[loopx-agent]

Goal And Delivered Outcome

The required digest single-owner test fails because native result recovery redefines the bare SHA-256 shape introduced in #7856. Reuse BARE_SHA256_PATTERN from the existing owner, register the real consumer in its guard, and characterize both proof fields through the recovery planner. This restores the required check while preserving recovery decisions.

• Before → after: the same focused tests with the new proof assertions produce 61 passes and the existing single-owner failure before the implementation, then 62 passes after it. No exception or budget was relaxed.
• Intended base: main, implemented against 8a9e116283df2796926ea153241f48c9c8fc3dbb (including fix(chat): resume unsubmitted native handoffs with one bounded format review #7863). Related to fix(chat): restore verified native answers after Core failures #7856 and the validation hold disclosed in refactor(runtime): share snapshot eligibility across Python and TypeScript #7862; no issue is closed.

Author Declaration

• Written by: model_agent — Codex, OpenAI GPT-6 family.
• Specification and revision: overall roadmap §2, the existing digest owner and native-result recovery contract at the same revision.

Criterion	Disposition	Owner / evidence
Restore the failing required validation on the selected delivery path	implemented	content_digest.ts reused by conversation_binding.ts; unchanged static guard passes
Preserve original request, failed-Turn and recovered-result boundaries	implemented	Existing planner test, 20 invalid/2 valid proof assertions, actual Python→Core recovery and refusal cases

Self-check: reviewed the entire final three-file diff, canonical pattern, recovery caller, consumer inventory, repository instructions and declared validation tasks. No new shared vocabulary, configuration, protocol or capability was added.

Scope And Continuation

Complete within this scope. The canonical expression is equivalent to the replaced expression ([a-f0-9] and [0-9a-f] denote the same set) and has no stateful flags. The upstream metadata-review logic is retained. Bounded simplification: one existing owner replaces the duplicate matcher; no new helper or state is needed.

This proposal does not qualify or clear historical receipts for #7862. That PR needs its own updated source and exact-head validation after the dependency is integrated. Broader controller/executor and product acceptance remain with their existing owners.

Validation

• Tested revision: 4509737dc18b5756b467209cbe13ab0bf916399a.
• Run state: finished.
• Input classes: synthetic, public_fixture.

Check kind	Result	Evidence / limitation
regression_parity	passed	Before rebasing, focused base/head: 61 pass + 1 existing single-owner failure → 62 pass. Both sets already include all 22 new proof assertions.
regression_parity	passed	Temporarily bypassing the digest gate makes the native recovery test fail on a null input digest; restoring the exact source passes. This sensitivity check ran before the rebase.
real_entrypoint / real_backend	passed	Original eight recovery cases pass on immutable test-only baseline and final head. Final head also passes all 16 metadata-review cases from #7863: 24 total. Real Python→Core/Node and isolated File-backed Chat/session journal; synthetic provider/SDK, no live messaging or model execution.
static	passed	npm run typecheck:control-plane; diff-scoped semantic advisory (no supported new vocabulary carrier); bilingual RFC diff and git diff --check. No RFC pair changes.
unit / integration	passed	npm run test:control-plane: 5826 passed, 0 failed, 77 skipped; Node 24.21.0.
static / integration	passed	Exact-scope change-quality receipt and standard source-checkout canary premerge: cqr_b5d1419cb4c709195c40, fingerprint b5d1419cb4c709195c40ce87159ce8ecab8a28f242aa2ca91f12618be56ca55a; receipt verified valid. Standard premerge: all 4 direct checks and 10 selected smokes passed; no manual hold or waiver. Safe-fix permitted, 0 review repair passes applied; 0 reported blocker/warning/advisory risks. This is author validation.

Coverage and gaps: tests exercise both digest fields, existing request/source/thread/time/stop/recovery checks, once-only delivery and the newly merged metadata-review recovery/refusal paths. Full-suite skips are disclosed above. No authority-store, migration or provider implementation changed; no live PostgreSQL, Lark tenant, installed App, live model or long-horizon effectiveness qualification is claimed. CI and independent review remain separate gates; no merge is performed.

Frontend / Visual Evidence

UI impact: none. This reuses the same internal recovery predicate; existing App/Lark/CLI interactions and visible outcomes are unchanged. No new caller-facing capability or presentation is introduced. Before/after, viewport, source data, attention and craft review: N/A.

Type / Area / Direction

• Bug fix, behavior-preserving refactor, test update.
• Control plane; host/runtime integration.
• Existing roadmap quality and recovery boundaries; no migration or shared-authority promotion claim (fixture promotion: N/A).

Boundary Checklist

• Public diff and description contain no private state, credentials, raw traces, internal links or local paths.
• Existing owners retained; scope limited to the demonstrated validation failure and its recovery caller.
• No paired RFC changed; bilingual diff check passes.
• UI impact marked none.
• Both commits have DCO sign-off.

[loopx-agent]

Reviewer: model_agent · gpt-6.1-sol · OpenAI · runtime_reported · effort=max

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

未发现阻塞性问题。当前审查绑定 7865@4509737dc18b5756b467209cbe13ab0bf916399a，不继承其他 head 的批准。

动机 / Motivation

维护原生聊天结果恢复的开发者需要通过已有的 digest 单一 owner 检查。 基线把相同的 SHA-256 形状重新写了一遍，导致必需检查失败；当前改为复用已有定义，并保留原来的恢复条件。 当前 head 的单一 owner 检查通过，合法结果仍可恢复，错误来源、停止、撤权和不确定送达仍按原边界处理。 本结论不代替其他 PR 的重新验证、合并资格、真实上游运行或完整产品验收。

改动思路 / Approach

既有 digest owner 接管相同的词法检查，原恢复决定与 IO owner 保持原职责，删除重复定义即可解决已复现失败。 当前 PR 的边界是三文件中的 matcher 收敛、consumer 登记和两类 proof 的有效/无效输入断言。 直接导入原有常量并登记实际 consumer，比再建 helper、放宽静态 guard 或复制 matcher 更小；没有新增执行机制。
实际路径是：LarkPrivateConversations.reconcile_request → ChatExternalConversations._recover_native_result → _context_recovery_plan → Core planBoundConversationRequest/planContextRecovery。 合格时追加确定 message_id 的已有答案；不重新提交原始业务、不改写失败 Turn，不确定 acknowledgement 保持 owed。 已读取并判断 repository experience 的任务/恢复视角；当前结论来自本 head 的实际反例与消费路径，不把 recall 或历史意见当验收。

具体改动 / Changes

3 文件 +13/-1：production +2/-1；tests +11/-0。 规范依据为 docs/architecture/rfcs/app-conversation-and-async-inbox-v0.md，固定 revision 8a9e116。该文本在实现 diff 前已读取，以下 criterion_id 是对既有段落要求的映射，并未追加整个父 roadmap 的验收。

• native-result-original-binding — implemented：原私有 steward/source/failed Turn 与当前授权才可恢复。 对应 loopx/control_plane/collaboration/conversation_binding.ts:560，由当前正/负路径验证。

• native-result-proof — implemented：稳定 idle trajectory、最新输入、正常终态与原请求时间相关联，缺失或冲突保持 pending。 对应 loopx/control_plane/collaboration/conversation_binding.ts:602，由当前正/负路径验证。

• native-result-once-delivery — implemented：冻结原答案并按确定身份送达；原失败与不确定送达记录保持，恢复不重放业务。 对应 loopx/capabilities/native_chat/external_conversations.py:308，由当前正/负路径验证。

关键代码讲解

• BARE_SHA256_PATTERN：唯一裸 SHA-256 形状；64 个小写十六进制字符，无 g/y flag。

• planContextRecovery：原生 proof 的两个 digest 改用已有常量；其他 original/source/time/normal-terminal 条件不变。

• CANONICAL_CONSUMERS：登记实际 consumer，使未来重建第二 matcher 的变更仍被原 guard 检出。

同 Python 3.14.8、Node 24.21.0、相同依赖和原 fixture，base/head 的 24 个真实 Python→Core/Node 恢复用例全部通过；覆盖原答案、原失败记录、一次返回与 format-review 拒绝。 两字段共 20 个无效 proof 断言和 2 个合法断言；原 source/thread/request/time/stop/steering/attachment/closed-session 限制保留。真实 24 例含丢 acknowledgement、message crash、撤权、新输入、错误 handoff 和工具调用拒绝。

对主干的风险 / Risks

共享 RegExp 若带 g/y flag 或改变字符集合可能污染连续判断；当前常量无状态 flag，原 type guard 不变。未知上游、原生平台和完整模型采用仍不作通过声明。 完整 TypeScript 套件 5826 PASS、0 FAIL、77 SKIP；focused 62 PASS；control-plane typecheck PASS；标准 premerge 4 direct + 10 selected 命令通过，聚合因 quality_stale_receipt FAIL。

PASS：当前 source 的全 TS 为 5903 项中 5826 通过、77 跳过，0 失败；base/head 的 24 项真实恢复用例逐项身份相同、全部通过。原 failed Turn 字节不变、provider send 一次、不确定 acknowledgement 不重发等断言均保留。两份 focused suite 使用相同工具、依赖与测试入口；基线唯一失败精确指向重复 matcher，当前通过。没有用放宽 guard 或删除断言造绿。

语义与 CI 对齐

本轮未查询、轮询或等待 CI，远端 CI 的未知原因保持未知。配置范围的质量资格实测为 quality_stale_receipt，standard premerge 聚合仍 FAIL；已通过的 direct/selected 命令与该政策 hold 分别记录，未改写旧 receipt、豁免合并门或声称 ready。实际合并仍须当前精确 head 的独立资格。

我的整体评价 / Verdict

所审三文件没有改变渲染内容；已追到原 App/Lark reply consumer，现有可见结果保持。 真实上游 Antigravity、installed App、原生平台与长期效益未验证。

long_horizon：preserved，依据上述恢复/重载与后续读取路径；没有推断模型采用、科学效益或完整成本净益。user_experience：preserved。复用既有 owner、边界可独立回退，code_volume 为 necessary、change_proportionality 为 proportionate；无新增 feature-off 承诺或 actor 权限。现有共享 digest vocabulary 被复用。 当前证据支持 APPROVE，质量/安装/合并限制继续保留。

English verdict: APPROVE — 7865@4509737dc18b5756b467209cbe13ab0bf916399a; canonical digest reuse preserves native recovery and refusal paths; focused 62 and matched real-path 24 pass, full TS has 5826 pass/77 skip. The configured quality gate remains held; no merge qualification is claimed.