Skip to content

LoopX 1.4.0 — Evidence, continuity and semantic control

Latest
Latest

Choose a tag to compare

View all tags
@loopx-agent loopx-agent released this 11 Oct 14:47
· 104 commits to main since this release
v1.4.0
1b452b0
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

LoopX v1.4.0 — Evidence, continuity and semantic control

Release source: 1b452b00a114bd9f0d9c24868c9f45df42661748 (tree d9e4ff7e573c1cca63fb536e0c60ad0a54f89997). Exact-source qualification passed. The public tag archive and source stable installation are verified at this commit. PyPI and desktop publication are waiting for GitHub-hosted runners; desktop-stable remains on 1.3.1.

1.4.0 connects original Goal acceptance, accumulated evidence and the next action more reliably. The shipped changes cover native Chat/Lark continuity, canonical typed work state, reviewed SQLite recovery and evidence-backed work-Turn review. The latest long-horizon study provides observed system-level progress and counterexamples; it is not a paired 1.3.1→1.4.0 score certificate or attribution of all gains to one model.

Release Decision

Who should upgrade: Core developers and users affected by long-running Chat recovery, stale work/lease decisions, evidence reuse or storage recovery; validate the supported profile before extending a SQLite trial.

What this release solves: Keeps original operations and source-bound results intact across continuation, recovery, review and canonical state reads.

Breaking changes: Yes. New unconfigured Goals now create canonical SQLite/hard_lease; existing Goals and explicit v0/v1 opt-out keep their route. Product and benchmark implicit review cadence is six settled work Turns; explicit legacy Todo-unit overrides retain their unit. Both local providers require Node 22.22.3 or newer; SQLite additionally validates the embedded fixed runtime. No automatic existing-Goal migration; package rollback does not roll back data.

How to verify: Inspect named version, installed provenance, managed runtime identity and the current Goal head. For an unconfigured disposable new Goal expect canonical SQLite and authority_initialized=true.

loopx --version
loopx doctor
loopx machine-config inspect
loopx todo list --goal-id "$GOAL_ID"

Contributors: @LIHUA919, @JasonBuildAI and eight other community contributors, including a first-time release contributor, plus the project agent are credited from the exact previous-tag range and merged PR metadata below.

State Kernel & Control Plane

  • Canonical typed Todo, dependency, handoff and completion read models retire redundant legacy writer crossings; original fences, leases, scopes and replay identities remain authoritative.
  • New Goals inherit canonical SQLite/hard_lease. Reviewed existing-Goal migration, cold-source import, backup and reverse migration preserve original receipts and later writes. Implementation is shipped; sustained D2 qualification remains separately open.
  • Quota/scheduler freshness, stopped-Goal admission, bounded monitor failure closeout and six settled work-Turn review separate useful work from polling. Receipt-bound terminal recovery rejects historical replay; in-flight CLI settlement now receives only the guidance for its projected command. Material closeout and MCP still require their full Vision evidence. Review calls still need original acceptance and evidence; a counter is not progress.

Capabilities & Workflows

  • Native Chat creation and queued Turn recovery retain original Session identity; private Lark replies/files return to the verified original audience. Binding revocation stops work and answer rendering preserves substantive streamed output.
  • Explore ordinary-work capture supplies scope-bound results to actual continuation; acceptance-bound progress review rejects stale criterion/result binding. Content reference outlines retain attribution, caveats and caller facts.
  • Reward Memory/repository-experience consumption retains scoped original evidence. Periodic report intent and stopped/disabled-subscription recovery preserve source and audience boundaries. Finance cumulative-flow assessments retain source periods and partial-coverage uncertainty; no transaction authority is added.

Benchmarks, Models & Quality

  • Long-horizon Portfolio and Lean studies retain frozen attempts, runner/model settings, observed improvements and unresolved slowdown/zero counterexamples. Task-owned budgets and bounded official feedback improve execution reliability; this release launches no benchmark jobs.
  • Astra-assisted semantic control development and typed owner convergence improve evidence, settlement and continuation contracts. Observed gains include model, prompt, runner and LoopX changes; no isolated causal model uplift is claimed.
  • Packaging provenance, UTF-8 host entrypoints and Windows/private-path handling improve diagnosis and recovery. Current exact-source tests and installed artifacts remain required before promotion.

Community Contributors

External community contributions are highlighted here; the project agent is credited separately. The links name representative merged work from the exact release range.

Compatibility & Validation

At frozen source 1b452b00a, all 515 full-public smokes passed without skips, timeouts or tracked side effects; 360 affected Python regression checks passed with no failures or skips. Ruff, mypy, control-plane TypeScript, production frontend and wheel builds passed with unchanged, clean source observation. The parent full Python run reported 20,735 passes, six failures and 335 skips; those six demonstrated failures were repaired and revalidated on this source. This is not a claim of a fresh full-tree Python sweep on the final commit. A real PyPI 1.3.1-to-candidate upgrade preserved original persisted Todo fields and registry routing. Installed UI preview/apply/removal restored the new-Goal SQLite/hard_lease default; a read-only Chat query returned through its original conversation with provider unavailability visible. Isolated managed DSH skill installation, readback and removal passed; authenticated interactive Host execution was not tested. Deep doctor succeeded with retained Host-material warnings. The 19 risk-selected and five direct checks passed; a separate owner-authorized benchmark review resolved the review obligation while retaining the raw automatic hold. Offline benchmark checks had 132 passes and 244 skips; external Docker/Harbor/SForge/PostgreSQL/NoKV execution and sustained SQLite D2 remain unqualified. The owner-authorized DS V4.1 Flash/high portfolio passed all 22 scenarios twice and all six contrasts: 44 logical actor calls, zero failures and zero skips. All 93 HTTP attempts are counted separately, including two bounded retries of incomplete pure model responses before any tool was decoded or executed. The canonical catalog, prompts, action limits and oracles were unchanged. Earlier Doubao evolving/high qualification had three failed scenarios and remains unqualified; its failure receipts are retained. A subsequent qualification-reader improvement is outside this frozen release range. The actual public v1.4.0 tag archive and source stable installs passed version, doctor and runtime-active readback at the frozen commit. Source stable is promoted to 1.4.0. PyPI and desktop workflows remain queued for hosted runners, with no public artifact readback yet; desktop-stable remains on 1.3.1.

Install / Update

Wait until the named package is available; follow the original installation owner. Existing installations keep their installation owner; restart their agent host after refreshing managed host material.

loopx update check
loopx update plan
loopx update apply
loopx doctor
loopx extension doctor --all-enabled --execute
  # Explicit PyPI package acquisition after publication:
python -m pip install --upgrade loopx==1.4.0

Optional Capability Activation & Use

Use an existing registered GOAL_ID where shown; only the disposable bootstrap example creates a new Goal. Commands referencing packages/ or benchmark/ run from the named versioned source checkout.

New Goal SQLite defaults

Activation: An unconfigured device creates new Goals with canonical SQLite and hard_lease. In Settings → Capability center → This device default → New Goal authority storage, explicitly choose canonical_creation, provider and supported handoff mode; preview and apply the current revision. Existing v0 preferences and explicit v1 opt-out remain effective.

Validation: Inspect machine configuration, create a disposable Goal with bootstrap, and require authority_initialized=true and authority_read.source_authority=sqlite_v0 on Todo readback.

Disable / rollback: For future creation, preview/apply a v1 goal_storage document with canonical_creation=false; remove is not opt-out and restores the SQLite default. Existing Goals retain their recorded storage.

Authority boundary: Storage selection grants no Host, lease, scheduler, repository, account or network permission. It does not migrate existing Goals.

loopx machine-config inspect
loopx doctor
mkdir -p sqlite-trial
loopx --format json bootstrap --project ./sqlite-trial --goal-id sqlite-trial --objective "Verify SQLite default" --dry-run
  # After reviewing the dry run, create a disposable project/Goal:
loopx --format json bootstrap --project ./sqlite-trial --goal-id sqlite-trial --objective "Verify SQLite default"
loopx --format json todo list --goal-id sqlite-trial

Docs: Versioned guide

Reviewed existing Goal migration

Activation: For an existing canonical Goal, use Goal → Settings → Goal data storage; stop writers, settle leases, take a verified complete backup, review the File/SQLite migration preview and explicitly apply that original plan. Cold Markdown sources use the separately reviewed import route.

Validation: Read the original operation receipt and the current Todo head after restart; retain new writes and verify a stale preview is rejected.

Disable / rollback: Review a reverse migration from the current SQLite head to File, preserving writes made during the trial. Restore a complete verified backup only through its recovery owner; do not delete the selector or database to obtain fallback.

Authority boundary: Migration retains the original authority and execution policy. It grants no permission to run jobs, repeat external effects, adopt a source or migrate another Goal.

loopx doctor
  # GOAL_ID is the existing Goal selected in the storage editor.
loopx todo list --goal-id "$GOAL_ID"
loopx configure-goal --goal-id "$GOAL_ID"

Docs: Versioned guide

Native workspace Chat and original Turn recovery

Activation: Start Chat with the explicit workspace_read grant; select an already authenticated Codex profile in the existing Chat provider picker. Enable LoopX mode only after configuring the Goal budget and authorizing its work. Retry original creation/Turn operations from their retained card.

Validation: Read a response in the selected workspace and inspect the retained original Session/Turn. Missing upstream resume remains a visible failure, not successful first-Turn execution.

Disable / rollback: Stop the active Turn and disable LoopX mode in the same Goal editor; stop the owned Chat service through its lifecycle. Preserve the original Session when investigating recovery.

Authority boundary: Workspace isolation does not import personal MCP tools, browser cookies or account history; provider authentication does not authorize external publication, migration or additional tools.

loopx chat --project-workspace-grant workspace_read --no-open
loopx doctor

Docs: Versioned guide

Explore evidence in ordinary work

Activation: Explicitly select evidence or planning for the existing Goal. Attach explore_result to admitted work settlement or use the ordinary capture route; planning/harness settings remain separately explicit.

Validation: Read Explore summary and the next Turn context; verify that source scope and result lineage belong to the current Goal and accepted work.

Disable / rollback: Set explore-mode off. Existing recorded evidence remains readable; disabling capture does not erase it or revert completed work.

Authority boundary: Capture and planning do not launch workers, authorize tools or certify a result. Private sources stay private; causal reuse needs bound evidence.

loopx configure-goal --goal-id "$GOAL_ID" --explore-mode evidence --execute
loopx explore summary --goal-id "$GOAL_ID"
loopx configure-goal --goal-id "$GOAL_ID" --explore-mode off --execute

Docs: Versioned guide

Six settled work Turn review cadence

Activation: Unconfigured product and benchmark lanes inherit six settled effective work Turns. Explicit legacy Todo-unit overrides retain their unit; set execution-replan-after-turns only for a reviewed Goal override.

Validation: Inspect the effective Goal configuration and original settlement facts; monitor-only polls, duplicate submissions and unsettled attempts do not advance this counter.

Disable / rollback: Clear execution-replan-after-turns to restore machine/default inheritance. Preserve explicit legacy settings unless intentionally changing their unit; there is no switch that disables all Goal acceptance obligations.

Authority boundary: A cadence trigger requires review, not a particular route change, extra quota or permission. It cannot replace human gates or declare Goal completion.

loopx configure-goal --goal-id "$GOAL_ID"
loopx configure-goal --goal-id "$GOAL_ID" --execution-replan-after-turns 6 --execute
loopx configure-goal --goal-id "$GOAL_ID" --clear-execution-replan-after-turns --execute

Docs: Versioned guide

Acceptance-bound progress review

Activation: Use the existing progress-review editor or configure-goal to opt into shadow; assist requires its qualified contract revision. Review actions must bind the original Goal, criterion and exact observed result.

Validation: Read configure-goal and the Goal review card; invalid criterion or stale result binding stays rejected. A model opinion is not accepted evidence.

Disable / rollback: Clear progress-review-configuration to return to off. Retain original receipts; do not reinterpret a failed or unavailable review as passed.

Authority boundary: The sentinel does not grant execution, alter acceptance criteria or permit publication. Shadow observes; assist remains within the admitted contract.

loopx configure-goal --goal-id "$GOAL_ID" --progress-review-mode shadow --execute
loopx configure-goal --goal-id "$GOAL_ID"
loopx configure-goal --goal-id "$GOAL_ID" --clear-progress-review-configuration --execute

Docs: Versioned guide

Content reference outlines

Activation: Open the existing Content Ops reference workbench or explicitly invoke reference search/draft with a caller-owned private catalog and revision-bound input. No new global switch is added.

Validation: Search a minimal catalog, then read original credit, source revision, caveats and unused facts from the prepared result. The commands do not fetch or verify sources.

Disable / rollback: Stop invoking the workflow and remove only the private prepared artifact you own. The original catalog is not overwritten and no lifecycle transition is automatically applied.

Authority boundary: Preparation grants no source-reading rights, lifecycle writes, publication or source-assertion adoption. Prepared captures containing original backing remain local_private.

printf '{"entries":[]}\n' > reference-catalog.private.json
loopx content-ops reference search --library-json reference-catalog.private.json --query release --format json

Docs: Versioned guide

Periodic report intent and recovery

Activation: Explicitly request the built-in weekly profile for a bound Goal/source, or enable a reviewed project profile and post-writeback subscription. Recurrence needs its separately authorized host schedule.

Validation: Inspect the exact weekly activation receipt and read original pending/report receipts. Stopped Goals and current disabled subscriptions suppress new work or delivery.

Disable / rollback: Pause the owned Automation and set a custom profile/subscription enabled=false. This stops future actions; retain original intent and delivered-report evidence for recovery.

Authority boundary: A profile, prepared report or internal Turn receipt does not authorize external delivery. Verified current Goal Channel audience/sender bindings and original source permissions still apply.

loopx periodic-report inspect-profile --preset weekly --format json

Docs: Versioned guide

Reward Memory decision consumption

Activation: Bind a qualified reward-memory config and admitted agents using the existing Reward Memory editor or configure-goal. Enable automatic recall only in its existing configuration owner; exact-head PR review may opt into its bound repository-experience route.

Validation: Inspect effective Goal configuration and the original scoped recall/disposition receipt. Empty, filtered, stale or unavailable results remain visible and permit independent work.

Disable / rollback: Clear reward-memory-config, or set automatic_recall=false and requalify the binding. Clear only the corresponding PR review route when disabling repository experience.

