[loopx-agent]

Quota admission and native Turn delivered the same decision through different layouts. This C1 proposal composes one complete contract before capture, preserving original requirements, evidence and settlement identity. New Host requests consume that checked source through the existing typed owner. Codex CLI and the operation-equipped app-server now prepare prompt and result schema with one source check per launch instead of two; the internal reply returns resolved metadata without echoing the complete source.

Author work remains unfinished. This integration stays Draft for remaining consumers, historical-reader retirement, packaged adoption and the original-quota comparison of actual decisions, accepted outcomes and complete costs. The local Codex preparation improvement does not establish overall benefit.

Behavior and ownership

Boundary	Shared owner and behavior
Complete input	Existing quota/turn_envelope.ts composition serves quota and Turn before capture. Acceptance, authoring, Explore guidance, Task title and vision references share typed owners; duplicate Python matching algorithms are removed.
CLI execution	One existing task-source boundary supplies selection, the original task commitment, admitted action and replan/writeback conditions. Adaptive and ordinary selection share the interaction owner. No per-field RPC or cross-attempt cache.
Host preparation	The typed owner checks complete source, version and Goal/Agent/work binding, then returns action, admitted-replan, resolved-approval and profile-applicability facts. Both actual Codex launch adapters share that check for prompt/schema construction. Python renders the original complete model input, without rebuilding authority from the old effect layout or constructing an unused historical prompt.
Results and recovery	Standalone prompt/schema consumers still validate independently. Structured candidate conversion checks its source again after execution and retains detached authority values. Supplied null or altered contracts reject; only omitted historical contracts use the old decoder. Original launch guards, evidence-content validation, accepted receipts, capture identity, numeric/hash codecs and once-only outer settlement retain their owners.
Native context	Outcome scope and full/delta encoding share one typed request. IO publishes current original recovery first and commits the required artifact before exposing a result. Full views page the existing immutable capture; deltas retain their encoded wire.

The scoped presentation remains opt-in: current-Agent and relevant outcomes expand while global intent, checks, permissions, stops and pending reads remain. Other independent outcomes retain current-state indexes and exact original-source references. Goal/Agent/Todo, provider/outcome revision and whole-source digest must match. Unknown relevance/fields/guidance, unresolved acceptance reads and broad replans widen to full; newly required bodies reach the delta as text. Canonical requirements are never filtered. These source/coverage checks do not establish semantic independence, model retention or C2 adoption.

Independent proposals and rollback

• #7517: intelligent-controller design, distinct from deterministic composition/codecs.
• #7520: main-usable route owner/caller convergence and actual TS producer registration.
• #7457: exact-reference owner and recovery guidance with existing schemas.
• #7468: authority rejection/migration diagnostics, without migrating state or granting authority.
• #7464 is merged as e9ef554ea; its duplicate patch is absent.

This branch is genuinely rebased onto target f31e06885ac5033d81810280cb99689f811807e7, its verified merge base. Current head: 72b88ccf14014cb8c409eae30f81e9fb03f36602. All 96 changed files retain identical bytes after this last rebase; the target added only an unrelated browser-test scroll precondition. The open prerequisites still overlap this integration; remove overlap after actual main adoption and validate the resulting combination. The Host replacement requires C1's complete source, so it remains here. Revert cohesive owner/caller changes together and reconcile original outstanding receipts before changing new admission.

Validation

Evidence	Current result and boundary
Actual Host adapters and launch guards	201 passed / 2 skipped across the four affected Host/capture/Codex/operation modules (160.03 s). Actual CLI processes and app-server protocol clients, real File/SQLite state, fresh-attempt checks, altered-source refusal, Stop/Goal replacement/stale mirrors, backpressure and large Unicode input. Executables and model responses are synthetic. The two live-model release-qualification cases remain skipped.
Native report backend	21 passed selected replan cases (213.96 s), including current monitor-refusal recovery. Synthetic model; no live research run.
Typed owner	51 passed, control-plane typecheck passed. Profile applicability includes omitted/null/empty/non-object/nonempty values. Existing capability-before-replan ordering remains.
Regression sensitivity	All four File/SQLite × CLI/app-server launch cases fail on immutable predecessor 75bd69bf6 at the repeated-check assertion, then pass on the candidate. Each of two fresh attempts checks again; invalid source rejects before a new native effect. Detached structured authority is independently checked.
Output parity	Frozen CLI-produced requests retain identical complete prompt/schema/result, historical output and invalid-source diagnostics. The existing app-server client's whitespace folding remains unchanged.
Exact final checks	Standard premerge: 6 direct + 19 selected checks, zero failures and zero manual holds. Committed-head bilingual check, Ruff, documentation governance and diff-scoped semantic advisory pass. The advisory is not exhaustive semantic analysis.

