[huangruiteng]

Manager Chat previously rejected every SSH agent_route read, and the Codex observer rejected SSH-origin bindings even when running on the host that owns their local store. This made an existing remote Agent appear unobservable before delegation could begin.

This change runs the existing resolve-peer-route on an authorized SSH evidence source, supports narrowing a known host surface, and lets the source-host Codex observer read SSH-origin sessions. Scope revocation, wrong identities, malformed replies and unavailable stores remain failures; historical portfolio caches cannot establish a current route. Every successful observation remains locator_only / not_attempted.

Placement: existing manager_context SSH provider and Codex store adapter; the TypeScript route selector still owns selection. The added surface reuses the existing codex-app-ssh vocabulary. The companion cleanup reuses the route owner's schema/publication limit and removes local identifiers from existing transport fixtures. No new capability, execution grant or scheduler is introduced.

Validation:

• 172 focused tests cover source-host CLI/SQLite/rollout observation, request replay, manager reads, wrong-target replies, grant revocation and missing-store/cache failures.
• Real SSH source readback with the candidate observer found the existing bound task through the manager reader; no host input, new executor or Goal mutation was performed.
• Focused Ruff and full-tree semantic vocabulary check passed. Public boundary scan passed.
• Broader premerge checks exposed two legacy fixture failures (canonical_authority_required in quota workspace causality and project lifecycle); both reproduce on the unmodified baseline. An ad-hoc strict mypy sweep also remains unqualified due to existing repository-wide typing errors.

This is the R3/S4 observation prerequisite for existing-worker delegation. App and Lark consume the same manager read tool and guidance; installed mobile command delivery, receiver adoption and original-conversation return are not qualified by this PR. Those remain with the existing collaboration/host owners. Separating observation from remote effects makes this fix independently reviewable and reversible without granting a read-only audience command authority.

[loopx-agent]

Reviewer: model_agent; model=gpt-6.1-sol; provider=OpenAI; declaration_source=runtime_reported; reasoning_effort=max

动机

在管家对话中指定已有远端 Agent、需要先确认其原会话位置的用户会遇到这个问题。
原来即使 SSH 来源已获授权且主机上存在会话记录，路由读取仍一概拒绝；这次在该来源主机运行原有解析器，避免要求用户重复提供已有会话链接。
已通过实际 CLI、SQLite 会话库和 rollout 读回验证正确目标、歧义、来源缺失、撤权及恢复；结果只提供会话位置，没有发送消息或启动执行。
本次不授予跨主机执行、消息发送或升级权限，也不宣称移动端委派、接收方采用和原对话结果返回已经完成。
这是已有协作旅程的观察前提；本评审将 SSH 命令接到本地隔离来源的实际 CLI，未冒称真实远端网络或安装版移动端交付已独立验收。

改动思路

来源访问属于现有 manager_context SSH provider，会话状态属于 Codex store adapter，候选选择仍由原有 TypeScript route owner 决定；不能把可读位置升级为执行授权。
当前 PR 只修复已授权来源的只读观察和原解析器接通，后续实际提交、接收方处理与结果返回继续由原协作和 Host owner 负责。

实际调用仍是管家已有 read tool。请求先经过既有参数和来源/Goal授权检查，再在选定 SSH 来源运行原有 resolve-peer-route；该来源主机自己的 Codex observer读取本地会话库，而不是调用者去用自己的主机记录代替远端事实。候选选择、归属冲突和重放规则继续由同一个 typed owner处理。

原文把所有远端观察一概拒绝，文档和 skill 现在明确这是有授权、指定来源的观察通道；host_surface只缩窄已知绑定，不能选另一台机器或制造权限。来源不可用时保留错误，禁止用历史 portfolio缓存凑出当前目标；定位成功也不代表提交成功。

来源事实	当前读回	后续效果
旧会话明确归档、原会话可读	返回原 current 会话位置	locator_only / not_attempted
两个可读会话，或两个不可读替代项	ambiguous，没有 selected_route	不猜测、不发送
IO过程中撤销来源grant	authorization_changed	丢弃已读位置；重新授权后可新读

具体改动

完整 diff 为10个文件、+172/-29：三个生产 Python read/IO adapter、现有管家 skill、两份协议/集成说明和四份聚焦测试。Python保留的是 SSH和Codex store IO；TypeScript route selector没有被复制成另一个 Python决策 owner。当前 target main 在这十个路径上没有后续改动。

