chore(release): prepare 1.3.0 long-horizon semantic control quality by loopx-agent · Pull Request #5682 · loopx-project/loopx

loopx-agent · 2026-10-05T12:38:14Z

LoopX 1.3.0 release preparation

The release improves continuing work, evidence-driven replanning and scoped recovery/settlement, informed by the latest long-horizon study and Astra-assisted engineering. Study workers remain gpt-6.1-sol/xhigh; no paired version outcome uplift is claimed.

Release Decision

Who should upgrade: Operators of continuing Codex work, evidence-driven replanning, and workspace Chat should consider this version once it is published. Users satisfied with v1.2.4 can remain there while the candidate is qualified.

What this release solves: Useful history could be crowded out by repeated observations; an already-known replan could demand a failed round trip; task steps, permission failures and settlement hints could point to the wrong recovery. This release collects bounded fixes to those paths, alongside clearer workspace Chat and explicit configuration recovery.

Breaking changes: No intentional breaking migration. Ordinary host-declared project Chat now defaults to workspace_write; choose workspace_read explicitly when needed. Existing read-only App bindings retain their grant. New generated settlement commands carry correctly placed global --format json; direct CLI defaults and stored receipts are unchanged. Managed execution names deepseek-flash; explicit historical model settings remain respected. Canonical new-Goal creation and Explore execution remain opt-in. Existing Goals are not migrated by a device preference. Lifecycle-only registry metadata and stored workspace approval no longer authorize a Codex workspace-write resume; an admitted runtime source is required.

How to verify: Expect loopx 1.3.0, a healthy owning installation, and a current scoped status/diagnostic readback after upgrading. Investigate unavailable or blocked results before starting work.

loopx --version
loopx doctor
loopx --format json status
loopx diagnose --goal-id "$GOAL_ID"

Contributors: @Inference1, @Duang777, and the other eight community contributors below are attributed to shipped work in the v1.2.4 → reviewed candidate range, with linked PRs and concrete contributions. The final source range contains 159 merged PRs and 10 eligible community contributors.

Product groups

Semantic control: explicit settled work-Turn review can qualify replanning while a Todo remains open,with legacy completed-Todo defaults preserved;the Task inspector exposes current blocked reasons. typed work/notice selection, complete executable settlement and durable recovery; lifecycle-only registry metadata cannot authorize Codex workspace-write resumes.
Workspace and host workflows: ordinary scoped Chat, checkpoint backup/recovery, opt-in canonical new Goals, governed delegation and preserved original Session identity.
Evidence and integrations: opt-in Explore/public GitHub evidence, managed DS profiles and scoped finance/DSH integration. Ego source reading is a staged adapter; native Bot adoption remains unqualified.

Community Contributors

@Inference1 — first-time external contributor: four document-version owners, one Lark visibility owner, five shared field vocabularies and one canonical agent-lane progress-scope vocabulary (#5597, #5621, #5684, #5654).
@mikamikasuki — first-time external contributor: refresh no-write mutation regression, exact source-session observation and retirement of completed contributor/RFC checkpoints (#5574, #5576, #5577, #5579, #5595, #5601, #5613).
@jackie-cqz — external contributor: native child result attribution, public GitHub evidence, shared validation, Windows paths/configuration publication and Chat delivery retry (#5455, #5459, #5526, #5602, #5603, #5606).
@Duang777 — external contributor: Goal recreation fences, validated inbox read commits and accountable Goal-level writeback, desktop update-pointer rollback protection and interrupted backup rotation recovery, atomic desktop rollback-bundle replacement, merged-contract compatibility, bounded runtime/configuration recovery and stale desktop update-response fencing (#5338, #5563, #5588, #5645, #5647, #5533, #5693, #5651).
@hhyykk — external contributor: one-request TypeScript checkpoint context (#5585).
@catwithtudou — external contributor: repository identity normalization for leases and preserved diagnostic chronology (#5572, #5584).
@songoow — external contributor: governed delegation stop, native fixture cleanup, exact-target CI recovery and focused smoke governance, impact-scoped CI qualification and background runner demand (#5308, #5534, #5535, #5539, #5567, #5652).
@BigDataDZ — external contributor: the committed goal-direction F2 revision-drift fixture (#5549).
@maxliux5 — external contributor: personal follow-through documentation consolidated into the existing manager profile (#5384).
@AronSwan — external contributor: explicit session input failures and delivery-time payload/transport conflicts, preserving replay identity (#5554).

Optional Capability Activation & Use

Explore Harness

Activation: In Goal settings → Capability Center choose evidence or planning. CLI planning opt-in is shown below; the default is off.

Validation: Read turn context and summary for the same Goal/Agent; recorded nodes alone do not prove adoption.

Disable / rollback: Set --explore-mode off --execute; retained evidence stays readable.

Authority boundary: Analysis and planning grant no worker spawning, claims, quota spend, merge or external publication.

Docs: Versioned guide

loopx configure-goal --goal-id "$GOAL_ID" --explore-mode planning --explore-harness-profile adaptive-resilient --execute
loopx explore turn-context --goal-id "$GOAL_ID" --agent-id "$AGENT_ID"
loopx explore summary --goal-id "$GOAL_ID"
loopx configure-goal --goal-id "$GOAL_ID" --explore-mode off --execute

TurnEnvelope and captured decisions

Activation: Opt in per guard invocation with --turn-envelope; add --decision-output-dir only with an explicit Turn id and a new directory whose parent exists.

Validation: Read the returned capture and verify Goal/Agent/Turn, original source hash and ok; observe rejection and incomplete publication honestly.

Disable / rollback: Omit both options. Delete only no-longer-needed private captures through ordinary file management.

Authority boundary: Saved decisions are private observations, not fresh admission; selection, leases, cancellation and mutation-time checks remain mandatory. Frontend/Lark do not consume these files.

Docs: Versioned guide

loopx --format json quota should-run --goal-id "$GOAL_ID" --agent-id "$AGENT_ID" --turn-instance-id "$TURN_ID" --turn-envelope --decision-output-dir ./guard-001
cat ./guard-001/decision.json

Ordinary workspace Chat

Activation: Run loopx chat; in the App steward conversation choose an already granted workspace in Scope. Host-declared roots now default to workspace_write; use the explicit read-only command below when required.

Validation: Read the selected scope, effective grant and returned result in the same conversation. A changed grant creates a new context; old history remains.

Disable / rollback: Restart the service with --project-workspace-grant workspace_read, or revoke the host workspace grant; new work on the old context is rejected.

Authority boundary: Workspace writes follow AGENTS.md and the actual sandbox. No hidden Goal, portfolio grant, peer delegation or external-send authority is created.

Docs: Versioned guide

loopx chat --project-workspace-grant workspace_read --no-open

Owner private Lark conversations

Activation: In Settings → Lark explicitly verify the selected App and personal owner, choose a workspace, executor, grant and ordinary Chat or steward role, then connect. /delegate --tokens N objective requires an original-source confirmation. /agents, /agent TARGET_REF and /project use separately authorized attached-Agent targets. In ordinary project/steward conversations send a PNG/JPEG/GIF/WebP image or image/text post under that same binding; no extra image switch is required. At most four images, 5 MiB each and 12 MiB total.

Validation: In the bound private conversation send /status and /help; verify the App/source, role, workspace grant, original Session/Turn and queue. Inspect the same binding in Settings. Check the original conversation and caption, same Session/Turn, and conclusion returned to the bound private steward. A download failure, unsupported mixed media, control-command image or attached-host image must return an explicit non-execution notice; do not treat its text as executed.

Disable / rollback: Disconnect that exact App binding in Settings → Lark; /stop targets the current ordinary Turn and /stop-commission targets the bound commission. Remove exact Agent target grants separately.

Authority boundary: Personal credentials, source/owner and listener identity remain explicit. Ordinary Chat creates no Goal; commission confirmation does not grant arbitrary writes, automatic heartbeat or canonical task acceptance. Live Lark/mobile qualification is separate. The receiving App alone downloads its canonical message resources. Image bytes and keys stay private; grants are checked again after download and before return.

Docs: Versioned guide

loopx chat --project-workspace-grant workspace_read --no-open
loopx chat --help

Configuration checkpoints

Activation: Settings → Capability Center → Configuration backup and recovery downloads a private checkpoint. CLI export uses a new destination, preview first, then --execute.

Validation: Run configuration-backup verify on the exact file; compare source scope and digest. Integrity verification does not certify privacy.

Disable / rollback: An isolated restored checkpoint can be removed without affecting live settings. Revert any adopted setting through its existing revision-checked editor or machine-config/configure-goal transaction.

Authority boundary: Capture and isolated restore copy no credential store, Host session, grant, provider selection, live registry, fence, lease or scheduler. Backups remain private, including secrets already embedded in configuration.

Docs: Versioned guide

loopx --format json configuration-backup export --goal-id "$GOAL_ID" --output "$NEW_CHECKPOINT_FILE"
loopx --format json configuration-backup export --goal-id "$GOAL_ID" --output "$NEW_CHECKPOINT_FILE" --execute
loopx --format json configuration-backup verify --input "$NEW_CHECKPOINT_FILE"

Canonical new-Goal creation

Activation: In Device defaults → New Goal authority opt in to canonical creation and choose File/SQLite plus soft_claim/hard_lease. The same v1 document uses the existing preview/apply transaction; default remains off.

Validation: Inspect machine settings, bootstrap a new empty project, then read its Todos and native authority receipt; existing Goals are not retargeted.

Disable / rollback: Preview/apply canonical_creation=false to disable future creation, or remove the goal_storage namespace with its exact removal-plan revision. Existing Goals retain storage and fences.

Authority boundary: Storage and execution policy are independent of tools, accounts, network, scheduling and migration authority. Missing authority cannot be recreated as empty by forced bootstrap.

Docs: Versioned guide

loopx machine-config preview --namespace goal_storage --config-json goal-storage.json
loopx machine-config apply --namespace goal_storage --config-json goal-storage.json --expected-plan-revision "$PLAN_REVISION" --execute
loopx machine-config inspect
loopx machine-config remove --namespace goal_storage
  # Review removal, then use its returned revision.
loopx machine-config remove --namespace goal_storage --expected-plan-revision "$REMOVAL_REVISION" --execute

Governed delegation stop

Activation: Use an already configured exact binding, registered requester and operation; delegation stop --execute explicitly requests stop. CLI/MCP and the App team surface share that owner.

Validation: delegation read distinguishes acknowledgement, proved native process drain and settlement. Missing supervision remains unknown and requires the returned recovery.

Disable / rollback: Remove the exact operator binding to revoke new execution; use stop on an active operation. A stopped/settled receipt is not a resume grant.

Authority boundary: Do not infer Host exit, lease release or non-execution from absent records. Windows/unsupported stopping refuses before launch-side cancellation effects.

Docs: Versioned guide

loopx delegation stop --goal-id "$GOAL_ID" --agent-id "$AGENT_ID" --execution-config "$DELEGATION_CONFIG" --operation-id "$OPERATION_ID" --execute
loopx delegation read --goal-id "$GOAL_ID" --agent-id "$AGENT_ID" --execution-config "$DELEGATION_CONFIG" --operation-id "$OPERATION_ID"

PR review queue ownership and direction

Activation: Capability Center configures additional owner logins and forward/reverse direction; Goal CLI can set exact per-Agent direction. Current-session request intake precedes generic queue discovery.

Validation: Inspect configure-goal and the read-only pr-review packet; compare effective accounts, Agent and direction. Queue ownership is separate from GitHub author identity.

Disable / rollback: Use --clear-pr-review-owner-logins --execute, --pr-review-agent-order AGENT=inherit, or --clear-pr-review-configuration --execute. Remove owner_logins from Goal/device settings before downgrading.

Authority boundary: These settings grant no GitHub review, comment, dismissal, merge, cross-Agent write or scheduler authority; review depth and CI policy retain their owner.

Docs: Versioned guide

loopx configure-goal --goal-id "$GOAL_ID" --pr-review-owner-login maintainer --pr-review-agent-order reviewer-a=forward --execute
loopx configure-goal --goal-id "$GOAL_ID"
loopx pr-review --goal-id "$GOAL_ID" --agent-id reviewer-a --repo "$REPOSITORY" --format json
loopx configure-goal --goal-id "$GOAL_ID" --clear-pr-review-configuration --execute

Public GitHub evidence

Activation: Opt in per plan with --public-github and a full commit SHA source; execute --execute authorizes anonymous source reads.

Validation: Read back the exact plan and execution receipt. Parent admit/reject and downstream research-ledger coverage are separate explicit operations.

Disable / rollback: Omit --public-github and --execute; no persistent provider switch is installed. Retire evidence only under the admitted downstream-coverage rules.

Authority boundary: No token, cookie, private repository, mutable branch source, raw-page persistence, automatic admission or outbound message permission. Complete frontend initiation remains open.

Docs: Versioned guide

loopx external-evidence plan --public-github --objective "Inspect public source" --user-activity "Choose a source" --decision "Whether a literal is present" --evidence-kind literal_match --source "$SHA_PINNED_PUBLIC_URL" --search-term LoopX --format json > plan.json
loopx external-evidence execute --plan-json plan.json --execute --format json > execution.json
loopx external-evidence readback --plan-json plan.json --receipt-json execution.json

Managed DeepSeek model selection

Activation: Managed execution now names deepseek-flash@high. Explicit LOOPX_TURN_MODEL/DSH_MODEL or --dsh-model overrides are still honored; configure credentials through the owning provider.

Validation: Read turn run-once --help and the returned runtime profile/actual provider identity; a model alias alone is not live qualification.

Disable / rollback: Set LOOPX_TURN_MODEL to the previous explicitly selected model and restart the owning host. Do not change an existing session silently; omitted configuration restores the shipped managed default.

Authority boundary: A model setting grants no API credential, paid invocation, workspace, permission, Goal or provider promotion authority. CPA routing remains separately installed/operator-owned.

Docs: Versioned guide

LOOPX_TURN_MODEL=deepseek-flash loopx turn run-once --help
  # Explicit rollback selection for the next owning host invocation:
export LOOPX_TURN_MODEL="$PREVIOUS_MODEL"

Finance evidence assessment

Activation: Finance Value Discovery is a separately installed source extension at version 0.8.5; install from the v1.3.0 checkout and register/enable its matching manifest. Select assess-period or assess-cash per command; no automatic assessment switch exists.

Validation: Run extension doctor, then assess-period on a reviewed local input. Producer accuracy, period eligibility, source authenticity and investment truth remain distinct. Use the supplied six-row cash example below; inspect arithmetic residuals, unknowns, source-column/unit/sign and measurement-kind failures. App/Lark cash presentation and production source adoption remain unqualified.

Disable / rollback: Disable loopx-finance-value-discovery with the command below. Retain private account/position observations outside public research projections.

Authority boundary: The package performs deterministic evidence assessments; it grants no investment advice, order, transfer, signing or execution authority. Missing source/timezone/binding evidence stays explicit.

Docs: Versioned guide

  # In a v1.3.0 source checkout:
python3 -m pip install ./packages/loopx-finance-value-discovery
loopx extension install --manifest packages/loopx-finance-value-discovery/extension.toml --execute --format json
loopx extension enable loopx-finance-value-discovery --execute
loopx extension doctor loopx-finance-value-discovery --execute
loopx-finance-value-discovery assess-period --input-json period.json
loopx-finance-value-discovery assess-cash --input-json packages/loopx-finance-value-discovery/examples/cash-reconciliation-v1.json
loopx extension run loopx-finance-value-discovery --input-json packages/loopx-finance-value-discovery/examples/cash-reconciliation-v1.json --execute --format json
loopx extension disable loopx-finance-value-discovery --execute

EdgeBench native trials

Activation: Explicit research-only invocation from a v1.3.0 checkout; Linux, Docker, pinned EdgeBench/SForge/Harbor, selected Codex binary and authorized model access are prerequisites. Use the selected worker and feedback profile.

Validation: Run --help before the reviewed trial; read session/model, native terminal result, evaluator completion and isolation receipts. Registration and sampling counts do not prove countable outcomes.

Disable / rollback: Do not start another trial; stop the exact owned trial/controller and TLS relay through their existing cancellation lifecycle. Preserve private logs and incomplete results.

Authority boundary: A release launches no benchmark jobs. The native judge owns task/scoring; blind policy requires separately qualified credential/network/submission isolation. Raw evidence and secrets remain private.

Docs: Versioned guide

python -m benchmark.edgebench.run --help
  # Paid execution only after the operator reviews task, pin, isolation and budget:
python -m benchmark.edgebench.run --task "$TASK_ID" --tasks-dir "$TASKS_DIR" --log-dir "$PRIVATE_LOG_DIR" --run-id "$UNIQUE_ATTEMPT" --worker heartbeat-resume --model "$MODEL" --effort xhigh --judge-url "$JUDGE_URL"

DSH LoopX plug-in

Activation: Install the separately published 0.1.1-beta.6 into the web profile below. Check DSH compatibility first; the qualified current host is 0.2.0-rc.2. Loading prepares the isolated CLI/skills and GoalBar; the passive Driver activates only after this exact Session invokes the installed loopx skill.

Validation: Check dsh --version, then resolve the exact live Session binding. Require status=bound and one Goal/Agent pair before using GoalBar. Installed files alone do not establish a live binding.

Disable / rollback: Remove dsh-loopx-plugin from the same profile and restart DSH. To roll back, install a retained previous tarball supported by that host; preserve LoopX state.

Authority boundary: Installation may prepare the isolated CLI and skills, but grants no Goal binding, quota spend, model call or execution by itself. LoopX owns Goal/Todo/Agent decisions; no credentials are bundled. GoalBar and Driver use the authenticated local Session boundary.

Docs: Versioned guide

dsh --version
dsh plugin --profile web add "https://github.com/loopx-project/loopx/releases/download/dsh-loopx-plugin-v0.1.1-beta.6/dsh-loopx-plugin-0.1.1-beta.6.tgz"
dsh --profile web --port 0
#After invoking the installed loopx skill in the exact DSH Session:
loopx --registry .loopx/registry.json --format json resolve-agent-thread --host-surface deepseek-harness-native --thread-id "$DSH_SESSION_ID"
dsh plugin --profile web remove dsh-loopx-plugin

Already bound steward inbox execution

Activation: Use an existing reviewed task binding and requester. Configure its existing execution file below, then add the exact {goal_id, agent_id, requester_agent_id, binding_id} row to execution_bindings in the same verified private sources[channel] policy; retain sender_ids. Chat may select that authorized binding in context_handoff. No new task or host is provisioned.

Validation: Read the receiver inbox and exact delegation operation. Delivery, launch submission, receiver adoption, native result, canonical acceptance and original-audience return remain separate. runtime_unverified and refused admission retain their recovery.

Disable / rollback: Remove that exact execution_bindings row from the same source policy to revoke future launches and replays. Inspect and stop any already launched exact operation with delegation stop --execute; stopping the manager does not stop its independent worker.

Authority boundary: Sender/read/context grants do not grant execution. Canonical preflight, registered requester, provider provenance and original Turn remain required. No new scheduling, cross-host launch, arbitrary command, protected write or publication authority; operator-editor/discovery completion remains staged.

Docs: Versioned guide

loopx configure-goal --goal-id "$GOAL_ID" --subagent-execution-config "$BINDING_CONFIG" --execute
loopx manager-inbox status --goal-id "$GOAL_ID" --agent-id "$AGENT_ID"
loopx manager-inbox read --goal-id "$GOAL_ID" --agent-id "$AGENT_ID"
loopx delegation read --goal-id "$GOAL_ID" --agent-id "$AGENT_ID" --execution-config "$BINDING_CONFIG" --operation-id "$OPERATION_ID"
loopx delegation stop --goal-id "$GOAL_ID" --agent-id "$AGENT_ID" --execution-config "$BINDING_CONFIG" --operation-id "$OPERATION_ID" --execute

Independent macOS service and Chat Codex homes

Activation: On macOS use the script from a v1.3.0 checkout and one qualified installed CLI owner. Set CODEX_HOME for service execution and LOOPX_CHAT_CODEX_HOME for Chat explicitly when changing them; omitted selections preserve existing bindings on install/restart.

Validation: Run service status, then inspect the actual running Chat identity and each selected home. Synthetic source checks do not prove login-after-reboot or provider acceptance.

Disable / rollback: Run stop to unload the two owned services or uninstall to remove their two plists. Reinstall the previous package through the same installation owner and restart to roll back; project state and credential homes are retained.

Authority boundary: Choosing a model home does not copy credentials between profiles or grant Goal, workspace-write, provider-call or external-message authority. New scan paths remain discovery inputs, bounded by Core authorization.

Docs: Versioned guide

CODEX_HOME="$EXECUTION_CODEX_HOME" LOOPX_CHAT_CODEX_HOME="$CHAT_CODEX_HOME" bash scripts/macos-dashboard-launchagent.sh install
bash scripts/macos-dashboard-launchagent.sh status
bash scripts/macos-dashboard-launchagent.sh stop
bash scripts/macos-dashboard-launchagent.sh uninstall

Rendered public-source MCP reader

Activation: Explicitly add a unique [mcp_servers.loopx_ego_source_read] to the actual execution host: command is the installed environment Python, args = ["-m", "loopx.extensions.ego_source_reader"], startup_timeout_sec = 30, tool_timeout_sec = 40. Its env must supply the four LOOPX_EGO_READ_* values below. Reserve one existing Ego Page and public origins only; restart the idle host and resume its original Session. The adapter remains a staged integration; native Bot/channel promotion is unqualified.

Validation: Read the stdio tool inventory below, then call read_public_url and read_public_image from that same host with an allowed URL/index. Inspect requested/observed URL, digest, truncation and actual image content; an out-of-origin call must be refused. A text result does not qualify visual understanding or complete article coverage.

Disable / rollback: Remove only that uniquely named MCP entry and restart the idle host. Restore the prior private config/package through the same installation owner when rolling back; preserve other MCP entries and Session bindings.

Authority boundary: Origin setup grants no private/admin-site permission, sandbox change, workspace write, note edit, publication or delegation. Page content is untrusted. Rendered image regions may be occluded; keep the Page exclusively reserved and respect user takeover.

Docs: Versioned guide

export LOOPX_EGO_READ_BIN="$(command -v ego-browser)"
export LOOPX_EGO_READ_TASK_SPACE="$RESERVED_TASK_SPACE_ID"
export LOOPX_EGO_READ_PAGE="$RESERVED_PAGE_LABEL"
export LOOPX_EGO_READ_ORIGINS="https://example.com"
"$LOOPX_ENV_PYTHON" -m loopx.extensions.ego_source_reader <<'JSONL'
{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"source-reader-readback","version":"1"}}}
{"jsonrpc":"2.0","method":"notifications/initialized"}
{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}
JSONL

Canonical retirement with an existing successor

Activation: For already promoted canonical Goals, opt in per original guarded Turn with todo supersede --successor-todo-id; use the original Goal/Agent/Todo/Turn and existing successor. Carry the actual lease proof required by that Goal. This is a state mutation without an additional execute flag; it does not enable canonical authority.

Validation: Read todo list for the same Goal after the operation. Verify the original is superseded, links point to existing work, the original lease is released, and successor owner/scope/status/due time are unchanged. Reuse the exact original Turn and unchanged intent after an ambiguous response; replay is not a new lease.

Disable / rollback: Omit the new option to retain the existing prelinked/generated recovery. Missing, self, cross-Goal or mixed generated/existing links refuse before mutation. Unpromoted Markdown requires its existing migration path. Retirement is terminal: do not reset canonical state to undo it; create explicitly authorized corrective work if required.

Authority boundary: The operation grants no new scope, changes no successor requirements or monitor due time, closes no Goal and certifies no deliverable. Original writeback and one quota spend remain separate; Chat/Lark actions and the remaining frontend migration journey are unchanged.

Docs: Versioned guide

loopx --format json todo list --goal-id "$GOAL_ID"
  # Use the current lease key/version returned for the original Todo.
loopx --format json todo supersede --goal-id "$GOAL_ID" --agent-id "$AGENT_ID" --todo-id "$ORIGINAL_TODO_ID" --turn-instance-id "$TURN_INSTANCE_ID" --task-lease-idempotency-key "$TASK_LEASE_IDEMPOTENCY_KEY" --task-lease-expected-version "$TASK_LEASE_EXPECTED_VERSION" --successor-todo-id "$SUCCESSOR_TODO_ID" --reason "Continue through the existing authorized successor"
loopx --format json todo list --goal-id "$GOAL_ID"

Single-material ranked moves and receipt coverage

Activation: Opt in per SDK caller to plan_material_single_move and material_rerank_receipt_chunks. An explicitly activated project source may pass MaterialProjectScope instead of goal_id to existing inventory and intake/rollback builders; exactly one owner is required. Optionally install only the project-local loopx-material skill. Both synthetic previews below change no source; real effects require the original source adapter.

Validation: Run the previews to verify complete ranking, unchanged relative order, 100/67 receipt coverage and project-scoped metadata without a Goal. Read project-local skill status. Actual project intake/rollback requires provider.verify_project_scope to resolve current Core caller, audience, exact profile/store, workspace grant, gate expiry and revocation before access/publication, plus the source transaction fence. Returned metadata is not permission or an applied move.

Disable / rollback: Uninstall the project-local skill with the exact command below and stop invoking the helpers or passing project_scope. Restore a real store only through its verified backup, source adapter, owner gate and rollback contract. Skill removal does not roll back source data.

Authority boundary: References select existing scope and grant no write, private access, scoring change, cutover or automatic reranking. Project intake creates no Goal and borrows no steward authority. Migration, rebuild and Explore keep the Goal route; only existing SDK/provider intake is extended. This experimental slice adds no frontend/Lark/CLI writer, so the broader project-material journey remains partial.

Docs: Versioned guide

loopx project-skill install --project . --skill loopx-material --surface codex --execute
loopx project-skill status --project . --skill loopx-material --surface codex --format json
python - <<'PY_PREVIEW'
from loopx.capabilities.material_lifecycle import plan_material_single_move, material_rerank_receipt_chunks
refs = [f"material:{i}" for i in range(1, 172)]
order, limits = plan_material_single_move(refs, "material:171", 5, protected_material_refs=["material:1"])
assert order == refs[:4] + [refs[-1]] + refs[4:-1]
changed = [ref for rank, ref in enumerate(order, 1) if refs[rank-1] != ref]
chunks = material_rerank_receipt_chunks(changed)
assert [len(part) for part in chunks] == [100, 67]
assert [ref for part in chunks for ref in part] == changed
print("Preview only: 167 affected materials, complete receipt coverage; no source write")
PY_PREVIEW
python - <<'PY_SCOPE'
from loopx.capabilities.material_lifecycle import MaterialProjectScope, build_material_store_inventory
scope = MaterialProjectScope("preview-project", "preview-profile", "preview-grant")
packet = build_material_store_inventory(
    project_scope=scope, store_id="preview-store", store_revision="preview-r1",
    observed_at="2026-10-01T00:00:00Z", source_snapshot_ref="preview-snapshot",
    backup_ref="preview-backup", source_digest="sha256:" + "0" * 64,
    lifecycle_counts={}, stable_ids_verified=False, backup_verified=False,
)
assert "goal_id" not in packet and packet["project_scope"]["project_ref"] == "preview-project"
assert packet["item_count"] == 0
print("Metadata preview only; no Core grant verified or source written")
PY_SCOPE
loopx project-skill uninstall --project . --skill loopx-material --surface codex --execute

Effective-work-Turn review cadence

Activation: Opt in in Capability Center → Goal review cadence by choosing Settled work Turns and a count from 1–5, for the device default or selected Goal. The CLI below explicitly selects three settled work Turns; the legacy completed-Todo default remains unchanged.

Validation: Read configure-goal for the same Goal, then quota should-run for its Agent. The shared TypeScript owner counts distinct settled work Turns after the accepted review checkpoint; duplicate retry, poll, unspent writeback and missing settlement do not count.

Disable / rollback: Clear the effective-Turn Goal override with the command below to restore the current device default. Use the revision-checked device editor to choose completed Todos, or remove todo_replan_cadence to restore the legacy capability default. Preserve existing state and receipts.

Authority boundary: The threshold creates a review obligation; it grants no host scheduling, execution, quota, workspace access or external-write authority. Existing v0 configuration retains its completed-Todo meaning until an explicit editor apply migrates it. An accepted negative work result can count.

Docs: Versioned guide

loopx configure-goal --goal-id "$GOAL_ID" --execution-replan-after-turns 3
loopx configure-goal --goal-id "$GOAL_ID" --execution-replan-after-turns 3 --execute
loopx configure-goal --goal-id "$GOAL_ID"
loopx --format json quota should-run --goal-id "$GOAL_ID" --agent-id "$AGENT_ID"
loopx configure-goal --goal-id "$GOAL_ID" --clear-execution-replan-after-turns --execute

Qualification

Frozen candidate: 69bd8a812ea2c745bc0231815a3a3f322b0d1f35, tree 5434e17aae0601b10662ffe925cfcff9545ff859. Final full regression,515 public smokes and DS high portfolio are running against this clean source. Ruff's workflow-owned namespaces,mypy19 contracts,and real wheel1.2.4→1.3.0 upgrade/Chat/three host skill lifecycles pass. Related repairs preserve all assertions: physical budget fixture#5711,and MCP/finished-host fixtures#5713 (162 related tests,serial2/parallel2 and actual live-group negative). Older failed/aborted matrices and passing122 receipts remain historical; no receipt is relabeled. Publication requires all eight exact-source lanes,reviewed benchmark boundary,and published artifacts/personal guide readback.

Turn/diagnostic presentation ceilings are15,000/45,000 JSON characters after identical14,647/44,126 outputs exceeded14,600/44,000. Monitor retains2,000 and all settlement assertions with a physically stable fixture. These are not token/fee budgets or promotion criteria. No matched version outcome uplift is claimed.

中文摘要

升级决策

**谁需要升级：**需要持续 Codex 工作、证据驱动重规划或普通 workspace Chat 的用户，在正式发布后可考虑升级；当前满足需求的 v1.2.4 用户可等待候选验证完成。

**解决了什么：**早期有效结果被重复观察淹没、已知 replan 仍要求失败重入、任务步骤与权限／结算提示错位；本次集合这些有界修复，并改善 workspace 对话与配置恢复。

**是否有破坏性变更：**无主动 breaking migration。host-declared project Chat 新默认 workspace_write，需只读时显式选择 workspace_read，旧 App 只读 grant 保留。新生成结算命令自带位置正确的 JSON 参数，历史命令与直接 CLI 默认不变。managed 模型命名改为 deepseek-flash，明确旧配置保持优先。canonical 新 Goal 与 Explore 执行保持 opt-in，不迁移已有 Goal。

**如何验证：**正式升级后期望 loopx 1.3.0、健康安装及正确作用域状态。使用上方 loopx --version、loopx doctor、loopx --format json status 与 loopx diagnose --goal-id "$GOAL_ID"，遇到 unavailable/blocked 先恢复再工作。

贡献者：@Inference1、@Duang777及下方另外八位社区贡献者均对应 v1.2.4 到本次候选的实际交付代码，列出具体贡献与相关 PR。

产品分组

本版结合最新长程研究与 Astra 辅助工程，改善续接、证据重规划和原范围内恢复／结算。实验 worker 仍为 gpt-6.1-sol／xhigh，不宣称版本配对涨分。

语义控制： 显式按已结算工作Turn复核开放Todo，旧完成Todo默认保持；Task inspector显示当前阻塞原因。类型化工作／提示选择、可执行结算及持久恢复；生命周期元数据不再授权 Codex workspace-write 恢复。
**工作区与宿主：**普通 Scope Chat、配置备份恢复、opt-in 新 Goal 规范权威、受治理委派及原 Session 身份。
**证据与集成：**按需 Explore／GitHub 证据、DS profile 和 finance／DSH；Ego 为分阶段适配器，原生 Bot 尚未资格化。

社区贡献者

@Inference1 — 首次外部贡献者：四个文档版本 owner、单一 Lark visibility owner、五组共享字段词汇及 Agent 执行通道进展范围的统一词汇归属（#5597, #5621、#5684、#5654）。
@mikamikasuki — 首次外部贡献者：refresh 无写入 mutation 回归、精确 source-session 观察及已交付贡献／RFC 检查点退役（#5574, #5576, #5577, #5579, #5595, #5601, #5613）。
@jackie-cqz — 外部贡献者：原生 child 结果归属、公开 GitHub 证据、共享验证、Windows 路径／配置发布及 Chat 交付重试（#5455, #5459, #5526, #5602, #5603, #5606）。
@Duang777 — 外部贡献者：Goal 重建 fence、校验后的 inbox 读取提交与 Goal 级责任写回、桌面更新指针防回退与中断备份轮换恢复、已合并契约兼容性、有界 runtime／配置恢复、桌面过时更新响应 fence 和桌面回滚包原子替换（#5338, #5563, #5588, #5645, #5647, #5533, #5693, #5651）。
@hhyykk — 外部贡献者：单次 TS 请求的 checkpoint context（#5585）。
@catwithtudou — 外部贡献者：lease 仓库身份归一及诊断时间顺序（#5572, #5584）。
@songoow — 外部贡献者：受治理委派停止、原生 fixture 清理、精确目标 CI 恢复与 smoke 治理、按影响范围选择 CI 资格验证并约束后台 runner 需求（#5308, #5534, #5535, #5539, #5567, #5652）。
@BigDataDZ — 外部贡献者：Goal direction F2 revision-drift fixture（#5549）。
@maxliux5 — 外部贡献者：将个人 follow-through 文档归并到已有 manager profile（#5384）。
@AronSwan — 外部贡献者：会话输入失败及交付时 payload／transport 冲突的明确处理，保持 replay 身份（#5554）。

可选能力启用与使用

Explore Harness

启用： 在 Goal 设置 → 能力中心选择 evidence 或 planning；下方命令启用 planning，默认关闭。

验证： 读取同一 Goal/Agent 的 turn-context 与 summary；节点存在不等于已采用。

停用 / 回退： 执行 --explore-mode off --execute；保留既有证据。

权限边界： 分析与规划不授予 spawn、claim、扣额、合并或外发权限。

Conversation

loopx-agent commented Oct 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

LoopX 1.3.0 release preparation

Release Decision

Product groups

Community Contributors

Optional Capability Activation & Use

Explore Harness

TurnEnvelope and captured decisions

Ordinary workspace Chat

Owner private Lark conversations

Configuration checkpoints

Canonical new-Goal creation

Governed delegation stop

PR review queue ownership and direction

Public GitHub evidence

Managed DeepSeek model selection

Finance evidence assessment

EdgeBench native trials

DSH LoopX plug-in

Already bound steward inbox execution

Independent macOS service and Chat Codex homes

Rendered public-source MCP reader

Canonical retirement with an existing successor

Single-material ranked moves and receipt coverage

Effective-work-Turn review cadence

Qualification

中文摘要

升级决策

产品分组

社区贡献者

可选能力启用与使用

Explore Harness

TurnEnvelope and captured decisions

Ordinary workspace Chat

Owner private Lark conversations

Configuration checkpoints

Canonical new-Goal creation

Governed delegation stop

PR review queue ownership and direction

Public GitHub evidence

Managed DeepSeek model selection

Finance evidence assessment

EdgeBench native trials

DSH LoopX plug-in

Already bound steward inbox execution

Independent macOS service and Chat Codex homes

Rendered public-source MCP reader

Canonical retirement with an existing successor

Single-material ranked moves and receipt coverage

Effective-work-Turn review cadence

发布验证

Uh oh!

loopx-agent left a comment

Choose a reason for hiding this comment

动机

改动思路

具体改动

关键代码讲解

对主干的风险

语义与 CI 对齐

我的整体评价

Uh oh!

loopx-agent commented Oct 5, 2026

Uh oh!

Uh oh!

loopx-agent commented Oct 5, 2026

Release benchmark boundary review / 发布 benchmark 边界审查

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

loopx-agent commented Oct 5, 2026 •

edited

Loading