Runtime/test files are unchanged from the validated 54903bc21; the final commit only narrows documentation wording. The exact final committed-head premerge and bilingual checks were rerun. This increment changes four runtime paths, four durable test paths and the paired RFC/protocol documentation; no new caller-facing capability, setting or UI journey is introduced.

Historical failures remain preserved: the first launch-suite run had 15 tests still injecting faults at the retired _prompt seam; those hooks now target the joint preparation boundary with their original assertions intact. The earlier 589-pass/12-failure report run used a synthetic model that only parsed the retired prompt marker; the corrected reader and its predecessor counterexample retain their own evidence. Initial ineffective observation/whitespace probes, raw-approval failures and old launcher setup failures are retained rather than counted as passes. The earlier full TS result (5,617 pass/75 skip) belongs to d9709501d, not this final head. Full remote CI, real PostgreSQL, installed App adoption and native SDK/model delivery are not newly qualified.

Matched local cost

Compared with rebased predecessor 75bd69bf6312e50041ab2f34066c6baec28ef76c on the same target: six sequential interleaved cohorts, 93 warm samples per arm/case, identical frozen requests and full output parity.

Request provenance / Host	Predecessor median / p95 ms	Candidate median / p95 ms	RPCs
File / Codex	22.147 / 26.204	12.003 / 13.653	2 → 1
File / structured	22.269 / 26.310	23.124 / 27.843	2 → 2
SQLite / Codex	21.656 / 26.511	11.734 / 17.183	2 → 1
SQLite / structured	21.324 / 23.608	23.716 / 26.079	2 → 2

Codex local preparation medians are about 46% lower. Both structured timings remain negative observations, despite lower transport volume. Codex internal JSON request bytes are 86,293/86,399 → 43,144/43,197 (File/SQLite), responses 62,554/62,606 → 211. Structured requests decrease by five bytes and responses become 422 bytes; its post-execution source check stays independent. Framing is excluded.

The workload covers prompt/schema construction or structured prompt plus candidate conversion. File/SQLite labels indicate request provenance; samples perform no authority-store IO or real model work. Separate owned runtimes and sequential arms avoid this Agent's validation overlap; machine/background load remains uncontrolled. An owned baseline V8 profile identifies hashing/key ordering as substantial TS CPU work, without measuring Python/transport/provider cost or proving elapsed savings. Startup, other calls, full CLI/Turn, model/cache tokens, billing, implementation/human cost and accepted outcomes are outside this measurement.

Earlier negative observations remain in the paired RFC: the preceding Host-consumption change had four negative warm timing comparisons; execution-read cost also regressed while response size grew 77 → 1,693 B. Original-quota cold JSON growth of 4.18–6.44%, small-source overhead of 1,655 B, unchanged warm-artifact bytes and mixed recovery/detail tails remain open. This improvement does not cancel them or qualify original-quota net benefit.

Remaining author work

• Finish remaining effect/session/material consumers and historical-reader exits, retaining accepted receipts and exact source identity.
• Qualify packaged App and remaining host/SDK/benchmark consumers. MemT's executable exact-lifetime producer gap holds only its dependent path.
• Compare original-quota single-session actual inputs, decisions, accepted outcomes and complete costs; evaluate intelligent two-session mediation separately. Warm-artifact/short-source overhead and unknown costs remain open.
• Adopt prerequisites through normal review, remove overlap and qualify the resulting target combination. C1 stays open; scoped outcome delivery and transport checks do not close its broader acceptance.

The bilingual controller RFC and Turn protocol describe this input lifecycle and its limits. No merge, installation, release, new paid-model/benchmark run or manual CI dispatch was performed.

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @loopx-agent.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @loopx-agent.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @loopx-agent.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork