[loopx-agent]

Problem and resulting behavior

Quota, native Turn and heartbeat callers composed overlapping executable inputs. This C1 candidate composes one complete source through the existing TypeScript owner before capture, validates its source/effect identity and carries the original obligations to the final host input. Historical journals keep their recorded decoder, bytes, Turn key and once-only settlement.

The preceding runtime increment removes native-child observation metadata’s dependency on the compatibility envelope. Request construction, durable Host attempts and both Codex transports read the original complete interaction context when supplied; historical requests keep their old decoder. This is source convergence: the existing verifier already rejects inconsistent projections, and no prior wrong-child admission or packet-cost improvement is claimed. The preceding DSH increment fixes adaptive tool/session bindings through the same checked selected-work owner.

The preceding runtime increment removes one redundant cross-process version check during complete-contract planning. The existing typed driver_lineage owner still checks version, source integrity, projection and work identity. The same fixed File/SQLite inputs use one fewer RPC and smaller argument/result JSON, with byte-identical final plans, Host requests, prompts and schemas. Historical inputs retain their original version diagnostics. The earlier profile-alias increment retains explicit off/native on and once-only admission/no-spend qualification.

The earlier Host-transfer repair retains supplied non-object work_contract values at request construction and original-capture publication. They now reach the existing TypeScript refusal owner instead of being interpreted as historical absence. Genuine historical omission remains compatible. This adds no validator, field, default or RPC. The ordinary executor's earlier source checks still apply; the evidence does not establish an outer settlement bypass.

Managed Session validation now uses the same complete-source owner. Preparation reuses dispatch's invocation-local checked work identity. After model work, the callback checks the current complete source before running its original independent argv; supplied invalid input cannot become historical absence. Canonical declaration checks before/after argv, actor admission, lease and once-only settlement retain their owners. This adds a post-model complete-source RPC, whose measured component cost is disclosed below.

Current tested product snapshot: a49625e3a7a3f6d87cc4f8dcba3ed556651d521f, with test-only provider isolation aa5da00a41060c4afd670915ba7b16e8d426a45d and the ordinary-fixture correction dd00992dd; final head e3d6283a9fad6e79a5afcd7c45dcac8ee358ad59 adds only the paired ledger. Current managed-validation matrix: eight passed, including actual native File/SQLite Session validation, refusal before argv/state/quota and no model replay on operation reentry. Current expanded shared-route qualification: 384 distinct passing cases across two integrated invocations (68 + 316), with no failures/skips/errors; earlier interrupted validation remains separately pinned. Earlier 18-case Host-transfer, eight-input transport parity and 528-case source qualification remain pinned to their preceding snapshots below. Latest target-main 8a9e116283df2796926ea153241f48c9c8fc3dbb is integrated in 4502a2f25e5410756119dcf3af85a95bf75ece70; 4cdf977c3aa2948bb4cc3ea149bcfd35f399e532 adapts its new explicit fixture caller. Installed-host adoption, complete cost and model/scientific benefit remain separate qualifications.

Draft reflects unfinished author work: the five complete-output budget holds, remaining complete-delivery gaps, supported-reader exit and original-quota single-session acceptance/full-cost comparison remain open. Pending review, CI or a quality receipt is not the reason for Draft.

Shared owners and actual consumers

• Quota and native Turn share complete composition, numeric identity/edit, source integrity and reference owners before capture. Unknown optional facts remain; unsupported executable semantics reject before dispatch. Original admission, capability, context-delivery and settlement owners retain their authority.

• Default turn plan remains inspection-only. Explicit transaction detail and execution retain the complete source; adding transaction fields cannot turn source-less inspection into executable work.

• Native Codex and structured-host final inputs preserve the complete source and original material readers. Same-capture recovery retains source refusal, selection/reentry and the original Turn's single writeback/debit. Heartbeat routing, safety and complete work guidance share their existing rule owner; historical saved bodies are unchanged.

• Ark/MemT tool identity uses extensions.turn_host.extract_turn_work_identity. Complete input follows the selected-work owner; historical provider input retains raw declared values and strict string/NUL checks. MemT's candidate validator retains the whole original request, including its complete-source fence. Actual CLI input still has no admitted exact MemT lifetime; tests do not invent one.

• Bundled DSH reuses the identity already returned by that dispatch owner within the same invocation. It adds no RPC or cross-attempt cache. Its two old identity walks become one historical raw-value adapter. Fresh-iteration and Goal-instance hashes are preserved; complete adaptive bindings intentionally use the selected primary Todo. The retained private metadata is excluded from final model input.

• Native-child observation metadata uses the original complete interaction context, with the existing local positive-integer decoder and zero additional RPCs. Complete-source verification, launch fences, receipt admission, feature-off isolation and historical raw input are preserved. No protocol field or second authority is added.

