feat(collaboration): reconcile request corrections with Goal effects

[songoow]

Current integration readback: head 3a8a6b5c041c57f897e4f4a619362ff6a3341981 merges canonical main a4ffcf3f158a77f58cb2df4a824914c02c1d5f73 without rewriting the existing PR history. The registry I/O census was regenerated from the merged source; only locations changed, with site identities and classifications preserved.

78 Python tests passed; three Windows-only cases were skipped on macOS. All 40 TypeScript tests passed, including real isolated File/SQLite/PostgreSQL 14.20 paths with zero skips. Frontend build/types, the packaged request correction/lost-response/cancellation journey, full semantic validation and public-boundary checks passed. The first PostgreSQL test invocation used the wrong local role; after correcting the disposable-server connection identity, the full selected provider group passed without code changes. Remote CI and new-head review remain separate; no PR merge or deployment was performed. Earlier validation below remains tied to its stated revision.

Result

A requester can revise or cancel an existing local request without losing the original work identity. A source-derived Goal amendment reserves one exact request revision and operation. Commit and conditional abort share one durable terminal receipt; the request links that receipt before another effect can proceed. Corrections also attempt to abort superseded reservations. If commit already won, the UI reports the retained Goal change instead of claiming rollback.

The original conversation now provides brief editing, cancellation and recovery. Independent receiver CLI/MCP reads, assessments and replies retain their source revision; an old answer cannot complete a newer request. Unknown responses retain the original operation across reload. Interim conversation reports are immutable per revision; only a conclusion for that same revision suppresses an unsent interim report. Uncontrolled CLI reads preserve the original instruction text.

Implemented against shared-goal-alignment-and-governed-amendment-v0.md §5.1 and manager RFC §§5.10,5.12. The documented §9.4 profile is exact source_session_v1, local private request lineage and existing canonical File/SQLite/frozen Goal policy. It does not qualify arbitrary Host effects, external-source control, restored writer activation, live-model/Lark delivery or complete M2/G1.

Written by: model_agent — GPT-6, OpenAI.

Dependencies and ownership

Base is current canonical main at b0b2acffb8fea7d85b20dd4f0139c1ce0616e5a7. The branch includes unchanged reviewed #6323 (8ddedecb288788961a479a28395698d68dfea8ca), which is still a separate prerequisite. #6343's corrected profile coverage is now in main. The request-control implementation begins after dependency/main composition fbc5bbe202658d6f6b3ef25cffe390f978b22ee3; do not count the prerequisite's implementation as new work here.

• Existing request entry owns corrections, read/assessment facts, reservations and operation receipts; no second request database. Its original source remains immutable.
• TypeScript owns transitions and outcomes. Python resolves authenticated sources and performs existing locked file/Goal IO. It never accepts a caller-authored terminal outcome.
• Existing Goal work planner is reused for direct and request-derived amendments. One operation hash orders commit/abort, and the actual store identity plus Goal/runtime/registry namespace pins recovery.
• Existing result-update chain and original return route are retained. Late unversioned observations remain bound to revision 1; current inbox, peer, Chat and Lark tracking share typed readback.
• A small source-route extraction reuses the already reviewed feat(goals): add explicit material reads and direction basis recovery #6338 helper at the same path. Bounded wire constants are imported by the frontend; the original formal 26-vocabulary scope/budgets are unchanged.

Migration economics

The original request/result store remains the authority. New request transitions live in TypeScript; Python supplies authenticated source observations and performs existing IO. Direct and request-derived Goal changes reuse planWorkCommit; request/result identity helpers and trusted Chat fact assembly were moved to their existing Core owners and the old definitions retired. No second writable request lifecycle, database, scheduler or model policy was added.

The new source/orchestration Python adapters total 327 lines; request transitions are 388 TypeScript lines, with the small wire vocabulary shared by the frontend. Whole-PR volume also includes the disclosed #6323 prerequisite. Native File/SQLite instrumentation counted 20 bridge calls for a first request-derived commit, 15 for original-operation replay and 14 for conditional-abort recovery, including existing lifecycle/replan observations. These are bounded correctness costs, not model calls or evidence of latency/token savings. The request and Goal commits remain separate; independent receipt readback is required to recover their linkage.

