Skip to content

LoopX 1.0.1 — reliable Goal Channels, recovery, and typed control-plane boundaries

Choose a tag to compare

View all tags
@huangruiteng huangruiteng released this 07 Sep 22:51
v1.0.1
7f2a020

LoopX 1.0.1 — reliable Goal Channels, recovery, and typed control-plane boundaries

At a Glance

LoopX 1.0.1 makes the 1.0 Workspace safer to operate: multi-Agent Goal
Channels are resumable, Agent-requested reports use typed intents instead of
keyword matching, Desktop failures are diagnosable, and more Todo authority is
atomic and recoverable.

Upgrade

loopx update check
loopx update plan
loopx update apply
loopx --version
loopx doctor

Highlights

  • Ask an addressed Agent for a report in a bound Goal Channel. The Agent makes
    the semantic decision and records an exact, provider-neutral, replay-safe
    request; LoopX does not classify messages with keywords or regexes
    (#4001,
    #4037,
    #4040).
  • Connect several Agents to one Lark Goal Channel through a resumable batch,
    with verified bot mentions and a distinct compatible App for each Agent
    (#4004,
    #4039,
    #4046).
  • Diagnose and recover Desktop startup/update failures with bounded copyable
    evidence, visible startup progress, safer update-journal cleanup, and
    package-time runtime-entry checks
    (#4014,
    #4021,
    #4022,
    #4027,
    #4031,
    #4041).
  • Read measured per-Goal Codex usage without inventing missing cost or token
    values; historical snapshots receive a provenance-bound compatibility path
    (#4016).
  • Keep ownership mutations atomic and projections recoverable: promoted Todo
    claim+lease, canonical-journal Markdown recovery, Stage 2C management, and
    completion policy now share stronger typed transaction boundaries
    (#3985,
    #4032,
    #4038,
    #4044).
  • Frozen host bundles can install the same version-bound LoopX workflow skills
    as wheel/source installations, and Goals can opt into earlier completed-Todo
    review without changing the default cadence
    (#4063,
    #4045).

Replan Fixes

  • Declared Vision fallback gaps remain visible in the frontier instead of
    disappearing behind compact projection
    (#3979).
  • Post-writeback composition failures retain typed source identity and
    retryability instead of collapsing into generic failure
    (#3978,
    #4025).
  • Goals with short Todo chains can request review after 1–5 completions; the
    shipped default remains five
    (#4045).

Contributors

Release Decision

Who should upgrade: Goal Channel, periodic-report, Desktop, measured-usage,
Reward Memory, frozen-bundle, or Stage 2C qualification users should upgrade;
stable CLI-only users unaffected by these paths may wait for their normal
maintenance window.

What this release solves: It closes the main post-1.0 reliability gaps in
multi-Agent channel onboarding, typed report requests, recovery diagnostics,
usage provenance, Todo ownership/projection recovery, and installed workflow
skill parity.

Breaking changes: No. The supported stable contract and persisted Goal
state remain compatible. The experimental loopx benchmark agent-phase and
benchmark_toolkit.external_agent bridge were intentionally removed; affected
runners must invoke their solver directly or migrate governed execution to the
Turn contract. Existing result files are not rewritten, and Stage 2C remains
default-off.

How to verify: After upgrading, version and doctor must report 1.0.1; the
weekly report profile must remain active/generation-allowed, and workflow-skill
readback must be ready for the installed package.

Contributors: Prepared by @huangruiteng with @now-ing, @wchwawa,
@Duang777, @liubf21, @huashuai, @steven-kid, @KevinBarrus, @AI-Scarlett, and
@xyx2002OvO; see Community Contributors below.

loopx --version
loopx doctor
loopx periodic-report inspect-profile --preset weekly --format json
loopx workflow-skills --install
loopx workflow-skills --format json

State Kernel & Control Plane

  • Promoted Todo ownership can atomically acquire its hard lease; omission of
    lease options preserves the old claim-only contract
    (#4032).
  • Canonical authority journal entries now recover Markdown Todo projections
    after commit-before-render failures, without making Markdown authoritative
    (#4038).
  • Completion successor policy moved into the coarse TypeScript transaction,
    while registry/source projection and legacy persistence remain Python
    adapters (#4044).
  • Stage 2C capture and rollback now preserve management locks, cursor lineage,
    full writer fencing, and typed remediation. This qualifies a default-off
    candidate; it does not promote file, NoKV, or PostgreSQL authority
    (#3985).
  • Corrupt lease expirations and invalid boolean/numeric API inputs fail closed,
    while claim-rejection details and event-store freshness are preserved
    (#3993,
    #4000,
    #4013,
    #4020,
    #4035,
    #4036).

Capabilities & Workflows

  • User outcome: an addressed Agent can naturally understand a report
    request and carry it into the governed report pipeline. Shipped layer: a
    manifest-discovered provider adapter validates the exact source and records a
    provider-neutral typed request. Last-mile boundary: the Agent still owns
    semantic interpretation; configured delivery authority and provider readback
    remain separate gates
    (#4001,
    #4037,
    #4040).
  • User outcome: one setup flow can bind multiple Agents and Apps to a Goal
    Channel and resume partial progress. Shipped layer: Lark owns membership,
    mention validation and per-Agent App selection behind typed batch transport.
    Last-mile boundary: group/app permissions and a live message round trip
    still require provider authorization and exact readback
    (#4004,
    #4039,
    #4046).
  • Reward Memory delivery guidance now fails open on irrelevant destinations,
    proves destination matches, and rejects unsatisfiable required references
    without granting send authority
    (#4010,
    #4011,
    #4018,
    #4030,
    #4033).
  • Frozen executables can deliver version-bound workflow skills from the same
    bundle, with no ambient checkout fallback
    (#4063).

Quality & Testing

  • Stage 2C CI now preserves full correctness coverage while running independent
    E2E, installed-package, and mutant lanes in parallel
    (#4064).
  • PR review policy now requires caller-observable semantic parity, executable
    migration evidence, canonical producer evidence, design challenge, and
    approval proof instead of accepting self-referential outputs
    (#4017,
    #4034,
    #4057,
    #4062).
  • Concurrent Todo add/update serialization is now explicitly covered
    (#4048).

Benchmarks & Integrations

  • The experimental external-agent subprocess bridge and benchmark agent-phase
    command were removed. Existing runners should invoke solvers directly; use
    loopx turn plan and loopx turn run-once --execute only when a supported
    host/adapter and independent validator provide governed execution. The
    continuation decision, integrity, study, scoring, and result-file surfaces
    are unchanged
    (#4067).
  • The Workspace now distinguishes absent usage from measured zero, and binds a
    Codex model to the exact snapshot event instead of inferring later context
    (#4016).
  • DSH plugin metadata now names its canonical repository
    (#4047).

No benchmark uplift, scoring change, leaderboard claim, or live-model result is
claimed by this release.

Community Contributors

Documentation & Compatibility

  • Existing Goal state and stable CLI contracts remain compatible. No provider
    promotion or data migration is required.
  • The TypeScript migration RFC now makes compatibility and ownership transfer
    expectations explicit; Stage 2 governed amendment proposals remain opt-in
    and authority-neutral
    (#3976,
    #3883).
  • Desktop diagnostics export only bounded categories, exit status and identity
    booleans—not raw logs, paths, environment variables, credentials, or Goal
    content (#4014).
  • The experimental benchmark bridge migration is documented above and in the
    versioned Benchmark Toolkit guide
    (#4067).

Optional Capability Activation & Use

Agent-authorized periodic reports

Activation: Bind the exact Goal, Agent, App and Goal Channel; after the
Agent semantically decides that one addressed source message requests a report,
record that source with periodic-report request --execute.

Validation: Inspect the weekly profile, preview the exact request, and read
the pending consumer before executing it. A repeat must preserve the same
request and adapter owner.

Disable / rollback: This is a per-source action, not a persistent switch;
stop issuing requests. Disable the effective periodic-report subscription or
pause its host Automation to revoke recurring delivery.

Authority boundary: Source validation does not grant report generation,
network, credential, archive, or sink authority. Delivery still requires an
enabled subscription, exact route/sender binding, provider readiness and
readback.

