feat(preference): add thin provider-neutral recall hook

[huangruiteng]

Summary

• add an opt-in, provider-neutral semantic_preference.recall() seam keyed by module-owned surface and query configuration
• return bounded provider results with explicit fail-open/fail-closed behavior
• build deterministic compact application receipts for existing evidence/state writeback, without a second ledger or receipt file
• expose thin CLI commands and document how Issue-Fix owns issue_fix.pr_description application policy

Why

Domain modules need a small way to reuse provider-owned semantic preferences without moving storage, ranking, or semantic policy into LoopX. The earlier prototype also maintained its own receipt persistence and configuration-summary abstractions; those were removed because existing LoopX evidence and state surfaces already own durable writeback.

Real callsite

An enabled local-private OpenViking provider recalled a reviewer-facing PR-description preference before editing public OpenViking PR #3190. The description was changed from English to concise structured Chinese, remote readback matched the intended body, and the generated receipt retained only the public artifact reference plus a digest of the provider-owned preference reference. No provider config, recalled content, or receipt ledger is included in this PR.

Validation

• python3 examples/semantic-preference-hook-smoke.py
• python3 examples/issue-fix-capability-guide-smoke.py
• Ruff check on the new module, CLI glue, and smoke
• py_compile on changed Python files
• loopx check public-boundary scan
• standard premerge canary: 4 direct checks and 17 selected catalog/risk/boundary checks passed; 0 failures, warnings, or manual holds

Risk and compatibility

• default-off: no config means no caller behavior changes
• provider command and config remain local-private and are never copied into receipts
• provider failures never become user gates automatically
• no existing domain module is forced to apply a preference; each module owns its surface, query, and application decision

[huangruiteng]

Findings

No blocking findings remain.

The self-review initially found that result count was bounded but individual provider items and receipt reference lists were not. Commit 7f5af9e7 now caps provider stdout, per-item payload size, and receipt references; the focused smoke covers compact-receipt overflow.

Assumptions

• Provider configuration is trusted local-private execution configuration, not a remotely supplied command.
• A domain module, not this hook, decides whether recalled preferences affect an artifact.
• Existing evidence/todo/refresh-state surfaces remain the only durable LoopX writeback.

Product / architecture judgment

The PR solves the intended problem with a thin reusable boundary: arbitrary module-owned surface/query configuration, one provider-neutral command protocol, bounded recall, and one stateless receipt constructor. It has no Issue-Fix branch and creates no independent memory/reward ledger.

The main installed-user risk is execution of a configured local command. That behavior is opt-in, config files inside a project must be ignored and untracked, time/output/item limits are enforced, and raw provider failures are reduced to stable failure kinds. No existing caller is activated automatically.

Validation

• generic two-surface recall smoke, default-off behavior, fail-open/fail-closed, stateless receipts, and receipt bounds
• real opt-in OpenViking recall applied to public PR #3190; remote body readback matched and the receipt contained no raw preference reference
• Issue-Fix capability guide smoke, Ruff, py_compile, and diff check
• final premerge canary: 4 direct checks + 17 catalog/risk/boundary checks passed; zero failures, warnings, or manual holds
• GitHub pytest passed

Merge decision

Approved for owner-authorized self-merge. The change is single-purpose, default-off, provider-neutral, boundary-scanned, and verified at one real callsite.