This reuses existing CLI/Chat Host entrypoints and adds no capability, setting or user step. Steward and other historical consumers, native-child receipt/journal compatibility, executor v0 transport, optional product journeys and packaged/installed qualification remain open. Historical decoders retire only after their original-version recovery windows reconcile; saved receipts and sources are never rewritten as new-version work.

Earlier matched DSH checkpoint

Frozen ae8ee460a and the candidate consume the same four complete requests from real File/SQLite CLI plans through the actual DSH adapter. The provider is synthetic. Each uses one dispatch RPC; canonical argument/result JSON bytes are unchanged.

Source	Ordinary prompt bytes	Adaptive prompt bytes	Internal authority JSON growth
File	32,377	32,517	114 / 115 B
SQLite	32,425	32,565	114 / 115 B

All four prompts are digest-identical before/after. Ordinary session/tool identities are unchanged; adaptive bindings correct the old Todo mismatch. The last column is a Python-object JSON size proxy, not allocations or wire traffic. The probe changes no work state and spends nothing. This is a caller-correctness result, with no claim of packet compression, latency, model-token, invoice or matched-outcome/full-cost benefit.

Prior costs remain in the bilingual source-convergence ledger: the Ark identity path removed a full-source copy but added 113 canonical result bytes; Markdown removed display padding while still exceeding its original size hold. These are separate checkpoints, not cumulative net savings.

Matched native-child metadata observation

Eight fixed on/off requests extend the same real File/SQLite normal/adaptive CLI fixtures, with synthetic capability context recomposed through the existing owner. Frozen integration 5d9dbb811 and the candidate produce identical metadata, request bytes (40,202–40,778), prompt bytes (30,744–31,030), schema hashes and canonical argument/result sizes. Metadata uses zero RPCs and complete-input preparation one RPC on both sides. This qualifies removal of an obsolete field-layout dependency; latency, allocations, wire framing, model billing and complete Host costs were not measured.

Validation and remaining failures

Check	Result and scope
Current managed postcondition matrix	8 passed, 20.911 s, no skips/errors. Two frozen bd2ea9c58 invocations cover four missing-refusal failures and four valid/historical controls. Source faults occur at the actual callback before independent argv; the native Session, canonical Task and settlement remain real. Six earlier ambient-provider startup failures are preserved, with fixture-only isolation and its one manual caller corrected.
Current integrated shared routes	68 + 316 passed across two invocations on 4cdf977c3 (335.058 / 644.420 s), 384 distinct cases across four complete modules, no failures/skips/errors; conversation-binding TypeScript owner: 45 passed / 0 failed / 0 skipped, 350.35 ms.
Pre-integration expanded native routes	At 9baa678db, five complete native/steward/calendar modules pass 359. The sixth private-conversation module was interrupted after 56 passed / 37 startup failures, 1,890.295 s for the overall incomplete run. All 37 report the provider startup rejection; two same-source environment-unset controls pass (3.064 s), then the exact two cases pass with only the neutral ordinary fixture isolated (4.402 s), keeping the original environment. The fixture change does not relax the production provider check. The nameless interrupt JUnit record is not a passing test, and this is not a full six-module pass.
Same-source native component observation	Two File/SQLite original-Session fixture cases pass, 14.070 s. Frozen Git methods are substituted with identical plan source hashes, dependencies and original argv. The additional baseline argv is read-only fixture validation; this is not a complete baseline-repository or installed-host run.
Previous Host-transfer refusal matrix	18 passed, 1.40 s. Corrected frozen 42b842f93: 10 missing-refusal failures / 8 passing controls. Both transfers, absent/valid/null/false/zero/list/text/empty-object/invalid-integrity cases, native and shared-reader refusal, no DSH runner load. Two initially unfulfilled-Goal controls were correctly rejected and retained before fixing only their complete-source fixture.
Previous Host-transfer source qualification	Initial six-module run: 522 passed / 6 failed, 298.49 s, no skips/errors. Frozen 42b842f93 reproduces all six pre-dispatch Host-context failures. Independent child import shows a different installed Core from the Goal cwd. Test-only source binding/readback plus explicit delivery-off fixes the historical direct-body control: 8 passed, 13.17 s in that complete module. Other five modules' 520 passes remain valid on unchanged product bytes. Original failures retained; no installed Core or user configuration changed.
Earlier 5a759b complete-plan cohort	334 passed / 0 failed / 0 skipped / 0 errors, 202.77 s. Includes actual File/SQLite delivery, failed-attempt recovery, validation and original-Turn settlement/replay. New six-case RPC/refusal matrix: 6 passed, 1.01 s; its frozen-source characterization retained five duplicate-call failures and one passing historical control.
Earlier native-child / Codex CLI / complete-source cohort	197 passed, 149.37 s. Includes real subprocess on/off observation/readback and corrupted-source refusal before another launch or receipt, plus real File/SQLite complete input and recovery. New tests first fail on legacy field access; the first wider run’s two incomplete-Goal fixture rejections are retained. The fixture now delivers its actual file/full revision; the product gate is unchanged.
Earlier 0cd native context / Turn driver	257 passed / 0 failed / 0 skipped / 0 errors, 116.07 s. Same two complete modules passed 257 in 118.43 s before the non-overlapping target-main chat integration; focused alias × off/on matrix: 4 passed, 2.42 s. Before fixture repair: 253 passed / 2 failed, 113.61 s; original failures retained.
Earlier owned operation Host	34 passed / 2 skipped, 24.16 s; the skipped cases require explicit live-model release qualification. No live model was called.
Earlier DSH regressions before repair	4 adaptive failures / 7 passing controls at the frozen implementation.
Earlier DSH and complete-source suites	367 passed, 67.66 s; fresh/reuse, adaptive work, raw historical values and invalid-source/version refusal before provider calls.
Earlier real File/SQLite CLI cases	2 passed, 4.41 s; built-in DSH, complete final input, independent validator, committed writeback and replay with one runner call and one debit.
Earlier optional Ark/MemT suites	44 / 65 passed, 17.60 / 52.00 s, with current Core source and isolated SDK/protocol fixtures. MemT's missing-client collection and five CLI import failures are retained: child imports independently exposed an older installed Core; binding only the test child's Python source path corrected them. No product/user configuration changed.
Earlier d104 quick premerge	6 direct checks and 4 selected checks passed; gate remains quality_stale_receipt (exit 1), with no exact-scope passing quality receipt or merge-readiness claim
Current diff, bilingual and public scans	Passed; both RFC mirrors changed together. The two runtime paths' diff-scoped advisory at the pre-integration snapshot found no supported new carriers; unsupported/dynamic forms are not certified. All new author/integration commits carry DCO sign-off. Earlier lint evidence remains pinned to its own snapshot.

