test(authority): qualify Turn ownership with NoKV

[wchwawa]

Summary

• Gate the real Turn execution and settlement path with one shared authority binding behind the explicit LOOPX_SHARED_AUTHORITY_TEST_ONLY=1 switch.
• Qualify two real LoopX CLI processes through Todo selection, authority claim, Host admission, writeback, quota, authority completion, scheduler evaluation, receipt readback, replay, expiry/reclaim, SIGKILL recovery, and stale-writer fencing.
• Add an explicit NoKV guard backend with no file fallback, and fence prepared-effect receipt repair before any resolver-side mutation.

@huangruiteng This is PR 3 of the stack and remains a Stage 4 TEST ONLY qualification surface.
Stack: #3818 -> #3819 -> this PR.

Issue Or Task

• Implements the approved post-feat(control-plane): add recoverable shared-authority foundation #3669 Turn-composition and live NoKV E2E slice.
• Contributor task ID: stage-4-authority-product-chain

Validation

• Focused Python suite: 149 passed, 1 expected live opt-in skip
• Live NoKV two-process product E2E: passed; random head removed with exact generation after independent readback
• Fault injection: pre-admission outage runs no Host; post-Host outage blocks writeback, quota, completion, and scheduler
• Mutation checks killed missing authority completion, stale lease/epoch bypass, and reused physical NoKV attempt identity
• Current Node and Node 22.6 native strip: 426 passed, 1 existing PostgreSQL environment skip
• npm run typecheck:control-plane; Ruff check/format; diff check
• loopx canary premerge --from-git-diff --git-diff-base codex/stage4-authority-canary (18/18 selected checks, no warnings or holds)
• NoKV main was read-only; its full Rust workspace tests and clippy passed at the qualified revision

Supplementary EchoJournal/Codex rehearsal was not used as merge evidence: three NoKV authority races each admitted exactly one CLI identity, but the sole winner stopped at Codex CLI authentication/compatibility. This PR therefore does not claim a completed real-model chain.

Type of Change

• Bug fix
• New feature
• Documentation update
• Test update

LoopX Area

• Control plane (goals, todos, quota, scheduler, registry, runtime)
• Public docs or presentation surface (README, protocols, dashboard)
• Host or runtime integration

Technical Direction

• Core control-plane hardening

• Shared Goal Authority and cross-host coordination

• Target base branch: codex/stage4-authority-canary

• Direction tracker or promotion unit: Stage 4 TEST ONLY Turn/provider qualification

Scheduler evaluation/projection is covered; wake delivery and ACK are not. Inbox is only an urgency signal and cannot grant authority. Production promotion still requires an effect-owning fenced commit for arbitrary Host mutations plus lease keepalive/cancellation; this stack does not weaken those Stage 5 holds.

Boundary Checklist

• I did not commit .loopx/, .codex/goals/, live ACTIVE_GOAL_STATE.md, credentials, private benchmark traces, verifier output, raw agent sessions, internal document links, or local machine paths.
• I did not duplicate maintainer-owned benchmark work unless a maintainer split out a public issue for it.
• I kept the change scoped to the linked issue/task.
• Every commit includes a DCO Signed-off-by trailer (git commit -s).

[wchwawa]

@huangruiteng Follow-up validation is complete.

Root cause: the authority winner was admitted correctly. The earlier CI failure happened later because the test fixture attempted accountable multi-agent writeback from a canonical checkout, so the existing independent-worktree guard correctly failed closed. The losing agent was fenced as expected.

The E2E fixture now declares repository causality, creates a credential-free temporary repository with a real linked worktree, and verifies the recorded delivery workspace before settlement. No production behavior or guard was weakened.

Validation:

• canonical checkout: red before the fixture repair, green after it on Python 3.11 with xdist
• focused authority and Turn tests: 149 passed, 1 opt-in live skip
• full local CI command: 5146 passed, 13 skipped, 71.32% coverage
• GitHub Python Tests: Linux and Windows passed
• LoopX premerge gate: 18/18 passed

[huangruiteng]

动机

RFC 最终确实需要一个 Goal、两个 Agent 的 TEST ONLY canary，验证 shared coordination authority 能约束 Turn admission、lease fencing、恢复和 settlement composition。这个目标有价值，且显式环境开关、无 NoKV→file fallback、恢复时缺 guard fail-closed 都是正确的安全方向。

改动思路

本 PR 在真实 turn run-once 主路径中注入 argv/stdin authority guard：Host 前 admission，writeback/quota/completion/scheduler 前 revalidation；示例 guard 再调用 Python CoordinationAuthorityExecutor 与 file/NoKV coordination provider 执行 claim、renew、complete。测试覆盖双进程竞争、过期 reclaim、SIGKILL 与 stale fence。

具体改动

• 新增约 891 行的 Turn authority checkpoint/controller，并改造 executor settlement composition；
• 新增 authority_rejected Turn result/journal contract；
• 增加 TEST ONLY CLI 参数和环境门禁；
• 新增约 610 行 Python reference guard、约 670 行 canary，以及大规模 E2E/恢复测试；
• 对 prepared-effect resolver、terminal completion 和 scheduler 增加 authority checkpoint。

对主干的风险

这是当前 stack 的架构 blocker，不应作为 Stage 4 qualification 合入：

1. 阶段越序。 RFC 要求先完成 Stage 2C local canonical promotion，再做 Stage 3 从唯一 local canonical 到远端候选的单向 shadow，之后才进入 Stage 4。当前 #3818 只提供 best-effort post-commit observation，尚未 promotion；#3819 也只是 Stage 2A provider candidate。本 PR 却以非 Draft 形式把真实 Turn 主路径登记为 Stage 4。
2. 没有消费上一层的 TypeScript NoKV provider。 #3819 新增的是 NoKVAuthorityStore + byte-only helper；本 PR 的 authority_guard.py 实际使用旧的 Python CoordinationAuthorityExecutor 和 examples/nokv-shadow-provider/provider.py 的 NoKVCoordinationProvider。因此 “#3818 → #3819 → #3820” 在 authority execution 上并未真正组合，反而形成第二条 Python provider/semantic path，违背 TypeScript transaction owner 与单一 authority seam 的规划。
3. canary 尚不能证明 RFC 要求的 effect safety。 README 已承认没有 arbitrary Host workspace-effect exactly-once、lease keepalive/cancellation、wake delivery/ACK。没有 keepalive/cancellation 时，长 Host 执行期间 lease 可过期并被 reclaim，旧 Host 仍可能继续产生外部 effect；因此现有成功用例不能作为 Stage 4 “外部 effect 不重复”证据。
4. binding 未完整绑定 Turn identity。 reference guard 的后续 revalidation 只验证 admission receipt 与 agent_id/todo_id/lease，没有重新校验 admission operation_id 必须由当前 request 的 turn_key 推导。把同一 agent/todo 的另一份有效 admission binding 代入当前 journal，后续 checkpoint 可能接受跨 Turn binding。需要 cross-Turn substitution negative test，并让 admission receipt/binding 明确覆盖 turn/effect identity。
5. default-off 路径的执行效果基本保持隔离，但公共 Turn result/journal schema 已增加 authority_rejected；所以可以说“默认不启用 guard”，不能把它表述成主路径/协议完全零变化。

建议将 PR 暂时转 Draft/hold。若想保留实验价值，可以先把 canary 留在 examples/tests 中，不接入 production Turn executor；正式推进时应：

• 基于 Stage 2C promotion + Stage 3 shadow 的 canonical/provider binding；
• 直接消费 TypeScript AuthorityStore/NoKV adapter 和同一 typed transaction boundary，不再建立 Python subprocess authority oracle；
• 由 registry/service 声明 provider binding，而不是用任意 argv 充当产品 authority selector；
• 补齐 Host lease liveness/cancellation 或将 effect-owning fence 收进可恢复协议；
• 增加 cross-Turn binding substitution、长 Host 过期/reclaim、ambiguous effect reconciliation 的负向测试。

我的整体评价

这是有价值的未来 canary 原型，但规模很大、进入真实 Turn 核心，并且越过了 RFC 的两道 promotion gate。TEST ONLY 只能隔离默认用户风险，不能替代阶段顺序和单一语义 owner；当前形态应 Request changes/hold，而不是视为 Stage 4 已完成。

English verdict: Request changes and hold. This is a useful future canary prototype, but it jumps ahead of local canonical promotion and one-way remote shadow, bypasses the new TypeScript NoKV AuthorityStore through a second Python authority path, and cannot yet prove long-running Host effect safety. Rebase the design on the single typed authority boundary and bind admission receipts to the exact Turn identity before Stage 4 qualification.

[wchwawa]

@huangruiteng #3819 has been unstacked onto main as the independent Stage 2A NoKV candidate, while #3818 is now the Stage 2C observation foundation. That intentionally invalidates this PR's old promotion stack and makes its current diff non-reviewable as a stage sequence.

I am marking #3820 Draft and keeping it on hold. It should be re-cut only after the remaining Stage 2C parity/crash/migration work, the separate local-authority promotion, and Stage 3 remote shadow parity are complete. Please do not merge this head.