LoopX 1.0.2 — single-owner Todo authority, automatic recovery, and faster workspaces

LoopX 1.0.2 — single-owner Todo authority, automatic recovery, and faster workspaces

At a Glance

LoopX 1.0.2 completes a major authority-boundary step after 1.0: promoted Todo
lifecycle decisions now have one TypeScript business owner, missing generated
Todo displays recover automatically without making Markdown authoritative, and
large workspaces spend less time rescanning history.

Upgrade

loopx update check
loopx update plan
loopx update apply
loopx --version
loopx doctor --deep

Highlights

• Complete, supersede, and archive promoted Todos through one provider
  transaction that also settles successor, lease, and receipt state. Python
  remains an adapter instead of deriving a second set of terminal rules
  (#4053,
  #4068,
  #4113).
• Reconstruct missing generated Todo sections for promoted Goals during normal
  projection delivery while preserving the Goal narrative and the canonical
  provider as authority (#4097).
• Preserve causal wait work before Todo compaction and stop broad guards from
  blocking legitimate agent writeback or hiding typed fence failures
  (#4059,
  #4079,
  #4084).
• Bound global recent-run reads and avoid redundant transcript scans. The
  isolated large-history checks measured roughly 2.6× faster recent-run
  aggregation with about 94% less peak memory, and roughly 40× faster
  generated-id chat append on a 10,000-message fixture
  (#4092,
  #4099).
• Make host recovery clearer with Desktop readiness diagnostics, stable DSH
  lineage identities, profile-neutral turn guidance, and version-aware
  workflow-skill readback
  (#4066,
  #4073,
  #4078,
  #4080,
  #4086).

Release Decision

Who should upgrade: Operators of promoted Goals, long-running workspaces,
Desktop or DSH hosts, managed workflow skills, PR review automation, or the
benchmark toolkit should upgrade now. Stable small CLI-only workspaces may use
their normal maintenance window.

What this release solves: It removes duplicate Python/TypeScript Todo
lifecycle decisions, repairs missing promoted Todo displays, preserves causal
waits through compaction, improves recovery diagnostics, and bounds hot reads
over large histories.

Breaking changes: No. Existing Goal state and supported CLI contracts stay
compatible. Promoted Goals may now recreate missing generated Todo sections;
unpromoted Goals remain unchanged. No provider is promoted by default, and no
new daemon, database, or migration is introduced.

How to verify: Upgrade the package and managed host material, then confirm
version 1.0.2, deep runtime readiness, and the relevant Goal or workflow-skill
readback.

Contributors: Prepared by @huangruiteng with @vlean, @Duang777,
@xyx2002OvO, @cocolord, @liubf21, @now-ing, and @cweiai; see Community
Contributors below.

loopx --version
loopx doctor --deep
loopx workflow-skills --install
loopx workflow-skills --format json

State Kernel & Control Plane

• Promoted Todo completion, supersession, archive, successor derivation,
  lease handling, and receipt publication now commit through one
  TypeScript-owned provider transaction. Stable operation replay, changed
  intent, duplicate create rejection, crash recovery, and domain rejection
  remain distinct typed outcomes
  (#4053).
• Todo lifecycle admission and terminal fences now share the same TypeScript
  owner across public entry points. The migration keeps provider selection,
  promotion, CAS, and receipt semantics unchanged while deleting duplicate
  Python decisions (#4113).
• The coarse completion transaction was restored for the remaining legacy
  path, and canonical Todo/RFC descriptions were aligned with the shipped
  boundary (#4068,
  #4093,
  #4119).
• Boolean-looking append sequences and ambiguous spawn-authority values now
  fail closed instead of being coerced into a different meaning
  (#4050,
  #4089).

Capabilities & Workflows

• Promoted Goals automatically rebuild missing generated Todo sections during
  successful projection delivery. Recovery is limited to Todo sections,
  preserves narrative text, and never falls back to Markdown authority
  (#4097).
• Causal wait coverage is derived from the shared Vision read model before
  completed Todo compaction, so actionable successor work stays visible to
  quota, projection, and semantic writeback
  (#4059).
• Workflow-skill installation records the packaged revision and reports stale
  or mismatched host material; PR review results bind the exact installed
  policy revision and require rule-ownership evidence for retained or migrated
  findings (#4086,
  #4065).
• Benchmark monitors can preserve a private, provisional
  benchmark_case_observation_v0 with provider-neutral traceability while a
  case is active. It never invents a score and remains separate from the final
  scored insight (#4070).