Original request/decision/result bytes and unversioned revision-1 callers remain supported for retained history and delayed observations. The obsolete unpublished adapter is absent from the wheel. New reads cannot activate old writers; after new records exist, rollback must retain compatible readers and receipts.

Validation

Validated candidate: 1675f570d32f06cc3b564e1511e6bbe3126bfa60. Exact-head review separately records scope, evidence provenance and remaining gates:

• Actual production source registration and File/SQLite CLI/HTTP tests for both terminal winners, lost replies/linkage, stale/changed source, unregistered receiver, old assessment corruption, fresh-id refusal, stripped-source refusal, and correction → old abort → new revision continuation.
• An isolated source-guard mutant makes both File/SQLite native oracles fail. Capacity regression was reproduced and fixed by reserving maximum legal JSON-encoded cancellation and terminal-linkage space under the existing byte limit.
• Real PostgreSQL 14.20 plus shared authority conformance at 41b22a51a: 372 passed, zero skipped, including correction-triggered abort. Final product-byte comparison proves only CLI guidance changed afterward; the tested owners remain identical. The disposable server was stopped. This is store qualification, not a PostgreSQL end-user profile.
• The integrated source/consumer suite passed 313 tests with three Win32-only skips. After the interim-return repair, affected native consumers passed 225 tests with the same three skips; independent new-request scope and paired scoped-guidance cases each passed two tests. These overlapping runs are not summed as coverage. The final CLI guidance delta is bounded and separately verified against main.
• Source and independently installed normal-wheel browser journeys use real source registration, canonical SQLite, normal Chat entrance, HTTP owners and separate receiver CLI. No HTTP/admission mock supplies the changed rule. Covers current-revision interim return, correction, lost successful response/reload/exact retry, stale editor, read failure/recovery, reserved-effect cancellation, English/Chinese and narrow screen. Synthetic typed progress is not model behavior.
• TypeScript/Ruff, semantic advisory/full drift, exact source-reader architecture checks, public-boundary scan, build and risk-based premerge checks. No budget ceiling is raised. The final normal wheel and independent installation match all 41 main-diff product files byte-for-byte, and the retired source adapter is absent. Risk-based premerge selected 19 checks plus five direct checks; focused TypeScript and Python checks supplement it. Hosted CI remains separate.

User journey and boundary

Before: changing a request could not govern a reserved shared Goal change or distinguish old and new receiver outcomes. After: open the original delegation details, edit the brief or cancel, and read the actual request/Goal result in place. Goal, receiver and source identities are already bound; no command copying or duplicate Goal selection is required. Save performs validation and write in one user gesture. A failed current read removes stale controls; unknown writes retain their original identity.

Cancellation stops new controlled effects for this request. Committed Goal work, independent work/leases and their separate execution/acceptance remain intact. The browser cannot act as a peer or receiver. The supported local actor declaration is not new remote authentication. The ordinary source-profile Goal runtime remains separately unqualified; no live execution is inferred from this cold control journey.

No homepage, hero or primary navigation changes. Before use, revert the candidate to roll back. After new control/proposal records exist, stop new admission and retain compatible readers, receipts and fences; never erase one side to make an unknown effect eligible. No merge, deployment or user App replacement is included.

[songoow]

Reviewer: model_agent; GPT-6; OpenAI; self_reported.

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

动机

原会话的请求发起者，以及按该请求协作的接收 Agent。 发起者修正或取消一项委托时，旧结果不能冒充新请求完成；已经预留、但回复丢失的 Goal 变更也不能靠换编号再执行。 候选实现让发起者在原会话修改、取消并核对结果；接收方按实际读取的版本判断和回传，未知变更通过原操作回执恢复后才能继续。 本批不开放任意 Host 效果、外部来源控制、通用重分配、恢复写者启用或真实模型团队运行。 完整 M2/G1、通用 source-profile 运行时、真实 Lark/模型采用与恢复后的授权重绑定仍需各自原验收。

本次检查完整主干至 1675f570d32f06cc3b564e1511e6bbe3126bfa60 的差异，不继承前置 PR 的批准结论。评审中发现并修复了新版本中途进展与旧 decision 记录冲突、旧结论压掉新进展的路径；另将版本操作指引限定到实际供给版本化请求的 CLI 页面。当前未发现该本地切片的阻断问题。

