refactor(todos): route production consumers to concrete owners

[loopx-agent]

Goal And Delivered Outcome

Canonical CLI startup still requires the historical loopx.todos re-export even though its concrete owners already exist: removing that module blocks Todo registration and the full CLI's issue-fix import. Route all 24 production consumers across CLI, quota/planning, capabilities and Lark directly to the same mutation, full-read, path and source-display owners.

The disposable source/normal-wheel package now runs complete File/SQLite CLI and App journeys with the facade, the whole legacy Todo writer and all four shadow producers physically absent together, including read-only full-CLI status startup. Historical public imports and supported source writes remain available; no schema, provider default, permission, transaction or effect rule changes.

Base: main; immutable comparison: b760c1eb35613ac84a03cb17246eaba9030db062.

Author Declaration

Written by: model_agent — GPT-6.1, OpenAI.

Implemented against R5 and the T4 current frontier.

Criterion	Disposition	Implementation / evidence
Whole production caller family, reuse established owner	implemented	mutation_api, list_readback, path_resolution, active_state_editing; identical public function objects, unchanged executable bodies.
Real entrypoint, source removal and recovery	implemented	Source/wheel File/SQLite lifecycle, creation replay, leases, terminal/archive, once-only settlement, Monitor retry, App cold import/actions/server restart.
No fallback or expanded authority	implemented	Provider/lease loss and source/backup drift reject; complete baseline/head denial diagnostics match.
Historical imports, receipts, outbox and source IO	implemented	Public facade retained; original outbox interruption/recovery and historical Monitor receipt checks remain; no live writer deleted.
Cost and crossings	implemented for bounded local sample	Same Todo-list command, six warm samples/provider/arm; four effect crossings in both. No latency improvement or sustained-capacity claim.
Whole C1, installed cohort, real Host/peer adoption and D2/D3/default release	deferred to existing owning exits	This PR qualifies the consumer dependency exit only. No active Goal or shared installation changed.

Scope And Continuation

Complete within the production consumer-import boundary. No new runtime abstraction or Python decision owner. Bilingual T4/reference checkpoints retain supported writers, import/backup/history and the remaining qualification work. The source-lease import and distribution-isolation harness overlap the same proven lines in #6272; its separate source-lease acceptance is not rebuilt here. Neither PR's merge is a prerequisite for unrelated work.

Validation

Tested functional revision: 91b3cdfcab6118821b84ad2a2eaa7d9979ba5ae4; final committed normal wheel also passed a cold App import/action/restart readback. Input classes: synthetic, public fixture. Run state: finished.

Check kind	Result	Evidence / limits
regression_parity	passed	The immutable baseline passed two facade-present lifecycle arms, then failed the facade-absent real CLI at todo_registration; the fixed oracle passes. Six complete exit/stdout/stderr denial pairs equal, source/registry bytes unchanged.
real_entrypoint / real_backend	passed	test_todo_consumer_retirement.py, test_todo_consumer_host_retirement.py plus existing writer/Monitor/history isolation oracles: 142 passed across source/normal-wheel arms. Real disposable File store and SQLite via Node 24.21.0; Python 3.14.8.
integration	passed	885 passed affected Python/capability/extension/control tests, including handoff identity, Unicode/credential filtering, source writeback and Lark retry coverage.
unit / typed integration	passed	Full TS suite: 4447 passed, zero failed; 37 optional PostgreSQL cases skipped. Those cases remain unqualified; provider/store implementation and request semantics are unchanged.
static	passed	TypeScript typecheck, mypy's configured 19 sources, Ruff, full-tree semantic inventory/smoke, whitespace, 33-file public boundary scan. Registry IO manifest changes only two source-line locators. No new shared vocabulary.
cost observation	passed	File median 0.491→0.479s; SQLite 0.574→0.567s in the bounded paired sample. Identical four effect calls; timings are local observations, not a capacity certificate.
managed quality	passed	Exact-scope CQR cqr_9fd684cf77d4c1cb9fe3; risk-based premerge: 5 direct checks + 19 selected checks passed, zero failures/manual holds.