Quality & Testing

• Stage 2C end-to-end tests now run with four file-distributed workers; the
  measured suite was about 38% faster while retaining process-level coverage
  (#4053).
• The Todo authority refactor was compared against an 8,680-decision
  production-derived snapshot with zero behavior differences, plus real
  PostgreSQL, file-provider, baseline, mutation, crash, retry, and split-root
  coverage (#4053,
  #4113).
• Stage 2C test modules no longer collide under concurrent collection, and
  Sonar guard assertions now prove the intended semantics instead of matching
  incidental syntax (#4096,
  #4098).
• Safe checkpoint recovery now applies on the first refresh instead of waiting
  for a second read (#4052).

Benchmarks & Integrations

• Generated-id chat append skips redundant full-transcript scans while
  explicit idempotency keys retain replay deduplication
  (#4092).
• Global recent-run merge reads only the requested window while preserving
  total counts, per-Goal counts, and stable ordering
  (#4099).
• DSH turn identities now derive from stable Goal/Agent/Todo lineage rather
  than mutable display values, and Desktop surfaces distinguish readiness
  errors from a hung service
  (#4066,
  #4073,
  #4078).
• Chat serving defaults are consistent across supported entry points
  (#4060).

Documentation & Compatibility

• The single-owner loop daemon proposal and bounded computer-use proposal are
  recorded as RFCs without silently enabling either runtime
  (#4054,
  #4115).
• Public documentation now distinguishes canonical Todo authority from display
  recovery and links restrained benchmark evidence from the README
  (#4093,
  #4119,
  #4120).
• Ordinary use of the word “authorization” no longer looks like a credential,
  and generic CLI turn guidance no longer instructs unsupported hosts to use a
  Codex App-only flag (#4079,
  #4080).

Community Contributors

• @vlean — first contributions: repaired broad
  writeback/public-safety guards and made turn-start guidance host-neutral
  (#4079,
  #4080).
• @Duang777 — stricter append/spawn values,
  preserved monitor fence errors, and bounded chat/recent-run hot paths
  (#4050,
  #4084,
  #4089,
  #4092,
  #4099).
• @xyx2002OvO — first-refresh checkpoint
  recovery, the single-owner loop daemon RFC, and Desktop status readiness
  (#4052,
  #4054,
  #4078).
• @cocolord — causal wait coverage before Todo
  compaction (#4059).
• @liubf21 — stable DSH session lineage identity
  (#4066).
• @now-ing — actionable Desktop bootstrap failure
  reporting (#4073).
• @cweiai — first contribution: version-bound
  workflow-skill installation and mismatch detection
  (#4086).

Optional Capability Activation & Use

Promoted Todo lifecycle

Activation: There is no new 1.0.2 toggle. The transaction applies only to a
Goal already promoted through the separately reviewed canonical-authority
procedure. coordination-shadow bootstrap remains pre-promotion qualification;
it does not promote a provider.

Validation: Read the Goal and Todo projections from the active authority and
confirm the provider/mode reported for that Goal.

Disable / rollback: Before promotion, preview and then execute a
revision-fenced candidate rollback. After promotion, do not bypass the writer
fence or use the pre-promotion rollback; use the provider's reviewed
export/downgrade procedure. There is no per-command Python fallback.

Authority boundary: The selected canonical provider owns Todo state. Python
adapts CLI/host context and Markdown remains a display; neither may derive a
second terminal decision.

Docs: Shared Goal Authority RFC at v1.0.2.

GOAL_ID=<goal-id>
loopx --format json status --goal-id "$GOAL_ID"
loopx --format json todo list --goal-id "$GOAL_ID"
loopx --format json coordination-shadow rollback \
  --goal-id "$GOAL_ID" --provider-revision <exact-revision>

Versioned workflow skills

Activation: Refresh the packaged managed skills after upgrading LoopX.

Validation: Inspect the recorded source and installed revision; ready=true
must refer to the current Python distribution.

Disable / rollback: Remove only unchanged LoopX-managed workflow skills with
the uninstall command, or reinstall the previous trusted LoopX package and run
its installer. Modified user files are preserved.

Authority boundary: Skill installation writes host instruction material
only. It does not modify project Goal state or grant repository, network,
credential, or merge authority.

Docs: Installing LoopX at v1.0.2.

loopx workflow-skills --install
loopx workflow-skills --format json
loopx workflow-skills --uninstall --dry-run

Revision-bound PR review

Activation: Install the loopx-pr-review project skill explicitly for each
host surface that should use it.

Validation: Read back the managed copy and require the installed source and
policy revision to match the current package/project declaration.

Disable / rollback: Preview, then execute project-skill uninstall for the
same project, skill, and host surface. This removes only the managed copy.

Authority boundary: The workflow produces review evidence and a decision;
it grants no merge, push, provider, or cross-Agent authority. A stale or missing
policy revision cannot certify approval.

Docs: PR review capability at v1.0.2.

loopx project-skill install --project . --skill loopx-pr-review \
  --surface codex --execute
loopx project-skill status --project . --skill loopx-pr-review \
  --surface codex --format json
loopx project-skill uninstall --project . --skill loopx-pr-review \
  --surface codex

Traceable benchmark observations

Activation: A benchmark monitor may explicitly emit the optional
benchmark_case_observation_v0 private artifact after a bounded active-runtime
readback. Core does not create it automatically.

Validation: Require a healthy exact-job receipt and live owner before using
the provisional observation, then check the artifact against the documented
schema and private/public boundary.

Disable / rollback: Stop emitting the provisional observation; no canonical
score, slot, or runner state needs migration. A project-local benchmark skill
can be preview-uninstalled independently.

Authority boundary: The artifact is provisional and private. It cannot
score, launch, stop, retry, reconcile, or release a benchmark run, and public
projections must omit raw trace, span, URL, path, and provider-session data.

Docs: Benchmark toolkit at v1.0.2.

loopx benchmark runtime-observation --admission-active \
  --job-receipt-state resolved --runner-owner-state alive \
  --require-healthy --format json
loopx project-skill uninstall --project . --skill loopx-benchmark \
  --surface codex

Desktop readiness diagnostics

Activation: Start the existing local dashboard/Chat surface; 1.0.2 adds no
remote endpoint or background-service opt-in.

Validation: Run the deep doctor probe and require the managed TypeScript
runtime readiness/lifecycle projection to be healthy before trusting the UI.

Disable / rollback: Stop the foreground dashboard process. To roll back the
diagnostic behavior, reinstall the previous trusted LoopX package and refresh
host material; project state is not deleted.

Authority boundary: Readiness diagnostics report local runtime health and
public-safe error codes. They do not mutate Goals, Todos, credentials, external
systems, or provider authority.

Docs: Install and runtime diagnostics at v1.0.2.

loopx doctor --deep
loopx dashboard --no-open

Install / Update

Python 3.11+ and Node.js 22.6+ are required.

python3 -m pip install --upgrade loopx==1.0.2
loopx workflow-skills --install
loopx doctor --deep
loopx --version

For pipx, use pipx upgrade loopx, then refresh workflow skills and run the
same doctor/version readback. Source and archive installations should follow
their existing trusted-owner update path; do not mix installation owners.

Validation

The exact release commit is qualified independently from mutable main before
the tag moves. Release automation rebuilds wheel and source distribution,
checks metadata and checksums, installs the wheel in a clean environment,
validates the managed TypeScript runtime and workflow-skill lifecycle, uploads
attested artifacts, and verifies PyPI when publishing is enabled.

中文摘要

LoopX 1.0.2 完成了 1.0 之后一轮关键的权限边界收敛：promoted Todo 的生命周期判断
由 TypeScript 单一业务 owner 负责；缺失的 Todo 展示可自动恢复，但 Markdown 不会变成
authority；长历史与长聊天的热路径也显著减负。

升级决策

**谁需要升级：**使用 promoted Goal、长周期 Workspace、Desktop 或 DSH 宿主、托管
workflow skill、PR review 自动化或 benchmark toolkit 的 operator 建议立即升级；仅使用
小型稳定 CLI Workspace 的用户可按常规维护窗口升级。

**解决了什么：**本版本删除了 Python 与 TypeScript 两套 Todo 生命周期判断，恢复缺失的
promoted Todo 展示，避免因压缩丢失 causal wait，增强宿主恢复诊断，并限制大历史热读范围。

**是否有破坏性变更：**无。已有 Goal 状态与受支持 CLI 合约保持兼容。promoted Goal
现在可能自动重建缺失的生成 Todo 段落；未 promoted Goal 不变。没有 provider 被默认
promote，也没有新增 daemon、数据库或迁移。

**如何验证：**升级 package 与托管宿主材料后，确认版本为 1.0.2、deep doctor 就绪，
并读回相应 Goal 或 workflow skill 状态。

**贡献者：**本版本由 @huangruiteng 与 @vlean、@Duang777、@xyx2002OvO、
@cocolord、@liubf21、@now-ing、@cweiai 共同完成；详见下方社区贡献者。

loopx --version
loopx doctor --deep
loopx workflow-skills --install
loopx workflow-skills --format json

状态内核与控制平面

• promoted Todo 的 complete、supersede、archive、successor、lease 与 receipt 由同一个
  TypeScript provider transaction 提交；Python 只保留外部上下文与兼容适配
  (#4053,
  #4068,
  #4113)。
• Todo admission 与 terminal fence 已收敛到同一 owner，provider selection、promotion、
  CAS 与 receipt 语义不变；布尔 append/spawn authority 的歧义输入改为 fail closed
  (#4050,
  #4089,
  #4093)。

能力与工作流

• promoted Goal 在正常投影投递时自动恢复缺失的生成 Todo 段落，只恢复 Todo、保留叙事，
  且绝不回退到 Markdown authority
  (#4097)。
• causal wait 在 completed Todo 压缩前从共享 Vision read model 推导，继续对 quota、投影与
  semantic writeback 可见 (#4059)。
• workflow skill 安装记录 package revision，PR review 结果绑定精确 policy revision；
  benchmark monitor 可保存私有 provisional observation，但不能冒充最终得分 insight
  (#4086,
  #4065,
  #4070)。

质量与测试

• Stage 2C 真实子进程测试改为 4 个按文件分发的 worker，实测约快 38%；同时保留 crash、
  retry、split-root、mutation 与真实 PostgreSQL 覆盖
  (#4053)。
• Todo authority 重构使用 8,680 个 production-derived decision 做差分，结果零差异，并通过
  baseline、file-provider、PostgreSQL 三臂验证
  (#4113)。
• 并行 Stage 2C module collision 与 Sonar 断言语义缺口已修复
  (#4096,
  #4098)。

Benchmark 与集成

• 10,000 条消息 fixture 上，generated-id chat append 的隔离基准约快 40×；全局 recent-run
  merge 在 100×1,000 synthetic runs 上约快 2.6×，峰值内存约下降 94%
  (#4092,
  #4099)。
• DSH turn identity 改为稳定 Goal/Agent/Todo lineage；Desktop 能区分可诊断启动失败与服务
  卡死 (#4066,
  #4073,
  #4078)。

文档与兼容性

• single-owner loop daemon 与 bounded computer-use 以 RFC 形式沉淀，均未静默启用
  (#4054,
  #4115)。
• 文档明确区分 canonical Todo authority 与 display recovery，并更新公共 benchmark 证据入口
  (#4093,
  #4119,
  #4120)。

社区贡献者

• @vlean — 首次贡献：修复过宽的 writeback/public-safety guard，
  并让 turn-start 指引兼容不同宿主
  (#4079,
  #4080)。
• @Duang777 — 严格化 append/spawn 输入，保留 monitor fence
  错误，并限制 chat/recent-run 热路径
  (#4050,
  #4084,
  #4089,
  #4092,
  #4099)。
• @xyx2002OvO — 首次 refresh checkpoint recovery、
  single-owner loop daemon RFC 与 Desktop status readiness
  (#4052,
  #4054,
  #4078)。
• @cocolord — Todo 压缩前的 causal wait coverage
  (#4059)。
• @liubf21 — 稳定 DSH session lineage identity
  (#4066)。
• @now-ing — 可操作的 Desktop bootstrap failure reporting
  (#4073)。
• @cweiai — 首次贡献：version-bound workflow skill 安装与
  mismatch detection (#4086)。

可选能力启用与使用

Promoted Todo lifecycle

**启用：**1.0.2 没有新增开关。该 transaction 只适用于已通过独立评审流程 promoted 的
Goal；coordination-shadow bootstrap 仍只是 promotion 前资格验证，不会 promote provider。

**验证：**从 active authority 读回 Goal 与 Todo 投影，确认该 Goal 的 provider/mode。

**停用 / 回退：**promotion 前，先预览再执行绑定精确 revision 的 candidate rollback；
promotion 后不得绕过 writer fence 或使用 promotion 前 rollback，须走 provider 已评审的
export/downgrade 流程。不存在逐命令 Python fallback。

**权限边界：**选中的 canonical provider 拥有 Todo 状态；Python 只适配 CLI/宿主上下文，
Markdown 只是展示，两者都不能推导第二份 terminal decision。

文档：v1.0.2 Shared Goal Authority RFC。

GOAL_ID=<goal-id>
loopx --format json status --goal-id "$GOAL_ID"
loopx --format json todo list --goal-id "$GOAL_ID"
loopx --format json coordination-shadow rollback \
  --goal-id "$GOAL_ID" --provider-revision <exact-revision>

Versioned workflow skills

**启用：**升级 LoopX 后刷新 packaged managed skills。

**验证：**读回 source 与 installed revision；ready=true 必须对应当前 Python distribution。

**停用 / 回退：**用 uninstall 只移除未被用户修改的 LoopX-managed workflow skills；或重装
上一个可信 LoopX package 并运行其 installer。用户修改过的文件会保留。

**权限边界：**skill 安装只写宿主 instruction material，不修改项目 Goal 状态，也不授予
repository、network、credential 或 merge authority。

文档：v1.0.2 安装指南。

loopx workflow-skills --install
loopx workflow-skills --format json
loopx workflow-skills --uninstall --dry-run

Revision-bound PR review

**启用：**为每个需要使用该能力的 host surface 显式安装 loopx-pr-review project skill。

**验证：**读回 managed copy，要求 installed source 与 policy revision 匹配当前
package/project declaration。

**停用 / 回退：**对相同 project、skill 与 host surface 先预览、再执行 project-skill
uninstall；只移除 managed copy。

**权限边界：**workflow 只产生 review evidence 与 decision，不授予 merge、push、provider
或跨 Agent 权限。stale/missing policy revision 不能证明 APPROVE。

文档：v1.0.2 PR review capability。

loopx project-skill install --project . --skill loopx-pr-review \
  --surface codex --execute
loopx project-skill status --project . --skill loopx-pr-review \
  --surface codex --format json
loopx project-skill uninstall --project . --skill loopx-pr-review \
  --surface codex

Traceable benchmark observations

**启用：**benchmark monitor 在有界 active-runtime readback 后，可显式写入可选的私有
benchmark_case_observation_v0；core 不会自动创建。

**验证：**使用 provisional observation 前，要求 exact-job receipt 已解析且 owner 存活，
再按文档 schema 与私有/公共边界检查 artifact。

**停用 / 回退：**停止产出 provisional observation 即可；canonical score、slot 与 runner
state 无需迁移。project-local benchmark skill 可独立预览卸载。

**权限边界：**artifact 是 provisional 且私有的，不能 score、launch、stop、retry、
reconcile 或 release benchmark run；公共投影不得包含 raw trace、span、URL、path 或
provider session 数据。

文档：v1.0.2 Benchmark toolkit。

loopx benchmark runtime-observation --admission-active \
  --job-receipt-state resolved --runner-owner-state alive \
  --require-healthy --format json
loopx project-skill uninstall --project . --skill loopx-benchmark \
  --surface codex

Desktop readiness diagnostics

**启用：**启动已有本地 dashboard/Chat surface；1.0.2 不新增远程 endpoint 或后台服务开关。

**验证：**运行 deep doctor probe，在信任 UI 前确认 managed TypeScript runtime 的
readiness/lifecycle 投影健康。

**停用 / 回退：**停止前台 dashboard process。若需回退诊断行为，重装上一可信 LoopX
package 并刷新 host material；不会删除项目状态。

**权限边界：**readiness diagnostics 只报告本地 runtime 健康度与 public-safe error code，
不修改 Goal、Todo、credential、外部系统或 provider authority。

文档：v1.0.2 安装与 runtime 诊断。

loopx doctor --deep
loopx dashboard --no-open

安装 / 更新

需要 Python 3.11+ 与 Node.js 22.6+。

python3 -m pip install --upgrade loopx==1.0.2
loopx workflow-skills --install
loopx doctor --deep
loopx --version

pipx 用户先运行 pipx upgrade loopx，再刷新 workflow skills 并执行同样的
doctor/version 读回。source 与 archive 安装沿用各自可信 owner 的升级路径，不要混用安装
owner。

发布验证

tag 移动前，会针对不可变的精确 release commit 做独立资格验证，而不是依赖可变 main。
发布自动化会重建 wheel/sdist、检查 metadata 与 checksum、在干净环境安装 wheel、验证
managed TypeScript runtime 与 workflow-skill 生命周期、上传带 attestations 的 artifacts，
并在启用 PyPI 发布时从 PyPI 回读验证。