Docs: https://github.com/huangruiteng/loopx/blob/v1.0.1/loopx/capabilities/periodic_report/README.md

loopx periodic-report inspect-profile --preset weekly --format json
loopx periodic-report request --goal-id "$GOAL_ID" --agent-id "$AGENT_ID" --source-ref "$SOURCE_REF"
loopx periodic-report request --goal-id "$GOAL_ID" --agent-id "$AGENT_ID" --source-ref "$SOURCE_REF" --execute
loopx periodic-report consume-pending --goal-id "$GOAL_ID" --agent-id "$AGENT_ID"

Multi-Agent Goal Channel onboarding

Activation: In Workspace notification settings, choose one compatible Lark
App per registered Agent and save the connection batch for the selected Goal
and group.

Validation: Confirm every Agent/App binding and listener is ready in the
Workspace, then send a new addressed message and drain the exact Goal/Agent
inbox.

Disable / rollback: Choose Disconnect for that Goal connection. This
removes its route without deleting Goal state, sessions, history, Todos, or
other connections.

Authority boundary: Configuration is not provider authorization. The batch
preflights membership and permissions; capture scope and inbox mode do not
grant cross-topic or cross-Agent reply authority.

Docs: https://github.com/huangruiteng/loopx/blob/v1.0.1/docs/guides/personal-workspace-user-guide.md

loopx dashboard
loopx lark-inbox drain --goal-id "$GOAL_ID" --agent-id "$AGENT_ID"

Completed-Todo review cadence

Activation: Preview and then apply a Goal-local completion threshold from
1–5; values 2 or 3 request earlier review.

Validation: Read execution_profile.replan_after_completed_todos back with
the settings inspection command.

Disable / rollback: Set the value to 5 to restore the shipped default.

Authority boundary: The setting only changes when LoopX asks for Goal
review after qualifying completions. It does not schedule a host, spend quota,
change task authority, or bypass writeback/evidence rules.

Docs: https://github.com/huangruiteng/loopx/blob/v1.0.1/docs/quota-allocation.md

loopx configure-goal --goal-id "$GOAL_ID" --execution-replan-after-todos 3
loopx configure-goal --goal-id "$GOAL_ID" --execution-replan-after-todos 3 --execute
loopx configure-goal --goal-id "$GOAL_ID"
loopx configure-goal --goal-id "$GOAL_ID" --execution-replan-after-todos 5 --execute

Frozen-bundle workflow skills

Activation: A distributor builds a frozen executable with the complete
version-pinned share/loopx/skills tree; the operator installs those skills
from that executable.

Validation: Read back the same command without --install; expect
source.kind: frozen_bundle, ready: true, and the bundle's LoopX version.

Disable / rollback: Run workflow-skills --uninstall; to roll back, keep
the previous sidecar and reinstall its matching skills.

Authority boundary: Skill installation changes host command discovery
only. It does not enable schedulers, launch Goals, grant repository/network
writes, or search ambient Python installations when bundled data is missing.

Docs: https://github.com/huangruiteng/loopx/blob/v1.0.1/docs/guides/getting-started.md

loopx-sidecar workflow-skills --install --skills-dir ./host-skills
loopx-sidecar workflow-skills --format json --skills-dir ./host-skills
loopx-sidecar workflow-skills --uninstall --skills-dir ./host-skills

Stage 2C authority shadow management

Activation: Enable the Goal-local file shadow, preview bootstrap, then
execute the exact bootstrap into an empty candidate lineage.

Validation: Inspect source/candidate parity and run bounded qualification;
candidate reads never become a decision source in this stage.

Disable / rollback: Preview and execute rollback with the exact provider
revision from inspect, then clear the Goal-local shadow setting.

Authority boundary: This is a default-off local qualification surface.
File, NoKV and PostgreSQL candidates are not promoted, and local canonical
state remains authoritative.

Docs: https://github.com/huangruiteng/loopx/blob/v1.0.1/examples/shared-goal-authority-e2e/correctness.md

loopx configure-goal --goal-id "$GOAL_ID" --local-authority-shadow-file --execute
loopx coordination-shadow bootstrap --goal-id "$GOAL_ID"
loopx coordination-shadow bootstrap --goal-id "$GOAL_ID" --execute
loopx coordination-shadow inspect --goal-id "$GOAL_ID"
loopx coordination-shadow rollback --goal-id "$GOAL_ID" --provider-revision "$REVISION" --execute
loopx configure-goal --goal-id "$GOAL_ID" --clear-local-authority-shadow --execute

Outbound guidance recall

Activation: Enable the existing Agent-scoped Reward Memory experiment for
outbound_message.before_send, exact destination refs and automatic recall.