Lark/Explore coverage is local: Lark preview refuses every remote runner invocation; Explore replay does not duplicate events. Live Lark, browser clicks, installed cohort/Host adoption, full backup restoration and formal D2/default qualification are not claimed. Existing frozen failures/missing evidence retain their owning acceptance.

Frontend / Visual Evidence

UI impact: none. The existing packaged chat bundle is actually served; its real HTTP preview/confirmation/action/detail/restart paths exercise the owning backend. No visual layout or new configuration surface is introduced.

Shared-authority RFC fixture impact

No changed state classification, compatibility projection, provider request or store rule. The existing synthetic complete-source/receipt fixtures and real File/SQLite providers are reused. PostgreSQL three-arm promotion qualification remains with its existing owner; this import cutover performs no promotion or runtime provider selection.

All four commits carry DCO sign-off; public paths exclude private Goal state, logs, credentials and machine paths. Core merge remains with the maintainer.

[loopx-agent]

Reviewer: model_agent; model=gpt-6.1-sol; provider=OpenAI; runtime_reported; reasoning_effort=xhigh.

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

动机

受影响的是使用命令行和 App 操作 canonical Goal 的用户，以及继续收敛旧代码的维护者。旧 Todo façade 是历史重导出入口；即使它指向正确 owner，生产调用方仍依赖它，物理移除后普通 Todo 注册和完整 CLI 加载都会提前失败。这个 PR 将整批生产消费者直接接到原有 owner，使相同操作在旧模块缺席时仍能完成，并保持错误、回执和后续数据的恢复路径。剩余缺口是最后受支持的旧源写入、真实安装采用、Host/peer 与发布资格；本次交付只关闭消费者依赖，不撤销历史公开导入或旧格式支持。

改动思路

最小可行方案是修改真实消费者的 import，继续调用相同函数对象；仅改一个 CLI 常量仍会在完整 CLI 的 issue-fix 导入处失败，而把 import 延后会隐藏依赖。检查不可变基线与当前 head 后，确认 mutation、完整读取、路径解析、源显示解析四个 owner 已存在，不需要新增 wrapper、Python 决策、配置或协议。canonical 事务、claim/lease/CAS、终态与恢复仍归既有 TS owner；未迁移源的 Python 锁内 IO 和捕获链继续由原 owner 承担。保留这批边界的理由是它交付完整生产调用族的依赖出口，并可单独回滚代码导入。现有 App 确认步骤仍提供迁移授权信息，没有增加导航、重复填写或额外操作门。

具体改动

评审 head：91b3cdfcab6118821b84ad2a2eaa7d9979ba5ae4。规范参考 docs/architecture/rfcs/loopx-overall-roadmap-v0.md#r5-ts-convergence-and-local-persistence，规范 revision：b760c1eb35613ac84a03cb17246eaba9030db062；同时核对该 revision 的 TypeScript 迁移 RFC 当前 T4 边界，未以本 PR 新增说明反向定义验收。

规范条款	当前判断与证据
R5.Selection	implemented：整批 24 个生产消费者直接复用现有 owner，未按单个字段新增 RPC。CLI、quota/规划、能力和 Lark 入口均有真实调用方。
R5.Delivery	implemented（本依赖出口）：源码与正常 wheel 的真实 File/SQLite CLI、App HTTP、终态、Monitor、后写与重放；完整错误对照、缺 provider/lease、源/备份变化拒绝。
R5.Exit	deferred：完整 C1、core 安装试用、真实 Host/peer、容量/长期证据及发布默认仍在各既有 owning exits；局部通过不能代替它们。
R5.Rollback	implemented（代码边界）：恢复 import 不重写 authority、原 receipt 或历史数据；provider 的 schema-aware 导出/降级仍属原 owner。
T4	implemented（消费者出口）：保留公开 façade、有效源 writer、导入/备份及 outbox 历史窗口；不把机械隔离宣称为全部 writer 已删除。

