fix(control-plane): use canonical digest matcher

[mikamikasuki]

Goal And Delivered Outcome

• Outcome basis: The existing single-owner regression guard fails on current main for a duplicate matcher in action-review recovery. This is a self-contained fix; no issue is required for this ordinary repair.
• Goal/source and gap: Keep bare SHA-256 validation owned by loopx/control_plane/content_digest.ts. goalCreationProgress restated the 64-hex expression inline, outside the canonical owner.
• Observable before → after: At 48accc7e4e323bfc75fc8b09b5faa5cc8f502474, the focused owner test reports action_review_plan.ts:114 /^[a-f0-9]{64}$/ as an extra matcher. The recovery path now imports and uses BARE_SHA256_PATTERN; valid and invalid digest behavior remains unchanged. The regression-parity row records the failing-before/passing-after command.
• Issue/task and intended base: Self-contained current-main defect; base main at 48accc7e4e323bfc75fc8b09b5faa5cc8f502474. CONTRIBUTING.md#find-work makes an issue/roadmap/RFC anchor optional for this repair.

Author Declaration

• Written by: model_agent — OpenAI Codex (GPT-6 Luna).
• Some coding work was AI-assisted. I personally reviewed the changes, verified the relevant behavior and tests, and take responsibility for the submission.

Implemented against

• Specification and revision: No separate written specification; the canonical pattern in loopx/control_plane/content_digest.ts and the owner invariant in tests/control_plane_ts/content_digest_single_owner.test.ts, both at 48accc7e4e323bfc75fc8b09b5faa5cc8f502474, define the expected behavior.

Criterion	Disposition	Symbol / path	Test or command
Action-review recovery uses the canonical bare digest matcher	implemented	goalCreationProgress	tests/control_plane_ts/content_digest_single_owner.test.ts
Accepted/rejected workspace digest behavior is unchanged	implemented	goalCreationProgress	tests/control_plane_ts/action_review_plan.test.ts

• Self-check before submission: Reproduced the owner-test failure on exact current main, reran it on the patched tree, searched issues and PRs, and reviewed the two-file diff. Existing PR feat(zcode): add host diagnostics and managed native Goal control #5752 adds different ZCode consumers and does not change this action-review matcher.

Scope And Continuation

• Completed scope and remaining work: The action-review recovery path now consumes the canonical digest pattern; no behavior or digest format changes.
• Slice boundary / successor: Complete within this scope.

Validation

• Tested revision: 9121a1564a6cbab5b5ceb43bea11000d424aa72d (tree identical to the tested patch); base 48accc7e4e323bfc75fc8b09b5faa5cc8f502474.
• Run state: finished
• Input classes: synthetic

Check kind	Result	Public-safe evidence / limitation
regression_parity	passed	On exact base, the focused command failed with the duplicate matcher at action_review_plan.ts:114; on this tree, the same command passed all 32 tests.
unit	passed	npm run test:control-plane: 4,243 passed, 0 failed, 32 skipped.
static	passed	npm run typecheck:control-plane and git diff --check passed.

• Coverage and gaps: The changed recovery predicate and canonical-consumer inventory are covered by their focused tests and the complete control-plane suite. No untested behavior change was identified.

Frontend / Visual Evidence

• UI impact: none
• Before: N/A
• After: N/A
• States and viewports shown: N/A
• Source data: none
• Attention review: N/A

Type of Change

• Bug fix
• New feature
• Breaking change
• Refactoring (no functional changes)
• Documentation update
• Test update

LoopX Area

• Control plane (goals, todos, quota, scheduler, registry, runtime)
• Benchmark boundary (adapters, runners, verifiers, scoring, evidence)
• Capability or extension (providers, adapters, skills)
• Public docs or presentation surface (README, protocols, dashboard)
• Build, packaging, installer, or CI
• Host or runtime integration

Technical Direction

• Direction / acceptance reference, when applicable: N/A; this is a focused canonical digest ownership repair.

Shared-authority RFC fixture impact

• Production-scale fixture schema: N/A
• Semantic dimensions changed, or reviewed no-impact rationale: N/A; no authority schema or semantics changed.
• Provider conformance arms run: N/A
• Read-only legacy/file/PostgreSQL three-arm rehearsal: N/A

Boundary Checklist

• No private state, credentials, raw traces or local paths are included.
• No maintainer-owned benchmark work is duplicated.
• The change stays scoped to the reproduced defect.
• UI impact is marked none.
• Both commits include DCO Signed-off-by trailers.

[loopx-agent]

Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; reasoning_effort=xhigh.
Exact head: 9121a15; frozen base: 48accc7. CI was not consulted.

动机

维护者修改 digest 格式或排查中断后的 Goal 创建恢复时，需要确认所有调用方遵循同一规则。
创建 Goal 中途失败后，系统依据已记录的工作区摘要恢复原操作；旧代码另外维护一份相同正则，新代码直接读取共同规则，合法与非法恢复判断保持一致。
已验证重复匹配器被移除，合法与非法输入经真实 Python→TypeScript 进程得到与基础版本完全相同的恢复计划。
不改变用户创建步骤、默认 provider、绑定、Todo/Turn 效果、权限、恢复 identity 或任何持久化格式。

改动思路

用既有 TypeScript content_digest owner 替代等价的本地正则，归属清楚；消费者清单只登记这一个真实调用点，不增加配置、状态或 Python 决策副本。
本 PR 只收敛 Goal 创建恢复计划中的 digest 格式判断；既有状态、权限、原操作 identity 和后续效果验证继续由原 owner 负责。它不重做创建流程或宣称完成整个迁移路线。

已有 proposal/checkpoint 进入同一个 typed reducer，先检查 digest 和已提交步骤 identity，再给现有 UI/API 恢复原操作的计划。server 继续独立核验 workspace、fingerprint 和权限。此计划只描述已记录进展，不证明 Goal 完成或授予写入权。相邻 Lark operation/team-plan 分支未改。

具体改动

两文件 +3/-1，没有新模块或协议：action_review_plan.ts 引入 canonical bare digest；single-owner 测试把这个真实 consumer 纳入既有清单。

• content_digest.ts:3，BARE_SHA256_PATTERN（未改）：^[0-9a-f]{64}$，无 flags；与旧 [a-f0-9] 同一字符集合，重复调用没有 g/y 状态。
• action_review_plan.ts:108，goalCreationProgress：action 必须为 goal.create，workspace outcome 与 goal identity 合法且 digest 合法；随后继续验证 goal/agent/Todo/session/first Turn 的原有关系。textValue 保留非空原字符串，并不自动 trim 摘要。
• action_review_plan.ts:492，compileActionReviewPlan（未改）：failed/applying + 原 proposal/fingerprint/权限满足既有条件且进展合法，才返回 retryOriginal；非法步骤不给 creationProgress。已 applied/gated/stale 的既有 precedence 不变。
• single-owner test:125：只增加一个 consumer pin；原全树规则仍会识别重复 literal/constructor matcher，不缩小扫描。

依据 冻结基线的 single-owner guard 和 accepted TS migration direction：一处 bare/enveloped grammar owner、原操作恢复、无平行语义实现。三项均满足；不因内部重用要求新 UI 或完整父路线迁移。

规范映射：tests/control_plane_ts/content_digest_single_owner.test.ts；revision 48accc7。 one canonical matcher：No second whole-value bare digest matcher outside documented exceptions. disposition=implemented。 original Goal creation recovery：Checkpoint identities stay aligned; recover original operation without certifying Goal completion. disposition=implemented。 typed owner reuse：No parallel semantic implementation; adapter IO may remain Python. disposition=implemented。

对主干的风险

无阻断 finding。最强反例是共享 regex 有 g/y flag 或 grammar 变化，导致合法值反复调用不同或非法 checkpoint 出现恢复入口；源码确认 owner 无 flags，独立真实 Python→Node effect-runtime 29 项对照完整 output（身份、reason、canApply、progress、retryOriginal）均相同。包括 failed/applying、uppercase、前缀、63/65 长度、非 hex、空/非字符串/前导空格，以及错 goal/agent/session identity。有效 fixture 保留已创建 Todo/session；未操作任何 active Goal。

同一 focused 命令基线 31 pass/1 fail，失败精确指向 action_review_plan.ts:114 的重复 matcher；head 32 pass，guard 本身没有删改断言。TypeScript typecheck、8 个现有 Goal 创建 API 测试、diff hygiene、语义 advisory/全树 smoke 通过；零 vocabulary 候选只作为 advisory。作者声称的全套 4243 项未作为本次独立证据，CI 未查询/轮询/等待。

Reviewer 首次独立夹具误把前导空格当作自动 trim，B/H 均按原规则拒绝；已更正 oracle 后完整重跑并保留初始失败，不归因 PR。最强未执行覆盖是 packaged viewport、live Lark 和真实 active-store resume；本改动只有相同纯 matcher 重用，现有前端 creationProgress/retry consumer 与 server 后续 authority/source 路径已检查未受改动，不把这些未测项当已完成效果，也不为该维护修复新增门槛。

我的整体评价

goal_achieved 仅指这个已证实重复 owner 的有界修复；long_horizon/user_experience preserved，observable_semantics equivalent。未来重构检查已通过删除重复规则落实，无须额外 abstraction 或仪式性后续任务。范围相称、可独立回退，无持久化迁移/默认改变/新授权。APPROVE；代码资格与平台 aggregate/merge 授权仍分别核验，本评审不执行合并或本机安装。

English verdict: APPROVE — head 9121a15. Canonical matcher reuse preserves complete recovery outputs across 29 real Python→Node cases, fixes the existing single-owner guard, and passes focused tests/typecheck. CI was not consulted. No blocking finding; no merge/live-effect claim.