Validation: Read experiment status, then preview a Goal/Agent-bound Lark
send with provider preflight and no --execute.

Disable / rollback: Set automatic recall false or clear the Goal's Reward
Memory config and Agent allowlist.

Authority boundary: Recalled guidance is advisory and destination-bound.
It neither authorizes sending nor forwards raw outgoing message content into
the recall query.

Docs: https://github.com/huangruiteng/loopx/blob/v1.0.1/loopx/capabilities/reward_memory/OUTBOUND.md

loopx configure-goal --goal-id "$GOAL_ID" --reward-memory-config "$REWARD_CONFIG" --reward-memory-agent "$AGENT_ID" --execute
loopx reward-memory experiment-status --goal-id "$GOAL_ID" --agent-id "$AGENT_ID"
loopx configure-goal --goal-id "$GOAL_ID" --clear-reward-memory-config --execute

Desktop recovery diagnostics

Activation: Install the signed stable Desktop build and open Recovery &
Updates when startup, runtime repair, or update installation fails.

Validation: Inspect the visible failure category and copyable bounded
diagnostics, then run package/runtime identity checks.

Disable / rollback: Use Restore previous version when a verified backup is
available, or reinstall the prior signed App and its matching runtime; restart
after recovery.

Authority boundary: Diagnostics exclude raw logs, environment variables,
paths, credentials and Goal content. Only explicit native actions install or
restore software.

Docs: https://github.com/huangruiteng/loopx/blob/v1.0.1/docs/guides/personal-workspace-user-guide.md

loopx --version
loopx doctor --deep

Install / Update

New and existing PyPI users use the package-native path:

python3 -m pip install --upgrade loopx
loopx workflow-skills --install
loopx slash-commands --install
loopx doctor

Existing installs can preserve the active pip, pipx, or archive owner:

loopx update check
loopx update plan
loopx update apply
loopx doctor
loopx extension doctor --all-enabled --execute

中文摘要

LoopX 1.0.1 重点修复 1.0 Workspace 的实际运行可靠性：多 Agent Goal Channel
建联可恢复，Agent 周报请求使用 typed intent 而非关键词识别，Desktop 故障可诊断，
更多 Todo 权限变更具备原子性与恢复路径。

  • 在已绑定 Goal Channel 中，用户可以自然地 @ 指定 Agent 请求周报；Agent 负责语义
    判断，LoopX 记录精确来源和 provider-neutral typed request
    (#4001,
    #4037,
    #4040)。
  • 一次选择多个 Agent 及其各自 Lark App，批量建联可在部分失败后安全续跑，并验证
    bot mention、群成员与绑定
    (#4004,
    #4039,
    #4046)。
  • Desktop 恢复页提供受限、可复制的诊断，启动进度和更新 journal 处理更可靠；Goal
    用量只展示真实测量值，不把缺失数据伪装成 0
    (#4014,
    #4016,
    #4021,
    #4022,
    #4027,
    #4031,
    #4041)。
  • Todo claim+lease、Markdown 投影恢复、Stage 2C 管理与 completion policy 形成更完整的
    typed transaction 边界
    (#3985,
    #4032,
    #4038,
    #4044)。
  • frozen host bundle 可交付同版本 workflow skills；Goal 可选择更早的 completed-Todo
    review，默认值仍是 5
    (#4063,
    #4045)。

Replan 修复

  • Vision fallback gap 在 frontier 中保持可见
    (#3979)。
  • post-writeback composition failure 保留来源身份和重试语义
    (#3978,
    #4025)。
  • 短 Todo 链可以配置 1–5 次完成后 review；默认仍为 5
    (#4045)。

升级决策

**谁需要升级：**使用 Goal Channel、周报、Desktop、Goal 用量、Reward Memory、
frozen bundle 或 Stage 2C 验证链路的用户应升级；不受这些路径影响的稳定 CLI 用户
可以按正常维护窗口升级。

**解决了什么：**本版本修复多 Agent 群建联、typed 周报请求、恢复诊断、用量来源、
Todo 权限/投影恢复和 workflow skill 安装一致性等 1.0 后的主要可靠性缺口。

**是否有破坏性变更：**无。受支持的稳定合同和已有 Goal 状态保持兼容。实验性的
loopx benchmark agent-phase 与 benchmark_toolkit.external_agent bridge 已删除；
受影响 runner 需直接调用 solver，或迁移到带受支持 host/adapter 和独立 verifier 的
Turn 合同。已有 result 文件不会被改写，Stage 2C 仍默认关闭。