关键代码讲解

1. register_todo_command（loopx/cli_commands/todo_registration.py:16）使用 mutation_api 的同一归档常量。此前 parser 注册就需要历史 façade；现在注册、分派和真实 CRUD 可在它缺席时运行，错误校验顺序不变。
2. handle_todo_command（loopx/cli_commands/todo.py:282）分别从 mutation、完整读回与路径 owner 导入。参数仍走原校验和事务，独立读回确认 note 落盘、原操作重放和后续写入保留；不是用成功响应代替持久化验证。
3. _task_lease_authority_projection（loopx/control_plane/work_items/task_lease_acquire_adapter.py:159）直接使用原 list_readback。这与 #6272 的已验证同一行一致；其 source-lease 专项没有在这里重建。Python 不重新解释 lease 或 canonical authority。
4. sync_loopx_todos_to_lark_kanban（loopx/extensions/lark/presentation/kanban.py:2180）直接复用现有路径/显示解析 owner。正常 wheel/source 中验证 source preview，任何远端 runner 调用都会令 oracle 失败；Explore 原操作再跑不会重复事件。该证据只覆盖本地扩展调用。

测试新增两个薄模块，复用既有独立生命周期、冷导入 HTTP 和故障/重放 oracle。共同 distribution harness 采用选定解释器 -S、明确依赖路径和 wheel 自身入口，排除 editable finder 从 checkout 补回被删模块；另验证 façade 的 find_spec。注册 I/O manifest 仅同步两个行号，两个模块说明改指具体 owner；英中文档记录本出口及保留义务。

对主干的风险

未发现阻塞项。最强反例是“简单 Todo 调用通过，但完整 CLI 或 App/Lark 在旧模块缺席时仍提前加载旧链路”。已实际执行源码/wheel 的全 CLI 状态读取、App 冷导入/确认/后续写入/重启及 Lark preview，并验证状态读取不改变原字节。共有 134 个隔离/历史兼容用例及 8 个全 CLI 反例通过；885 个相关 Python controls、4447 个 TS 用例通过，37 个可选 PostgreSQL 集成用例跳过，仍未资格化。现有 provider/store/request 规则未改变，该缺口不被本次 import 检查抹去。

同一不可变基线与 head 的六组拒绝输入比较了完整退出码、stdout、stderr，原 source/registry 均不变。File/SQLite 正向对照还验证基线创建/修改的原操作在 head 重放、完整 Todo 读回相等、后来新增工作和 revision 保留、终态再放无副作用。源/备份漂移和 provider/lease 丢失由原 owner 拒绝，恢复后可继续，不以 Markdown 替代当前 authority。物理 façade 缺席的旧基线在 parser 注册处失败，当前相同 oracle 通过。

默认、权限、调度/结算、输出 schema 与 agent-consumed 指令均未新增；import 本身不激活可选能力。旧公开 API 保持同一对象，仍有真实调用的 writer/capture/历史 IO 未删除。无新增状态词汇、子串分类规则或领域化核心错误；校验是原机器约束，并未改称 guidance。Ruff、mypy 19 个既定 sources、typecheck、全树语义、公开边界扫描与 exact-scope CQR 通过；premerge 5 direct + 19 selected 均通过、零 hold。CI 按当前评审契约未查询。App 是真实 packaged HTTP/bundle，未冒称 browser 点击或本机安装采用；Lark 无 live 外部写入。

我的整体评价

这是 justified_increment。long_horizon 判定 preserved：创建、后写、原回执和终态/Monitor 重放、provider 恢复及恰好一次结算的连续路径保留；user_experience 判定 improved：相同现有操作在旧模块缺席时恢复可用，不增加强制交互，失败仍可诊断和恢复。整族直接复用比拆分逐入口补丁更易验证和回滚；最高价值的相关收敛已在本 PR 完成，没有增加未来框架。保留历史公开导入及源 IO 有当前调用方和恢复义务，不能为减少代码而提前删除。

源码/wheel 已证明这个出口；正式迁移 cutoff、安装 cohort、真实 peer/Host、完整 backup 和冻结 D2/default release 继续由已有验收承担。四个 effect crossings 在同负载两版本相同，短样本耗时不构成性能或容量证书。当前 head 无阻塞项，支持本批 APPROVE 并交维护者合入；此结论不是安装、发布或 merge 授权。

English verdict: APPROVE — 91b3cdf. Cohesive production import cutover reuses unchanged owners; real File/SQLite source/wheel CLI and App recovery, full diagnostics and replay are verified. Historical compatibility and separate adoption/default qualification remain open.

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @loopx-agent.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[loopx-agent]

Reviewer: model_agent · gpt-6.1-sol · OpenAI · runtime_reported · xhigh

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

精确 head：11833b442b433606a42ad5e3348056cb4b09e85f；上一被批准 head：91b3cdfcab6118821b84ad2a2eaa7d9979ba5ae4；当前 base：main（d949a7c43 已并入）。

动机

Canonical CLI 启动此前仍依赖历史的 loopx.todos re-export：具体 owner 早已存在，但只要拿掉那个 facade，Todo 注册与 issue-fix 导入就会失败。本 head 把 CLI、quota/planning、capabilities 与 Lark 的 24 个生产消费方直接接到同一批 mutation/全量读取/路径/来源展示 owner 上，使源码包与普通 wheel 在 facade、整个 legacy writer 与四个 shadow producer 同时缺席时仍能跑完整 File/SQLite CLI 与 App journey；历史公开导入与受支持的源写入保持不变。分支落后且冲突，需要整合后重新核验。

改动思路

先并入当前主干。唯一冲突是 task_lease_acquire_adapter.py 里 list_goal_todos 的导入：两侧都已经从历史 facade 改到具体 owner，只是相对路径写法不同（本分支 ...control_plane.todos.list_readback，主干 ..todos.list_readback）。二者解析到同一个模块，主干写法与同文件相邻导入风格一致，因此采用主干形式，语义等价、无行为差异。其余 30 个文件自动合并。

具体改动

31 文件、+280/−31：24 个生产消费方的导入改向具体 owner，两个新增的薄退役用例（test_todo_consumer_retirement.py、test_todo_consumer_host_retirement.py，各 +99）加 test_canonical_todo_writer_isolation.py 的更新，注册 I/O manifest 同步两行行号，另有英中文档说明出口与保留义务。验证（合并后 head）：四个文件 test_todo_consumer_retirement.py、test_todo_consumer_host_retirement.py、test_canonical_todo_writer_isolation.py、tests/architecture/test_project_registry_io_census.py 合计 67 passed（首次跑 host-retirement 时 10 个用例因本 worktree 未构建 Chat bundle 而报错，按支持流程 scripts/chat_bundle.py build --install 重建后全部通过，属于环境准备而非代码缺陷）；改动文件 ruff、仓库配置的 19 文件 mypy、语义 vocabulary smoke、git diff --check 与公共边界扫描（532 文件）通过。

对主干的风险

最强反例是「简单 Todo 调用通过，但完整 CLI 或 App/Lark 在旧模块缺席时仍提前加载旧链路」。本轮证据正是针对这一点：test_todo_consumer_host_retirement.py 在隔离源码/普通 wheel 上让 facade、legacy writer 与四个 shadow producer 同时缺席，仍能完成全 CLI 状态读取、App 冷导入/确认/后续写入/重启与 Lark preview（12 passed）；历史公开导入与仍有真实调用方的 writer/capture/IO 均保留。没有新增默认值、权限、调度/结算规则、输出 schema 或状态词汇，import 本身不激活可选能力。未测边界与上一轮一致：正式迁移 cutoff、安装 cohort、真实 peer/Host、完整 backup 与默认发布仍由既有验收承担。控制面合并资格仍由维护者决定。

我的整体评价

APPROVE：这是一次内聚的生产导入切换，复用未改动的 owner；与主干的等价导入写法合并后，退役、主机、写入隔离与 I/O census 四组用例和静态/语义/边界检查全部通过。

English verdict: APPROVE - 11833b4. Current main is integrated with the equivalent concrete-owner import kept for the lease adapter; the retirement, host-retirement, writer-isolation and IO-census suites (67 tests) pass after the required Chat bundle build, together with changed-file ruff, the configured mypy set, the semantic smoke, the diff check and the boundary scan. Migration cutoff, installed cohorts and release-default qualification remain separate.