The frozen 46bdaddb3 record retains six context-delivery and two driver-profile failures. At d1046499a, the two complete current modules instead produce 253 passes and two profile-alias failures. Actual responses reject native capture without a Turn identity before the tests access scheduler_hint; no scheduler-policy failure is inferred. The fixture now supplies its original Turn and exercises explicit off/native on for both aliases. Native cases follow only the generated original-capture context-read commands through contiguous UTF-8 pages, retaining the original scheduler assertions and verifying one admission, no spend, and unchanged Goal/event-log bytes after recovery. The two complete modules pass 257 cases with no skips or errors, including again on 0cd09b46c (116.07 s). The six older failures retain their original provenance; this recheck does not reassign their individual causes. Earlier 122-case TypeScript and ten-case steward results remain historical, with their environment failures and corrections in the ledger.

The five output holds also remain: small complete Markdown 24,531>10,000, crowded plans 24,044/27,508>22,500, complete alias 24,252>13,000, and the separate public multi-agent alias probe 25,933>13,000. No fixture population, requirement, route, capability, absolute/line/growth limit or historical failure was removed or relaxed.

There was no external model/solver/judge/paid scientific launch, CI status query/manual trigger, live installation, release, default promotion or merge. PostgreSQL and installed-host/model acceptance are not qualified by these source checks.

The 197-test cohort and 34-pass/2-live-opt-in-skip Host cohort were measured at e06e1a5c4f359a0b87e8009afaaf57b0e02f3767. The subsequent target-main integration changes six non-overlapping chat paths; both new complete-host feature-on/off subprocess cases passed again on d1046499ac8752eb2d944650fc29690d38c1b2eb (2 passed, 1.29 s). That earlier d104 integrated head also passed its recorded execution checks; no current passing quality receipt or merge-readiness is claimed.

Matched required-read traffic checkpoint

Frozen target-main c334bbaf196505778149ae4edeefaa013d343259 and C1 d1046499ac8752eb2d944650fc29690d38c1b2eb use identical fixture/command-producer AST and sequentially recreated identical physical fixture paths. The actual source module is verified in each checkout. After each JSON command, execute its declared pending Goal read, unless the original full Goal is already inline. Values below include final stdout newlines; all five rows deliver the complete fixture Goal text and selected Task text.