改动思路

请求和 Goal 分别保有自己的事务；复用既有 Inbox、Goal work planner、operation receipt 和返回链路，比另建请求库或用一次远端存活检查代替取消顺序更符合现有边界。 本 PR 交付受支持本地来源从修订/预留到提交或中止、独立回执关联和原会话回读的完整切片；主干至本 head 包含仍开放的前置 #6323，不能将它重复算作新成果。

请求先在原记录预留一个不可变操作；提交与条件中止在 Goal owner 竞争同一终局回执；随后独立读回并关联原回执。请求修正不删除旧预留，超时不释放 fence，提交胜出就保留 Goal 工作。TypeScript 负责决定，Python 解析真实来源和执行 IO；前端不增加独立配置或决策源。

最强反面是完整 diff 较大、有限容量与多次同步观察有维护/调用成本，且普通 source-profile runtime 仍未整体可用。这个限制已体现在资格边界：现有原对话可以完成修正/取消/恢复，不能由此宣传通用团队运行。只改 brief、增加超时或另加一个状态页都无法解决两个 owner 间的提交顺序。

具体改动

完整 diff 为 73 个文件、+5516/-213。其中包含仍 OPEN 的 #6323（8ddedecb288788961a479a28395698d68dfea8ca）的 root/policy、固定模板、实际 claim/replan 和设置页前置；#6343 已在主干。请求控制自身的新工作在既有依赖组合之后。源路由 helper 复用 #6338 的同一路径，无第二套路由或全 Direction 依赖。

依据变更前 b0b2acffb8fea7d85b20dd4f0139c1ce0616e5a7 的 docs/architecture/rfcs/shared-goal-alignment-and-governed-amendment-v0.md；同时对照 docs/architecture/rfcs/capable-manager-semantic-handoff-v0.md，新增 §9.4 只记录本地资格与限制，没有改写原验收。

• §5.1(1)、§5.1(2)： request_control.ts:265 planRequestControl 在既有 Inbox 内管理修订、读取/判断和唯一预留；request_amendment.py:168 control_request 在修正/取消后尝试条件中止。保留原始 brief/source、为合法取消及关联预留容量，未提高128000字节限制。
• §5.1(3)、§5.1(4)： goal_amendment_authority.ts:351 executeGoalAmendment 复用 work planner 与原 CAS/receipt；execute_request_amendment 独立读取原 Goal 终局再关联。绑定包含真实 store/source 身份；新编号、缺 source、迟到原 worker 都不能获得新效果。
• manager §5.10、manager §5.12： result_publication.ts:112 planCollaborationResult 与原返回链路保留各版本结果；省略版本仍指原始1。中途进展按修订保存，仅同修订结论能收起未发进展。Inbox、peer、Chat、Lark tracking 共用回读；新请求仍可在另一请求效果未知时独立推进。
• §9.2(1)、§9.2(2)、§9.2(3)： 前置的原承诺、冻结policy、实际新增工作/回执、精确实例/基线与现有租约保护已按当前调用关系复核；无 permission/objective/acceptance 扩张。
• §9.2(4)、§9.2(5)、§9.2(6)： 原操作恢复、独立peer adoption/claim和原义务消费继续复用前置owner；当前新增 RequestControl 在原交办详情提供完整编辑、取消和恢复。保存是一次操作手势，已知 Goal/接收方不用重填；未知响应跨刷新重试同一请求，读失败清除旧控件，过期编辑加载当前版本。未改首页/hero/主导航。
• M2/G1 promotion： 通用执行、真实团队两轮、独立实际验收和外部发送仍由原里程碑承担，未由此关闭。

边界内的未来整理已应用：工作图共享planner，原来源事实组装移到Core并删除旧函数，旧未发布Python适配器名被移除，类型化wire由前端复用。迁移成本也明确：原受控请求是新增语义，并非把旧writer换名；原始记录/返回和独立Goal路径继续存活。实际File/SQLite调用计数为首次request commit20次bridge、原操作replay15次、条件abort恢复14次，包含既有生命周期/replan观察，不是模型调用；未声称速度或token改善，也未为每字段新建RPC。

对主干的风险

• 中途返回修复后的原生路径225项通过、3项Win32专用跳过；新增同Goal未来请求不被旧fence捕获2项通过；typed request/result18项通过。最终仅CLI指引与测试变化，补跑开/关路径2项及当前主干完整输出对比通过。此前集成版本的313项通过和typing修正50项仍可复用到未变化边界，未把这些不同集合相加当覆盖率。
• 共享owner在41b22a51a的隔离真实PostgreSQL14.20上372项通过、0跳过，至最终head仅CLI指引及测试变化，相关owner字节未变；包含commit/abort/correction与原authority conformance，服务已停止。这不新增PG终端用户profile。
• 来源源码和独立安装正常wheel的真实浏览器均通过：生产注册、SQLite、原Chat入口、实际HTTP、独立receiver CLI、中途返回、丢成功响应后reload/同操作重试、过期编辑、读失败恢复、取消终局、中文/英文/390px。41个产品文件HEAD/source/wheel/install逐字节相同，退休适配器不存在。已检查整屏层级和状态；sidebar的generic Goal状态不可用没有被mock隐藏。
• 主干/候选使用同一份原请求保存状态，经CLI正向/冲突/重放与原会话回读，全输出和指引保持一致；新注册root commitments为单独校验的provenance增量，旧回执不回填。源码guard移除的隔离反例和中途返回旧实现都曾实际失败，修复后通过。未用实现输出充当预期不变量。
• 风险预合并检查19项及5项direct检查通过；TypeScript、Ruff、focused mypy、语义advisory/full drift、IO census和公共边界检查完成，无budget上调。较早一轮检查与manifest生成重叠触发tracked-side-effect；稳定树重跑保留guard后通过。浏览器曾因旧bundle拒绝、之后因可见文本与live-region双匹配失败；重建和精确定位后通过，没有删除行为断言。

远端CI在本次读取时仍排队；本地证据不替代hosted CI或merge readiness。合成replan历史、故障注入与真实本地后端不等同于真实模型或Lark发送，Windows专用路径本轮未资格。回退在新数据产生前可revert；新记录产生后应停止新准入并保留兼容reader/receipt/fence，不可删掉一侧记录制造可执行状态。

我的整体评价

APPROVE，限上述精确head的本地来源切片；交付判断是 justified_increment。已验证的价值是请求改动后仍能正确续行、历史结果不污染当前判断、取消与不确定效果不重复执行，并在原会话看到实际结果。维持长程原目标、未完成要求和权限边界；不以一次receipt、测试数量或此PR代表整个Goal完成。

请求和 Goal 分别保有自己的事务；复用既有 Inbox、Goal work planner、operation receipt 和返回链路，比另建请求库或用一次远端存活检查代替取消顺序更符合现有边界。 本 PR 交付受支持本地来源从修订/预留到提交或中止、独立回执关联和原会话回读的完整切片；主干至本 head 包含仍开放的前置 #6323，不能将它重复算作新成果。

前置#6323、hosted CI、维护者合并和更广profile推广分别保留。未执行merge、部署或运行用户的活跃Goal。

English verdict: APPROVE - 1675f57: the bounded local request revision/cancellation journey preserves one reserved Goal operation, authentic terminal linkage and revision-specific original-route results. Native positive/negative recovery, main/head full-output parity, isolated real PostgreSQL (372 passed), source/independent-wheel browser and risk-based validation passed. Prerequisite #6323 remains open; hosted CI, wider runtime/live-model qualification and merge authority are separate.

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @songoow.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @songoow.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[songoow]

Conflict reconciliation at 6637b26e17af5cdb4900c0a163f68a84ef962ecc against main 91b675dfca178db68d3527140272ffb263a3b319.

Native request correction and Goal amendment HTTP regression: 37 passed. TypeScript owner/proposal: 57 passed, 4 PostgreSQL cases skipped. Semantic vocabulary and registry I/O: 133 passed.

Control-plane typecheck, semantic advisory, regenerated I/O census (zero unclassified sites), and diff whitespace checks passed. No unmerged paths remain. No limits, history retention, activation authority or product defaults were changed by the resolution. Related refactor pass: unnecessary for this merge-only reconciliation; existing typed owners are retained.

This records conflict repair, not approval or merge readiness. Hosted CI and exact-head review remain separate; PostgreSQL was not requalified in this batch. No merge performed.