续失败或空读被标成已经完成。 每条成功来源在读取后记录 observation，每个 receipt 在全部尝试后记录 completed_at；晚失败、空读、binary与partial状态保持真实，既有日期和权限字段不变。 每条成功来源在读取后记录 observation，每个 receipt 在全部尝试后记录 completed_at；晚失败、空读、binary与partial状态保持真实，既有日期和权限字段不变。 本评审不授予发布、消息发送、自动采纳、凭据/私有来源访问或 merge权限，不认证发布/首次可得时间。 真实 GitHub/TLS success、普通安装、served App、live Lark送达和长期效用未独立资格化；本轮真实网络只到受控本地HTTPfixture。

本次全PR判断绑定 5c2a74ff3cc4f2b7370d44c5a2328c462f7f3521，最新基线 b0b2acffb8fea7d85b20dd4f0139c1ce0616e5a7。原 head 的批准没有继承。冲突来源是主干的失败阶段说明、修复模式和测试与时间修复在相同位置插入；三处都保留双方内容，随后修正合并时误加的 Markdown 表格空行。原匿名有界读取的权限与失败处理没有扩张。

改动思路

当前有界交付是原 public GitHub provider 的两个观察时点纠正，复用既有协议、共享 readback及显式 opt-in。 把时钟读取放在原 HTTP owner 的相应边界即可；不在 TS 或 Python 增加第二日期/准入owner，也不引入 clock框架。 Python仍只拥有现有provider的HTTP读取，TypeScript拥有exact-plan、receipt观察、parent准入与退出/读回。两次clock调用放回各自真实操作边界；无需新schema、状态、provider、开关或时钟框架。共享CLI、Markdown及本地Lark builder继续携带既有字段，不新增需要用户重填信息的路径。源的accessed_at与receipt完成不同，也都不是发布或首次可得时间。

最强不交付理由是receipt本身不认证执行，时间正确也可能被误读成证据完整。这个边界通过现有truth flags与亲自调用保留；不修则迟到失败仍能被标成已完成。实际CLI的晚404反例证明现有provider内三行改动已经足够，扩大Core权限或新UTC框架不合比例。future-facing pass保留这个原owner，没有额外抽象。

具体改动

关键代码讲解

• execute_public_github:76：去掉loop前共用now；非空UTF8读取后记录source accessed_at，所有成功、404、empty/binary尝试后记录receipt completed_at。当前main的visibility/download/text-validation阶段标识与脱敏失败局限均保留。
• readback:33：既有TS exact-plan/receipt身份核验与独立parent准入继续拥有结果；当前真实CLI fullpacket比较只有六个时钟及派生observation-id路径不同，其余所有字段逐值相同，没有归一化或丢弃失败。
• render_readback:82：共享Markdown原样保留source日期及失败/准入限制；现有本地Lark builder验证仍通过，不能外推live送达或servedApp验收。

四个变更文件逐一检查：provider三个时点位置改动，README双语说明，单个scoped self-repair模式行，以及五种advancing-clock回归。时间修复与main失败阶段测试都保留，表格结构完整。代码/协议名复用既有owner；新recipe label仅是本地文档导航，不激活HTTP。

接受依据是 External Evidence Research v0，spec_revision b0b2acffb8fea7d85b20dd4f0139c1ce0616e5a7，并非本PR新增README自证。逐项映射：Decision 的完整plan及完成/source观察时点 implemented，实际CLI/TS/HTTP counterfactual支持；Acceptance 的身份、缺证、独立parent及禁止自动promotion implemented，51Python与17TS正负例保留；Product surfaces 的既有共享读回 implemented，CLI与本地Markdown/Lark builder已核，servedApp/liveLark仍是明确未资格化范围。

对主干的风险

最强风险是借时间修复去伪造publication/ready、弱化显式执行或丢失晚失败。基线provider在当前五种clock断言全部失败；实际UTC的CLI→TS→stdlib urllib→本地socket HTTP中，base来源/完成均早于相应返回，head均在之后，source success与晚404同时保留。该fixture只替换transport路由与base executor，没有mock时间；不宣称真实GitHub/TLS就绪。两臂省略 --execute 均拒绝且零HTTP读取；default-off、私有/越界/变造plan等原负例保留。

当前51provider/CLI、17TS通过，Ruff和typecheck通过；最终exacthead premerge五项direct、19项selected全通过，公开边界四文件无命中。第一次semantic检查因工作树缺typescript开发依赖失败，保留后以本地npm ci --ignore-scripts恢复，最终重跑通过。第一次baseline harness未替换CLI的import alias而实际跑到head，父审拒绝该证明，修正后才接受base反例；初次表格空行也已在新commit修复。没有删除历史失败、放松阈值或升级默认安装。CI按当前契约false未查询、轮询或等待。

语义与 CI 对齐

本PR复用现有source/receipt字段，访问时间的观察位置是明确披露的意图变化；完整decision/readback字段对照与whole-tree semantic检查均通过。development advisory零支持carrier只代表有限分析；正式semantic gate已独立执行。无新typed状态、跨域金融措辞或将建议变成强制执行的路径。

我的整体评价

APPROVE 5c2a74ff3cc4f2b7370d44c5a2328c462f7f3521。long_horizon improved：后续读取失败的记录不再被批次开始时间提前完成，旧receipt和原fallback不重写；user_experience improved：原有读回能区分实际来源观察与完成时点，未增加配置/确认步骤。当前完整四文件修复与其维护成本相称，保留原typed owner、default-off和authority限制。完整金融源可用性、默认升级、App/liveLark及效用仍未验，批准只覆盖本PR的时间语义与合并冲突恢复。

English verdict: APPROVE — 5c2a74ff3cc4f2b7370d44c5a2328c462f7f3521. Latest-main phase diagnostics are retained; 51 Python and 17 TypeScript cases, five failing base counterexamples, real CLI/localHTTP chronology and exact-head premerge (5 direct/19 selected) pass. Default installation, live GitHub/TLS, App and live Lark qualification are not promoted.