**如何验证：**升级后版本与 doctor 应报告 1.0.1；weekly report profile 应保持
active/generation-allowed，workflow skill readback 应与当前安装包版本一致。

**贡献者：**本版本由 @huangruiteng 发布，并包含 @now-ing、@wchwawa、@Duang777、
@liubf21、@huashuai、@steven-kid、@KevinBarrus、@AI-Scarlett、@xyx2002OvO 的贡献；
详见下方社区贡献者。

loopx --version
loopx doctor
loopx periodic-report inspect-profile --preset weekly --format json
loopx workflow-skills --install
loopx workflow-skills --format json

状态内核与控制面

  • promoted Todo 可在同一 CAS 中完成 claim+lease；canonical journal 可恢复 Markdown
    兼容投影；completion successor policy 归入粗粒度 TypeScript transaction
    (#4032,
    #4038,
    #4044)。
  • Stage 2C capture/rollback 加入管理锁、完整 cursor lineage、writer fence 与 typed
    remediation；这只是默认关闭的候选验证，不会推广 file/NoKV/PostgreSQL authority
    (#3985)。
  • 损坏的 lease 过期时间、错误 boolean/numeric 输入 fail closed，同时保留 claim 拒绝
    细节和新鲜 event-store 读取
    (#3993,
    #4000,
    #4013,
    #4020,
    #4035,
    #4036)。

能力与工作流

  • **用户结果：**用户可在 Goal Channel 中自然地向 Agent 请求周报。已交付层：
    manifest 动态发现 provider adapter，验证精确 source 后记录 provider-neutral typed
    request。**最后一公里边界：**Agent 仍负责语义判断，交付权限和 provider readback
    仍是独立门禁
    (#4001,
    #4037,
    #4040)。
  • **用户结果：**一次流程可绑定多个 Agent/App 并恢复部分进度。**已交付层：**Lark
    extension 负责成员、mention、App 选择，LoopX 仅传输 typed batch。最后一公里边界：
    群/App 权限和真实消息回环仍需 provider 授权与精确读回
    (#4004,
    #4039,
    #4046)。
  • Reward Memory guidance 对无关目标 fail open、校验 destination match，并拒绝无法满足的
    required refs，但不授予发送权限
    (#4010,
    #4011,
    #4018,
    #4030,
    #4033)。
  • frozen executable 可从自身 bundle 交付版本绑定的 workflow skills，不会回退搜索
    环境中的 checkout (#4063)。

质量与测试

  • Stage 2C 的 E2E、installed-package 和 mutant lane 在不减覆盖的前提下并行
    (#4064)。
  • PR review 要求 caller-observable semantic parity、可执行迁移证据、canonical producer
    证据、设计挑战与 approval proof
    (#4017,
    #4034,
    #4057,
    #4062)。
  • 增加 Todo add/update 并发串行化覆盖
    (#4048)。

基准与集成

  • 删除实验性的 external-agent subprocess bridge 和 benchmark agent-phase。普通 runner
    应直接调用 solver；只有具备受支持 host/adapter 和独立 verifier 时才使用
    turn plan / turn run-once --execute。continuation、integrity、study、scoring 与已有
    result 文件不变
    (#4067)。
  • Workspace 区分“缺失用量”和“真实测得 0”，Codex model 与精确 snapshot event 绑定
    (#4016)。
  • DSH plugin metadata 指向 canonical repository
    (#4047)。

本版本不宣称 benchmark uplift、scoring 变化、leaderboard 结果或 live-model 收益。

社区贡献者

文档与兼容性

  • 现有 Goal state 和稳定 CLI 合同保持兼容，无需 provider promotion 或数据迁移。
  • TypeScript migration RFC 明确 compatibility/owner transfer；Stage 2 amendment proposal
    仍 opt-in 且不增加 authority
    (#3976,
    #3883)。
  • Desktop diagnostics 不包含 raw log、环境变量、路径、凭证或 Goal 内容
    (#4014)。
  • experimental benchmark bridge 的迁移路径已在上文及版本化 Benchmark Toolkit 文档说明
    (#4067)。

可选能力启用与使用

Agent-authorized periodic reports

**启用：**先绑定精确 Goal、Agent、App 与 Goal Channel；Agent 对被 @ 的来源消息做语义
判断后，使用 periodic-report request --execute 记录该来源。

**验证：**检查 weekly profile，preview 精确 request，并在执行前读 pending consumer；
重复请求必须保留同一 request 与 adapter owner。

**停用 / 回退：**这是 per-source action，不是持久开关；停止调用即可。要撤销 recurring
delivery，关闭有效 subscription 或暂停对应 host Automation。

**权限边界：**source validation 不授予 report generation、network、credential、archive
或 sink 权限；交付仍需 enabled subscription、精确 route/sender、provider readiness 和读回。

**文档：**https://github.com/huangruiteng/loopx/blob/v1.0.1/loopx/capabilities/periodic_report/README.md

loopx periodic-report inspect-profile --preset weekly --format json
loopx periodic-report request --goal-id "$GOAL_ID" --agent-id "$AGENT_ID" --source-ref "$SOURCE_REF"
loopx periodic-report request --goal-id "$GOAL_ID" --agent-id "$AGENT_ID" --source-ref "$SOURCE_REF" --execute
loopx periodic-report consume-pending --goal-id "$GOAL_ID" --agent-id "$AGENT_ID"

Multi-Agent Goal Channel onboarding

**启用：**在 Workspace 通知设置中，为每个 registered Agent 选择兼容 Lark App，并保存
所选 Goal/群的 connection batch。

**验证：**在 Workspace 读回全部 Agent/App binding 与 listener readiness，再发送新的
定向消息，并 drain 精确 Goal/Agent inbox。

**停用 / 回退：**对该 Goal connection 选择 Disconnect；不会删除 Goal state、session、
history、Todo 或其他 connection。

**权限边界：**配置不等于 provider 授权；batch 会预检成员与权限，capture scope 和 inbox
mode 不授予跨 topic/Agent 回复权限。

**文档：**https://github.com/huangruiteng/loopx/blob/v1.0.1/docs/guides/personal-workspace-user-guide.md

loopx dashboard
loopx lark-inbox drain --goal-id "$GOAL_ID" --agent-id "$AGENT_ID"

Completed-Todo review cadence

**启用：**preview 后应用 1–5 的 Goal-local completion threshold；2 或 3 会更早触发 review。

**验证：**通过只读 settings inspection 读回
execution_profile.replan_after_completed_todos。

**停用 / 回退：**设为 5，恢复发布默认值。

**权限边界：**只改变 qualifying completion 后何时请求 Goal review；不调度 host、不花费
quota、不改变 task authority，也不绕过 writeback/evidence 规则。

**文档：**https://github.com/huangruiteng/loopx/blob/v1.0.1/docs/quota-allocation.md

loopx configure-goal --goal-id "$GOAL_ID" --execution-replan-after-todos 3
loopx configure-goal --goal-id "$GOAL_ID" --execution-replan-after-todos 3 --execute
loopx configure-goal --goal-id "$GOAL_ID"
loopx configure-goal --goal-id "$GOAL_ID" --execution-replan-after-todos 5 --execute

Frozen-bundle workflow skills

**启用：**distributor 在 frozen executable 中打包完整、版本固定的
share/loopx/skills，operator 从该 executable 安装 skills。

**验证：**不带 --install 再次读回；应看到 source.kind: frozen_bundle、ready: true
和 bundle 的 LoopX 版本。

**停用 / 回退：**运行 workflow-skills --uninstall；回退时保留旧 sidecar，并重装与其
匹配的 skills。

**权限边界：**skill 安装只改变 host command discovery；不会启用 scheduler、启动 Goal、
授予 repository/network 写权限，也不会在 bundled data 缺失时搜索环境中的 Python 安装。

**文档：**https://github.com/huangruiteng/loopx/blob/v1.0.1/docs/guides/getting-started.md

loopx-sidecar workflow-skills --install --skills-dir ./host-skills
loopx-sidecar workflow-skills --format json --skills-dir ./host-skills
loopx-sidecar workflow-skills --uninstall --skills-dir ./host-skills

Stage 2C authority shadow management

**启用：**开启 Goal-local file shadow，preview bootstrap，再向空 candidate lineage 执行
精确 bootstrap。

**验证：**inspect source/candidate parity 并运行 bounded qualification；本阶段 candidate
read 不参与 decision。

**停用 / 回退：**使用 inspect 返回的精确 provider revision preview/execute rollback，
随后 clear Goal-local shadow setting。

**权限边界：**这是默认关闭的本地 qualification；file、NoKV、PostgreSQL candidate 均未
promotion，本地 canonical state 始终权威。

**文档：**https://github.com/huangruiteng/loopx/blob/v1.0.1/examples/shared-goal-authority-e2e/correctness.md

loopx configure-goal --goal-id "$GOAL_ID" --local-authority-shadow-file --execute
loopx coordination-shadow bootstrap --goal-id "$GOAL_ID"
loopx coordination-shadow bootstrap --goal-id "$GOAL_ID" --execute
loopx coordination-shadow inspect --goal-id "$GOAL_ID"
loopx coordination-shadow rollback --goal-id "$GOAL_ID" --provider-revision "$REVISION" --execute
loopx configure-goal --goal-id "$GOAL_ID" --clear-local-authority-shadow --execute

Outbound guidance recall

**启用：**为 outbound_message.before_send、精确 destination refs 和 automatic recall 启用
已有的 Agent-scoped Reward Memory experiment。

**验证：**读 experiment status，再用 provider preflight 且不带 --execute preview 一个
Goal/Agent-bound Lark send。

**停用 / 回退：**关闭 automatic recall，或 clear Goal 的 Reward Memory config 与 Agent
allowlist。

**权限边界：**recall guidance 只是 advisory 且 destination-bound；不授予发送权限，也不把
raw outgoing message 写入 recall query。

**文档：**https://github.com/huangruiteng/loopx/blob/v1.0.1/loopx/capabilities/reward_memory/OUTBOUND.md

loopx configure-goal --goal-id "$GOAL_ID" --reward-memory-config "$REWARD_CONFIG" --reward-memory-agent "$AGENT_ID" --execute
loopx reward-memory experiment-status --goal-id "$GOAL_ID" --agent-id "$AGENT_ID"
loopx configure-goal --goal-id "$GOAL_ID" --clear-reward-memory-config --execute

Desktop recovery diagnostics

**启用：**安装 signed stable Desktop build；发生 startup、runtime repair 或 update installation
失败时打开 Recovery & Updates。

**验证：**检查可见 failure category 和可复制的 bounded diagnostics，再运行 package/runtime
identity check。

**停用 / 回退：**有 verified backup 时选择 Restore previous version，或重装上一版 signed
App 与其 matching runtime；恢复后重启。

**权限边界：**诊断不包含 raw log、环境变量、路径、凭证或 Goal 内容；只有显式 native
action 可以安装或恢复软件。

**文档：**https://github.com/huangruiteng/loopx/blob/v1.0.1/docs/guides/personal-workspace-user-guide.md

loopx --version
loopx doctor --deep

发布验证

The exact release source is commit 7f2a020b18d1b5bb00da4044403ae72ddce2d743
with tree db6436c9ab3b5908844a128fe2a7201ec369da3d, package version
1.0.1, and expected tag v1.0.1. Its exact-source qualification is ready for
owner release: change-quality receipt cqr_5ca6f323681e60aed501, premerge
10/10, Linux pytest 6,640 passed / 31 skipped across two shards, native Windows
CI passed, all Stage 2C lanes passed, public smoke fleet 512/512, real Doubao
qualification 21 scenarios × 2 repeats with 6/6 contrasts, install/upgrade/host
validation passed, and the public/private boundary scan found zero violations.

Native Windows frozen execution was validated by repository CI and the Windows
desktop release lane rather than on this macOS host. All three exact-tag release
workflows completed successfully: Python artifacts were built, attested,
uploaded, and published through PyPI Trusted Publishing; macOS and Windows
desktop artifacts were rebuilt and verified; and the signed desktop update
manifest was published. An independent clean environment installed
loopx==1.0.1 from PyPI and read back distribution/runtime version 1.0.1.
The stable branch was then fast-forwarded to the exact tagged candidate. This
full body was read back from GitHub and revalidated against the bilingual
capability-usage and public/private-boundary gates.

Contributors

huashuai, huangruiteng, and 8 other contributors
Assets 13
Loading