验收映射：Sources Of Truth implemented，原 registry、绑定、grant和Host记录仍为唯一来源；Space, Caller Context, And Layers implemented，前后两次范围检查及负例防止观察层扩权；Directory Packet implemented，正确位置必须符合原 Goal/Agent，未知替代项保持歧义；Non-Goals implemented，新增读回没有消息提交、执行、升级或新调度。协议中“远端一概不支持”的旧部署边界被本次有界IO能力扩展替代；其余身份与权限要求保留，不能把本次文档修改当成独立验收来源。

规范来源：docs/reference/protocols/peer-agent-directory-and-observation-v0.md，不可变验收版本 b285c7c1b38bb1d426fca2ef6bd8ddfce177959a；评审 head 953e20eda13713c19d148cfdcac0f9bc51e6de38。

关键代码讲解

• rejected_read_arguments（loopx/capabilities/manager_context/inspection.py:96）: Validates host_surface only for exact agent_route requests and exposes repairable argument errors without executing a read.
• read_remote（loopx/capabilities/manager_context/ssh_evidence.py:152）: Executes the existing resolver on the authorized source host and rechecks source/Goal grants after IO; route failures never use cached portfolio.
• _valid_peer_route_packet（loopx/capabilities/manager_context/ssh_evidence.py:302）: Checks exact Goal/Agent, locator-only authority, untouched delivery and selected identity before returning a public-safe packet.
• CODEX_LOCAL_STORE_SURFACES（loopx/codex_app_thread_activity.py:35）: Allows the source-host observer to read an SSH-origin session from that host local store; no connection or task launch is introduced.

对主干的风险

没有阻断性发现。 当前172项聚焦测试通过，未改基线对应159项通过。新增独立四场景把真正的来源 CLI、SQLite会话库、rollout和TypeScript selector接到 manager transport runner，证明正确原目标、多个可读目标、缺来源记录、IO中撤权；缺来源或撤权恢复后可新读原会话，前后 registry/数据库/rollout字节不变，始终没有消息或执行。相同消费者在基线四项均因旧 remote_agent_route_not_supported、零来源调用而失败。这里使用隔离来源的本地 SSH runner seam，未冒称网络SSH传输已由本评审实测。

早期私有测试把“两条未知替代项”预期为 unavailable，实际原 selector给 ambiguous；该状态同样不选择任何目标，符合原协议。更正的是测试对原歧义语义的误解，保留了不误选、无效果和恢复断言；不能把这项测试错误归为产品故障。现有独立测试还覆盖错误Goal/Agent/host、私有或不合法回复、授权撤销和禁止读取旧portfolio缓存。

原生 standard premerge 仍有两项失败：peer-agent-runtime汇总中的 quota-spend-workspace-causality夹具，以及 project-lifecycle dry-run夹具，均在 canonical_authority_required拒绝。用同一命令在不可变 base和本 head分别复现，完整规范化错误相同，相关 smoke、refresh与canonical authority源码逐字节未变；规范化仅移除checkout/临时路径和耗时。当前新路由不变量另有通过证据，因此归为 pre_existing_unrelated。保留 exit1及必须检查的合并限制，没有弱化断言、改限额或迁移活动Goal来制造绿灯。其余 direct、compile、catalog、风险及边界检查通过；没有查询或等待远端CI。

语义与 CI 对齐

重用现有 codex-app-ssh、route schema和Host状态，没有新增协作协议或生命周期。host_surface是现有绑定的过滤，不是机器标识或权限。读取成功与locator_only/not_attempted都是既有机器契约，skill只解释如何请求观察；未引入必须委派、升级、发送或另建任务的义务。共享自动加载指令按 actor、来源、顺序、失败/恢复和权限逐项比较，新增的是来源观察支持，而非隐藏的默认执行。

我的整体评价

APPROVE，作为已有协作旅程中可独立回滚的观察前提。long_horizon=preserved：原请求、路由重放与工作owner不变，不因读取产生新工作；user_experience=improved：已有授权和身份足够时无需让用户再查一次会话链接，失败与歧义仍诚实保留。这里没有把一次可读位置、源码合入或作者实机声明记为完整委派收益。

有界重构已应用：复用原路由schema与publication limit、沿用typed selector并保留专门IO adapter；没有需要添加的泛化框架。两项基线红检查、安装态移动端提交、接收方采用及原对话返回保持各自未完成边界，不作为本次已完成的能力。

English verdict: APPROVE at 953e20eda13713c19d148cfdcac0f9bc51e6de38 for the bounded authorized-source observation increment. The original native resolver and typed selection owner are reused; source revocation, unknown/ambiguous targets and wrong identities remain effect-free, and restored authority/store recovers the original route. Local focused and source-CLI/SQLite consumer evidence passes. Two unchanged canonical-authority fixture failures remain red; live SSH, installed mobile delivery, receiver adoption and return-to-conversation are not independently qualified here.