Public synthetic caller	Main initial + required-read stdout B	C1 initial + required-read stdout B	Difference	Required reads, main → C1
Small ordinary quota JSON	23,619	24,578	+959 / +4.06%	1 → 1
Small compatibility alias JSON	9,446	24,578	+15,132 / +160.19%	1 → 1
Small plan JSON	10,886	11,330	+444 / +4.08%	1 → 0
Crowded plan JSON	23,518	24,044	+526 / +2.24%	1 → 0
Crowded plan with Vision	26,981	27,508	+527 / +1.95%	1 → 0

Crowded C1 plans include the unmarked original Goal/Todo text: the 8,026-byte read is inline, explaining most initial-output growth. That content remains required. The current ordinary-quota comparison retains a positive 959-byte cost; these results establish no traffic saving. Legacy alias and complete input carry different information, so its large increase is not an outcome-matched efficiency comparison. The additional 18-Todo/3-Agent/12-run alias matrix gives 9,603 → 29,571 initial bytes; both sides lack the full Goal on that axis, and it is separate from the historical 25,933-byte probe.

This measures actual emitted body/declared-read stdout for local fixtures. It excludes tool framing, bridge/latency, tokens/cache, model comprehension/decisions, accepted outcomes and human attention; full single-session cost/benefit remains unqualified. Original limits, fixture population and historical failures are unchanged. No product source changed in this measurement checkpoint. The prior native-child metadata and DSH source-convergence results keep their original qualification scopes.

Matched planning validation transport

Eight frozen inputs from actual isolated File/SQLite CLI plans cover complete/historical sources and fresh/resume policies. Against C1 predecessor 0cd09b46c, complete planning drops from two RPCs to one because the typed lineage operation already performs the same version gate. The measured plan → Host request → prompt/schema preparation sequence drops from three to two RPCs.

Complete source, each fresh/resume case	Argument + result JSON before B	After B	Saved B	Saved relative to this sequence
File	92,598	81,554	11,044	11.93%
SQLite	92,838	81,752	11,086	11.94%

All eight final plan/request/prompt/schema files are byte-identical before/after; historical controls retain three RPCs and identical traffic. All four complete model inputs preserve their whole contract and original fixture Goal. Source files stay unchanged, probes spend nothing and no model is called. CSV, SQLite integer totals and Decimal ratios agree.

These are canonical RPC argument/result JSON sizes for this component sequence, excluding RPC framing, prior CLI collection/composition, latency, allocation, actual model usage, downstream work and settlement. Final model input is unchanged. This is a measured removal of one redundant transport/validation call, with no cache, new protocol, setting or authority; it does not establish the original-quota comparison, overall net saving or long-horizon benefit. It cannot be added to packet or selective-read percentages with different denominators. Unsupported versions, corrupt source, a self-consistently rehashed substituted adapter and null complete input still refuse through the existing typed owner.

Matched managed Session validation observation

Only quota.turn_envelope.evaluate calls are counted here. Preparation retains zero such calls by reusing the dispatch identity. At the post-model boundary the complete-source reader adds one, with 42,911 / 42,959 B canonical argument-plus-result JSON for File/SQLite in the same-source native-fixture comparison. These component observations are pinned to the pre-integration source and are not a new integrated full-cost rerun. The separate eight fixed CLI-source cases add 36,320 / 36,404 B for complete inputs and no such call for historical inputs. These populations are separate and are not added together.

This measured component cost increase supports source refusal; it is not compression. Framing, latency, allocation, canonical Task/admission reads, independent argv, model usage, recovery and accepted outcomes are excluded. Zero counted calls never means zero total cost. No whole-net-benefit value, including zero, is inferred from these observations.

Remaining C1 acceptance

Repair the measured output/delivery gaps through their owners, migrate the remaining actual consumers and qualify refusal/recovery/rollback before final writer cutover. Compare necessary semantics, actual decisions, accepted outcomes and complete costs on the same single-session path against original quota; evaluate two-session operation separately. The controller/executor RFC remains open. This reversible consumer increment does not certify complete C1 delivery or long-horizon benefit.

Bounded refactoring: complete planning reuses the version gate already inside its typed lineage operation. The current managed Session increment replaces two complete-input compatibility-envelope selections with the same complete owner: preparation reuses only invocation-local metadata, while the post-model boundary checks its source again. Historical decoding and standalone diagnostics remain; there is no new runtime helper, vocabulary, parallel parser or cross-call cache. The prior profile fixture keeps its shared local CLI invocation path. Original Goal content, negative cases, output limits and all five budget holds are retained. Earlier CLI/driver qualification retains its own snapshot. Current author validation covers four complete native/ordinary/private/Antigravity modules across two integrated runs, 45 shared TypeScript cases, staged/committed bilingual checks, diff checks and public-boundary scans. This remains an unfinished C1 proposal, with no current merge-readiness or installed-host/full-cost qualification.

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @loopx-agent.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @loopx-agent.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @loopx-agent.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @loopx-agent.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @loopx-agent.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork