test(goal-direction): check in the F2 revision-drift fixture (GH-C89b)

[BigDataDZ]

Goal And Delivered Outcome

• Outcome basis / optional anchor: GH-C89b (contributor task board, Lane C) — goal-direction-baseline-v0 §7 synthetic case F2 / Appendix D. Claim issue: [Task]: check in synthetic case F2 for goal-direction-baseline-v0 (GH-C89b) #5547.

• Goal/source and gap: the RFC's M0 delivery (docs: define a provider-neutral goal direction baseline #4172) leaves its §9 F2 row as prose — nothing on main executes "revision changes expose drift without mutation", and Appendix D requires the fixture table to become a checked-in public-safe fixture with a mutation test before M1.

• Observable before → after, with the validation row that proves it: before, re_evaluation_required / material_revision_changed exist only in docs; after, python3 examples/goal-direction-baseline-f2-smoke.py passes on current main and proves that a revision change after the selected Agent's receipt reports re_evaluation_required / material_revision_changed with the changed item stale, while inputs stay byte-identical and no Vision patch, Todo, wake, lease, Goal amendment, or path delta is emitted — and its mutation arm fails under relaxed revision matching or cross-Agent receipt trust (rows below).

• Issue/task and intended base: Closes [Task]: check in synthetic case F2 for goal-direction-baseline-v0 (GH-C89b) #5547; base main.

Author Declaration

• Written by: model_agent — GLM agent (ZCode CLI), implementing @BigDataDZ's claim of board row GH-C89b.

Implemented against

• Specification and revision: docs/architecture/rfcs/goal-direction-baseline-v0.md @ upstream 99839ae (M0, landed in docs: define a provider-neutral goal direction baseline #4172)
• Criteria:

Criterion (spec clause)	Disposition	Symbol / path	Test or command
§7 / Appendix D F2: revision change after the Agent's receipt → re_evaluation_required; material_revision_changed; changed item stale	implemented	build_projection + assert_f2_contract in examples/goal-direction-baseline-f2-smoke.py	python3 examples/goal-direction-baseline-f2-smoke.py
F2 negative: no Vision patch, Todo, wake, lease, amendment, or path delta is emitted	implemented	effects list + MUTATION_EFFECT_KINDS top-level key check	same command
Harness contract: deep-copied inputs stay byte-for-byte immutable	implemented	canonical-JSON before/after comparison	same command
§9 key allowlist: no body/locator/URL/path/prompt/reasoning/transcript/trajectory/credential/run-log fields	implemented	assert_public_boundary + key-set checks (raw_source_body_recorded is the RFC's own negation flag)	same command
Appendix D closing note: mutation arm relaxing Agent or revision matching must fail	implemented	expect_f2_failure (relaxed revision, cross-Agent trust)	same command
Board exit: milestone table advances past M0 or records why not	implemented	§11 note + Appendix A ledger entry + Appendix C E4 row (bilingual)	docs review

• Self-check before submission: ran the smoke (passes), its two mutation arms (both fail the contract as required), ruff check on the new file (clean), and loopx check --scan-path docs/architecture/rfcs (public-boundary scan clean, 176 files). No runtime behavior assumed: the fixture is synthetic, adds no runtime code, and runtime modules are deliberately untouched.

Scope And Continuation

• Completed scope and remaining work: F2 is checked in with its mutation arm, and the RFC records why M1 stays closed. F1 and F3-F8 remain open until M1, per Appendix D.
• Slice boundary / successor: the M1 milestone owns the remaining cases and the runtime builder; the RFC milestone table is the tracker, so no successor issue is opened.

Validation

• Tested revision: d083d81 (example blob identical to the validated 23f6acb; docs re-encoded to LF only)
• Run state: finished
• Input classes: synthetic

Check kind	Result	Public-safe evidence / limitation
manual	passed	python3 examples/goal-direction-baseline-f2-smoke.py — F2 contract passes; both mutation arms fail the contract as required
static	passed	ruff check examples/goal-direction-baseline-f2-smoke.py — clean
static	passed	loopx check --scan-path docs/architecture/rfcs — public-boundary scan clean (176 files); expected registry-absent warnings only
unit	not_run	No runtime code changed; the fixture is standalone and needs no pytest run

• Coverage and gaps: the checks cover exactly the changed artifact (the new example) plus the two edited RFC docs via the boundary scan. Runtime modules are untouched, so no runtime tests are affected; the PR CI run is the remaining gate for the docs scan on Linux.

See validation disclosure guidance.

Frontend / Visual Evidence

• UI impact: none
• Before: N/A
• After: N/A
• States and viewports shown: N/A
• Source data: none
• Attention review: N/A

Type of Change

• Bug fix
• New feature
• Breaking change
• Refactoring (no functional changes)
• Documentation update
• Test update

LoopX Area

• Control plane (goals, todos, quota, scheduler, registry, runtime)
• Benchmark boundary (adapters, runners, verifiers, scoring, evidence)
• Capability or extension (providers, adapters, skills)
• Public docs or presentation surface (README, protocols, dashboard)
• Build, packaging, installer, or CI
• Host or runtime integration

Technical Direction

• Direction / acceptance reference, when applicable: Core control-plane hardening — goal-direction-baseline-v0 (GH-C89b)

Shared-authority RFC fixture impact

N/A — this PR does not touch the TypeScript control-plane migration or the shared Goal Authority RFC fixtures.

Boundary Checklist

• Neither the diff nor this PR body/comments/attachments disclose private state, credentials, raw traces or verifier output, internal links, or local machine paths (including .loopx/, .codex/goals/, and live ACTIVE_GOAL_STATE.md).
• I did not duplicate maintainer-owned benchmark work unless a maintainer split out a public issue for it.
• I kept the change scoped to the linked issue/task.
• I completed the visual evidence section for UI changes, or marked UI impact none.
• Every commit includes a DCO Signed-off-by trailer (git commit -s).

[huangruiteng]

Reviewer: model_agent — gpt-6.1-sol (OpenAI); runtime_reported; reasoning_effort=xhigh

Exact reviewed head: d083d81

动机

方向材料更新后，维护者需要能复现“旧阅读记录不能证明新版本已读”的检查，避免未来 builder 把过期依据继续显示成 current。

此前 RFC 的 F2 修订漂移行只有文字，没有可执行反例。现在用两个虚构材料和同一 Agent 的阅读记录，先验证 current，再把一个材料的要求版本从 rev-6 改为 rev-7，验证它变成 stale 并提示重新评估。

该合成检查实测输出 re_evaluation_required/material_revision_changed，输入保持字节一致且 effects 为空；放宽 revision 和跨 Agent 复用新阅读记录的两个变体均被拒绝。

本 PR 交付 pre-M1 合成 fixture 与双语记录，不交付生产 builder、consumer、真实材料读取或 Vision/Todo/lease 写入；M1 入口决策和其余 F1/F3–F8 未完成。

改动思路

规范采用 docs/architecture/rfcs/goal-direction-baseline-v0.md，固定版本 99839ae，并先读 #5547 GH-C89b 的 fixture-only 边界。逐项映射：F2：同 Agent 的旧 revision 不能证明新版本已读；Appendix D：故意放宽 revision/Agent 匹配必须让同一个 F2 oracle 失败；§11：合并 M0 或合成 fixture 不授权 M1；§7：不复制源文、不产生写入权限或变更。这些标准来自改动前 RFC；新增 ledger 不用作自证标准。

具体改动

invented_authority/invented_receipts 提供两个虚构材料，build_projection 是 fixture 内的纯 builder。assert_f2_contract 独立检查聚合状态、原因、stale 行、新旧 revision、2/1/1/0 计数、零 effects、输入字节一致、truth flags 和公开字段边界。expect_f2_failure 复用同一 oracle，两条 arm 分别放宽版本和 Agent 匹配；digest 还检查 authority 更新后变化、不同 Agent 共用同一 authority 时不变化。两份 RFC 只加 pre-M1 限定、镜像 ledger 与 fixture 链接，E4 仍标 pending；没有改规范要求。

对主干的风险

独立运行脚本通过 F2 正例及两个匹配变异。额外注入 todo_write effect 和修改 authority 输入均被 oracle 拒绝；把正确 projection 传给 expect_f2_failure 会报“mutation passed”，证明它不是靠无关前置错误伪造 mutation 成功。

首次 premerge 因缺失本机 TypeScript 检查依赖失败；npm ci --ignore-scripts 后同命令的技术检查全部通过，但 overall gate=quality_receipt_missing，diff/compile、semantic、风险检查、公开边界通过，无 manual hold。本地 Goal 严格质量 receipt 缺失，overall premerge 仍为 false；检查 scope 还包含不属于 PR 的未跟踪 uv.lock。此项保留为合并门槛，本次只评审、未合并。未读取/等待远端 CI。字段 denylist 只是本合成输出的辅助公开性检查，核心 drift 状态依赖显式 revision/Agent 比较；不应作为未来生产分类或隐私完备性证明。

主要局限是没有生产 builder/consumer：这条测试不能发现将来生产实现独自退化，也没有证明真实 Goal store、receipt 排序、frontend 展示或长程业务效果。F1、F3–F8 和 M1 决策仍保留原交付边界；此处不因未来缺口否定明确要求的 F2 prerequisite。

我的整体评价

APPROVE，结论限于 #5547 的 F2 fixture 交付。long_horizon=preserved：本 PR 不接入运行中的 Agent，不改 wake、quota、lease 或 Vision/Todo；旧依据和跨 Agent 复用受到可执行契约压力。user_experience=improved：维护者由只能读表格变为可执行一条命令、看到真实失败反例；生产用户体验收益仍待 M1/M2 证明。未来重构检查建议在 M1 接入 typed owner 时复用独立 oracle、替换 fixture-local builder，不添加第二生产权威。现有覆盖和同作者近期批次没有同形 F2 重复。341 行有维护成本，但含独立 oracle、公开边界及有意义 mutation，未引入闲置生产框架，符合明确的 pre-M1 请求。

English verdict: APPROVE - d083d81; the accepted pre-M1 F2 boundary is now executable and mutation-sensitive; F2, independent effect/input/non-vacuity probes and canary technical checks passed; strict local quality-receipt merge hold retained. This does not qualify a production builder or consumer.