Authority boundary: Recall does not grant corpus access, signing, orders, transfers, publishing or record migration. The new caller API does not deliver universal frontend/Lark consumption or cross-session persistence.

loopx configure-goal --goal-id "$GOAL_ID"
loopx configure-goal --goal-id "$GOAL_ID" --clear-reward-memory-config --execute

Docs: Versioned guide

Anonymous public source reader

Activation: Install loopx[public-source-reader] in the existing trusted Chat host environment, set LOOPX_CHAT_PUBLIC_SOURCE_READ=on and restart the idle service. Native workspace_only Chat alone consumes this opt-in.

Validation: In that Session ask to read a public article and an actual image, then inspect observed URL/digest and explicit missing coverage. Test rejection of private/local addresses without supplying any credential.

Disable / rollback: Set LOOPX_CHAT_PUBLIC_SOURCE_READ=off and restart the same owned service; off is the default. Optional dependency removal uses the same Python installation owner.

Authority boundary: Anonymous HTTPS reads import no cookies, personal MCP configuration or account history. They grant no private-source, writable-workspace, delegation or publication access; a successful MCP probe alone does not qualify a Bot journey.

python -m pip install "loopx[public-source-reader]==1.4.0"
LOOPX_CHAT_PUBLIC_SOURCE_READ=on loopx chat --project-workspace-grant workspace_read --no-open
  # Rollback: restart the same service with LOOPX_CHAT_PUBLIC_SOURCE_READ=off.

Docs: Versioned guide

Turn journal inspection

Activation: Explicitly inspect a known fenced Turn through turn inspect-journal; readback and recovery use the same typed journal owner. There is no new global activation switch.

Validation: Select the original journal identity from its receipt and inspect it; unreadable, conflicting or impossible phases fail visibly rather than being treated as finished.

Disable / rollback: Stop the inspection/watch command. Restore only the original verified journal through its recovery owner; package rollback is not state rollback.

Authority boundary: Inspection is read-only and cannot execute effects, spend quota or repeat a settled command. It does not authorize repairing another actor’s journal.

loopx turn inspect-journal --goal-id "$GOAL_ID" --agent-id "$AGENT_ID" --turn-key "$TURN_KEY" --format json
  # GOAL_ID, AGENT_ID and TURN_KEY come from the original retained receipt.

Docs: Versioned guide

Native Lark replies and private file handoff

Activation: Explicitly install the bundled loopx-lark provider. In existing Lark settings bind one verified App/profile, authorized audience and workspace; one listener owner per App. Separate assistant/steward Apps need separate identities and grants. Transport readiness does not certify every assistant DM journey.

Validation: Run the provider doctor, then send synthetic content through that selected binding and read back its original source/audience, retained reply and file-delivery receipt. Unavailable private sources stay unavailable; do not copy grants from another App.

Disable / rollback: Revoke the affected binding and stop its owned collector; disable loopx-lark or use extension rollback to a retained qualified version. Recover ambiguous replies/files from their original intent instead of resending.

Authority boundary: An App binding grants only its recorded source, audience and workspace. Bot transport does not run models, inherit a personal user account, grant document access, publish to chats or import old Goals/authentication.

loopx extension install --bundled loopx-lark --execute --format json
loopx extension doctor loopx-lark --execute --format json
loopx capability list --format json
  # Stop/revoke the selected binding before disabling:
loopx extension disable loopx-lark --execute --format json

Docs: Versioned guide

Finance source-bound cumulative flow

Activation: From the versioned source checkout, separately install the optional Finance package and its manifest, enable it through the existing lifecycle and doctor the managed runtime. Invoke only the reviewed synthetic flow-difference or period-comparison packet; this core release does not publish or install a separate extension version.

Validation: Run the source-bound synthetic packet and read its derived value, shared period/version/accuracy declarations and explicit missing coverage. The new operation validates declarations, not source truth or investment merit.

Disable / rollback: Disable the extension; extension rollback selects a retained qualified revision. Preserve original research/receipts and do not rewrite source periods to force a derivation.

Authority boundary: Availability adds research computation only. It grants no corpus access, orders, transfers, signing, trading or adoption of a financial conclusion; unresolved source/period/PIT limitations remain explicit.

python -m pip install ./packages/loopx-finance-value-discovery
loopx extension install --manifest packages/loopx-finance-value-discovery/extension.toml --execute --format json
loopx extension enable loopx-finance-value-discovery --execute --format json
loopx extension doctor loopx-finance-value-discovery --execute --format json
loopx extension run loopx-finance-value-discovery --input-json packages/loopx-finance-value-discovery/examples/flow-difference-v1.json --execute --format json
loopx extension disable loopx-finance-value-discovery --execute --format json

Docs: Versioned guide

Automation minimum-interval eligibility

Activation: Off by default. Pause the affected automatic schedule, inspect the bound Goal/Agent, preview a min-interval-minutes policy using the returned expected-revision and owner-reference, then explicitly execute. Parent/child constraints combine by maximum; configuration alone does not edit an App timer.

Validation: Read the effective policy and exact UTC next-eligible condition from automation-cadence or Settings → Automatic execution interval. For Lark select the authorized Agent before /status. Apply an actual App schedule only through its tool, then view/read back before the original ACK.

Disable / rollback: Pause the affected schedule; preview min-interval-minutes=0 with the current revision and approve-reduction, then execute and read back. Parent constraints remain. Preserve automation prompt, status and notification preference.

Authority boundary: Eligibility means only that the minimum interval elapsed. It grants no launch, quota, session-health, tool or publication authority. Reliable actual App automatic-trigger admission remains separately unqualified.

loopx --format json automation-cadence --goal-id "$GOAL_ID" --agent-id "$AGENT_ID"
  # REVISION is the revision returned above; preview before adding --execute.
loopx --format json automation-cadence --goal-id "$GOAL_ID" --agent-id "$AGENT_ID" --min-interval-minutes 1440 --expected-revision "$REVISION" --owner-reference owner-daily-cadence
  # Disable preview, using a newly read revision:
loopx --format json automation-cadence --goal-id "$GOAL_ID" --agent-id "$AGENT_ID" --min-interval-minutes 0 --expected-revision "$REVISION" --owner-reference owner-disable-cadence --approve-reduction

Docs: Versioned guide

EdgeBench native feedback and explicit controls

Activation: New attempts across all five workers default to --feedback native with a 3,600-second archive submission cooldown. Freeze model, worker, task budget, feedback and resource policy in a new attempt manifest. --feedback best-only and --feedback blind are explicit controls with their documented proxy/isolation requirements; old trials are unchanged.

Validation: Inspect runner help and the original private attempt manifest/result: feedback, timeout_seconds, eval_interval and submission_cooldown must match the frozen policy. Recover an accepted result by its original ID when the pinned client supports --result ID --details; a lost reply requires --list reconciliation before lookup.

Disable / rollback: Stop the owned attempt through its runner. For a new attempt choose an explicit control, or --feedback native --submission-cooldown 120 --eval-interval 300 to restore previous native timing. Never edit prior receipts or blindly resubmit; plain --details creates a new evaluation.

Authority boundary: Feedback exposes the native provider full public result, not a newly implemented score-only filter. It grants no scoring, task-budget, registration, resubmission or remote-write authority. Restart cooldown continuity and per-run fairness remain unqualified; no benchmark job is launched by these readback commands.

python -m benchmark.edgebench.run --help
  # TRIAL_RECEIPT is the retained private manifest/result of an existing attempt.
jq '{feedback, timeout_seconds, eval_interval, submission_cooldown}' "$TRIAL_RECEIPT"

Docs: Versioned guide

中文摘要

1.4.0 围绕原 Goal 验收、累积证据与下一步行动之间的联系，改进原生 Chat/Lark 连续性、canonical 类型化任务状态、可审阅 SQLite 恢复和工作 Turn 复核。最新长程研究保留整体系统进步及反例，不把所有收益归于单一模型，也不宣称完成 1.3.1→1.4.0 配对比较。

升级决策

谁需要升级： 受长程 Chat 恢复、过期任务/租约判断、证据复用或存储恢复影响的核心开发者和用户；扩展 SQLite 试用前先验证自己的支持 profile。

解决了什么： 在继续执行、恢复、复核与 canonical 状态读取中保留原操作身份和绑定来源的结果。

是否有破坏性变更： 有。未配置的新 Goal 默认 canonical SQLite/hard_lease；已有 Goal 和明确的 v0/v1 opt-out 保留路径。产品与 benchmark 的隐式复核为六个已结算有效工作 Turn，旧显式 Todo 单位仍有效。两个本地 provider 均需 Node 22.22.3 或更新版本；SQLite 另检查内嵌修复版本。不自动迁移已有 Goal，包回滚不等于数据回滚。

如何验证： 检查版本、安装来源、托管 runtime 身份与当前 Goal head；未配置的一次性新 Goal 应读回 canonical SQLite 和 authority_initialized=true。

loopx --version
loopx doctor
loopx machine-config inspect
loopx todo list --goal-id "$GOAL_ID"

贡献者： 包括 @LIHUA919、@JasonBuildAI，按真实 tag 范围与合并 PR 元数据列出十位社区贡献者（含首次进入发布者）及项目 Agent，详见下方。

状态内核与控制面

  • canonical Todo、依赖、交接和完成读取复用类型化 owner，退出重复 legacy 写入路径；原 fence、lease、scope 与重放身份仍是权威。
  • 新 Goal 默认 canonical SQLite/hard_lease；已有 Goal 的审阅迁移、冷来源导入、备份与反向迁移保留原回执及新增写入。实现已交付，持续 D2 资格仍单独开放。
  • quota/调度新鲜度、停止 Goal 的接纳、monitor 失败有界结算与六个已结算工作 Turn 复核，区分实质工作与轮询；计数不能代替进展。

能力与工作流

  • 原生 Chat 创建与排队 Turn 恢复保留原 Session；私有 Lark 回答/文件返回已验证原受众，撤销绑定后停止工作，回答呈现实质流式内容。
  • Explore 普通工作证据进入实际继续执行；进展复核绑定验收，拒绝过期 criterion/result。内容参考提纲保留署名、限制与调用者事实。
  • Reward Memory/仓库经验保留原作用域证据；周期报告保留请求来源和受众边界；Finance 累计流量评估保留来源期间与覆盖不完整的不确定性，不增加交易权。

基准、模型与质量

  • Portfolio 与 Lean 长程研究保留冻结尝试、runner/model 设置、观察改善和减速/零分反例。任务预算与有界官方反馈提高执行可靠性，本次发布不启动 benchmark。
  • Astra 辅助的语义控制面开发与类型化 owner 收敛改进证据、结算和继续执行契约；观察进步包含模型、prompt、runner 与 LoopX 改动，不宣称隔离的模型因果收益。
  • 打包来源、UTF-8 Host 入口与 Windows/私有路径处理改进诊断和恢复。推进正式版前仍须当前源码验证与实际安装回读。

社区贡献者

以下突出外部社区贡献，项目 Agent 单独署名。链接列出本次真实发布范围内的代表性合并工作。

兼容性与验证

冻结源码 1b452b00a 的 515 项 full-public smoke 全部通过，没有跳过、超时或 tracked 副作用；360 项相关 Python 回归通过，零失败、零跳过。Ruff、mypy、控制面 TypeScript、生产前端与 wheel 构建通过，连续源码观察确认干净且未变。父提交完整 Python 测试记录为 20,735 项通过、六项失败、335 项跳过；六项已复现失败均已修复，并在冻结源码重新验证。这不代表最终提交重新完成了全树 Python 扫描。真实 PyPI 1.3.1 升级到候选包保留已有 Todo 原持久化字段与 registry 路由；安装版 UI 预览、应用和移除配置读回新 Goal SQLite/hard_lease 默认，原对话只读查询返回且 provider 不可用状态可见。隔离 DSH 托管技能安装、回读与移除通过，未测试已认证 Host 的交互执行。Deep doctor 总体成功，保留 Host 材料警告。19 项风险选择检查与五项直接检查通过；维护者授权的独立 benchmark 人工评审已完成，原自动 hold 仍保留。benchmark 离线检查 132 项通过、244 项跳过，外部 Docker/Harbor/SForge/PostgreSQL/NoKV 执行和 SQLite 持续 D2 仍未验证。经维护者授权替代的 DS V4.1 Flash/high 完整资格通过：22 个场景各执行两次，六个对照全部通过，44 次逻辑 actor 调用、零失败、零跳过。93 次 HTTP 请求全部计数，包含两次纯模型响应传输重试；重试前未解码或执行工具。固定 catalog、提示、动作上限与行为断言保持不变。先前 Doubao evolving/high 有三个失败场景，仍未通过，失败回执保留；后续资格读取器改造不在本次冻结发布范围内。实际公开 v1.4.0 tag archive 与源码 stable 安装均在冻结提交通过版本、doctor 和 runtime-active 回读；源码 stable 已推进至 1.4.0。PyPI 与桌面工作流仍等待托管 runner，公开制品尚未回读；desktop-stable 仍为 1.3.1。

安装与更新

命名包可用后再执行。已有安装沿用原安装 owner，刷新托管 Host 材料后重启 Agent Host。

loopx update check
loopx update plan
loopx update apply
loopx doctor
loopx extension doctor --all-enabled --execute
python -m pip install --upgrade loopx==1.4.0

可选能力启用与使用

出现 GOAL_ID 时使用已有注册 Goal；只有一次性 bootstrap 示例创建新 Goal。引用 packages/ 或 benchmark/ 的命令从命名版本的 source checkout 执行。

New Goal SQLite defaults

启用： 未配置机器的新 Goal 默认创建 canonical SQLite，并采用 hard_lease。在设置→能力中心→此设备默认→新 Goal 的权威存储中明确选择 canonical_creation、provider 与受支持的交接策略，审阅并应用当前 revision。原 v0 配置和显式 v1 opt-out 仍有效。

验证： 先检查机器配置，再用 bootstrap 创建一次性 Goal；创建须读回 authority_initialized=true，Todo 读取须 authority_read.source_authority=sqlite_v0。

停用 / 回退： 停用未来 canonical 创建须审阅/应用 canonical_creation=false 的 v1 goal_storage 文档；移除设置会恢复 SQLite 默认，不等于停用。已有 Goal 保留记录的存储。

权限边界： 选择存储不授予 Host、租约、调度、仓库、账号或网络权限，也不迁移已有 Goal。

loopx machine-config inspect
loopx doctor
mkdir -p sqlite-trial
loopx --format json bootstrap --project ./sqlite-trial --goal-id sqlite-trial --objective "Verify SQLite default" --dry-run
  # After reviewing the dry run, create a disposable project/Goal:
loopx --format json bootstrap --project ./sqlite-trial --goal-id sqlite-trial --objective "Verify SQLite default"
loopx --format json todo list --goal-id sqlite-trial

文档： Versioned guide

Reviewed existing Goal migration

启用： 已有 canonical Goal 从 Goal→设置→Goal 数据存储进入。先停写、结算租约并验证完整备份，再审阅 File/SQLite 迁移预览，明确应用原 plan。冷 Markdown 来源走单独的审阅导入入口。

验证： 重启后读回原操作回执与当前 Todo head，验证新增写入仍在、过期预览被拒绝。

停用 / 回退： 从当前 SQLite head 审阅迁回 File，保留试用期间新增写入。完整备份只能经原恢复 owner 恢复；不可删除 selector 或数据库来触发 fallback。

权限边界： 迁移保留原权限和执行策略，不授予启动任务、重复外部副作用、接纳来源或迁移其他 Goal 的权限。

loopx doctor
  # GOAL_ID is the existing Goal selected in the storage editor.
loopx todo list --goal-id "$GOAL_ID"
loopx configure-goal --goal-id "$GOAL_ID"

文档： Versioned guide

Native workspace Chat and original Turn recovery

启用： 用明确的 workspace_read grant 启动 Chat，在既有 provider 选择器选择已认证的 Codex profile。配置 Goal 预算并授权工作后再启用 LoopX 模式；在保留的卡片中重试原创建/Turn 操作。

验证： 在所选工作区读回实质回答并检查原 Session/Turn。上游拒绝恢复仍是可见故障，不能当作首 Turn 已执行。

停用 / 回退： 在同一 Goal 编辑器停止当前 Turn、关闭 LoopX 模式，并通过服务生命周期停止所拥有的 Chat。调查恢复时保留原 Session。

权限边界： 工作区隔离不导入个人 MCP、浏览器 cookie 或账号历史；provider 认证不授权外部发布、迁移或更多工具。

loopx chat --project-workspace-grant workspace_read --no-open
loopx doctor

文档： Versioned guide

Explore evidence in ordinary work

启用： 为既有 Goal 明确选择 evidence 或 planning；在已接纳的工作结算中附加 explore_result，或使用普通 capture 入口。规划与 harness 配置仍单独明确启用。

验证： 读回 Explore summary 和下一 Turn 上下文，核对来源作用域与结果 lineage 属于当前 Goal 和已接纳工作。

停用 / 回退： 设置 explore-mode off；已记录证据仍可读，关闭 capture 不会删除证据或撤销完成的工作。

权限边界： 记录与规划不启动 worker、不授予工具权限，也不认证结果；私有来源继续私有，复用须绑定证据。

loopx configure-goal --goal-id "$GOAL_ID" --explore-mode evidence --execute
loopx explore summary --goal-id "$GOAL_ID"
loopx configure-goal --goal-id "$GOAL_ID" --explore-mode off --execute

文档： Versioned guide

Six settled work Turn review cadence

启用： 未配置的产品与 benchmark 路径继承六个已结算有效工作 Turn。明确设置过的旧 Todo 单位仍保留；只有审阅后的 Goal override 才设置 execution-replan-after-turns。

验证： 检查有效 Goal 配置与原结算事实；monitor 轮询、重复提交与未结算尝试不推进计数。

停用 / 回退： 清除 execution-replan-after-turns 恢复机器/默认继承。除非明确修改单位，保留原 legacy 设置；不存在关闭所有 Goal 验收义务的开关。

权限边界： 触发节奏要求复核，不要求一定换路线，也不增加 quota 或权限；它不替代人工 gate，不宣告 Goal 已完成。

loopx configure-goal --goal-id "$GOAL_ID"
loopx configure-goal --goal-id "$GOAL_ID" --execution-replan-after-turns 6 --execute
loopx configure-goal --goal-id "$GOAL_ID" --clear-execution-replan-after-turns --execute

文档： Versioned guide

Acceptance-bound progress review

启用： 通过既有 progress-review 编辑器或 configure-goal 明确启用 shadow；assist 需要已验证的 contract revision。复核操作须绑定原 Goal、criterion 与精确观察结果。

验证： 读回 configure-goal 和 Goal 复核卡片；无效 criterion 或过期结果绑定继续拒绝，模型意见不是已接纳证据。

停用 / 回退： clear-progress-review-configuration 回到 off，保留原回执；不能把失败或不可用的复核改称通过。

权限边界： sentinel 不授予执行、不修改验收条件、不许可发布；shadow 只观察，assist 仍受接纳的 contract 限制。

loopx configure-goal --goal-id "$GOAL_ID" --progress-review-mode shadow --execute
loopx configure-goal --goal-id "$GOAL_ID"
loopx configure-goal --goal-id "$GOAL_ID" --clear-progress-review-configuration --execute

文档： Versioned guide

Content reference outlines

启用： 打开既有 Content Ops reference 工作台，或明确调用 reference search/draft，提供自己拥有的私有 catalog 与绑定 revision 的输入。不增加全局开关。

验证： 先搜索最小 catalog，再从准备结果读回原署名、来源 revision、限制和未使用事实；这些命令不抓取或验证来源。

停用 / 回退： 停止调用并仅删除自己拥有的私有准备产物。原 catalog 不被覆盖，也不会自动应用生命周期迁移。

权限边界： 准备不授予来源读取权、生命周期写入、发布或采纳来源断言；包含原 backing 的 capture 结果仍为 local_private。

printf '{"entries":[]}\n' > reference-catalog.private.json
loopx content-ops reference search --library-json reference-catalog.private.json --query release --format json

文档： Versioned guide

Periodic report intent and recovery

启用： 为绑定的 Goal/来源明确请求内置 weekly profile，或启用审阅后的项目 profile 与 post-writeback 订阅。周期运行需要单独授权的 Host schedule。

验证： 检查 weekly activation 原回执并读回原 pending/report 回执。已停止 Goal 和当前 disabled 订阅抑制新增工作或送达。

停用 / 回退： 暂停拥有的 Automation，将自定义 profile/订阅设为 enabled=false，停止未来动作；保留原 intent 与已送达证据供恢复。

权限边界： profile、准备报告或内部 Turn 回执不授权外部送达；仍须当前已验证的 Goal Channel 受众/发送者绑定及原来源权限。

loopx periodic-report inspect-profile --preset weekly --format json

文档： Versioned guide

Reward Memory decision consumption

启用： 通过原 Reward Memory 编辑器或 configure-goal 绑定已验证 config 与接纳的 Agent；automatic recall 只在原配置 owner 中启用。精确 head PR review 可明确选择其绑定的 repository-experience 路径。

验证： 检查有效 Goal 配置与原作用域 recall/disposition 回执。空、过滤、过期或不可用结果保持可见，不阻断独立工作。

停用 / 回退： 清除 reward-memory-config，或设置 automatic_recall=false 后重验绑定。停用 repository experience 只清除对应 PR review 路径。

权限边界： 召回不授予 corpus 访问、签署、下单、转账、发布或记录迁移权。新增 caller API 未交付全部 frontend/Lark 消费或跨 session 持久化。

loopx configure-goal --goal-id "$GOAL_ID"
loopx configure-goal --goal-id "$GOAL_ID" --clear-reward-memory-config --execute

文档： Versioned guide

Anonymous public source reader

启用： 在既有可信 Chat Host 环境安装 loopx[public-source-reader]，设置 LOOPX_CHAT_PUBLIC_SOURCE_READ=on 并重启空闲服务；仅原生 workspace_only Chat 消费此 opt-in。

验证： 在该 Session 请求读取公开文章与实际图片，检查观察 URL/digest 和缺失覆盖；不提供凭据，验证本地/私有地址被拒绝。

停用 / 回退： 设置 LOOPX_CHAT_PUBLIC_SOURCE_READ=off 并重启同一拥有的服务；off 是默认。移除可选依赖沿用相同 Python 安装 owner。

权限边界： 匿名 HTTPS 不导入 cookie、个人 MCP 或账号历史，也不授予私有来源、可写工作区、委派或发布权。MCP probe 成功不能单独认证 Bot 旅程。

python -m pip install "loopx[public-source-reader]==1.4.0"
LOOPX_CHAT_PUBLIC_SOURCE_READ=on loopx chat --project-workspace-grant workspace_read --no-open
  # Rollback: restart the same service with LOOPX_CHAT_PUBLIC_SOURCE_READ=off.

文档： Versioned guide

Turn journal inspection

启用： 通过 turn inspect-journal 明确检查已知 fenced Turn；回读与恢复复用同一类型化 journal owner，不增加全局启用开关。

验证： 从原回执选择 journal identity 再检查；不可读、冲突或不可能的阶段须可见失败，不能当作完成。

停用 / 回退： 停止检查/watch 命令。只经原恢复 owner 恢复已验证 journal；包回滚不是状态回滚。

权限边界： 检查只读，不能执行副作用、扣 quota 或重做已结算命令，也不授权修复其他 actor 的 journal。

loopx turn inspect-journal --goal-id "$GOAL_ID" --agent-id "$AGENT_ID" --turn-key "$TURN_KEY" --format json
  # GOAL_ID, AGENT_ID and TURN_KEY come from the original retained receipt.

文档： Versioned guide

Native Lark replies and private file handoff

启用： 明确安装 bundled loopx-lark；在既有 Lark 设置中绑定已验证 App/profile、授权受众与工作区，每个 App 仅一个 listener owner。assistant/steward 的独立 App 分别验证身份与 grants；transport readiness 不认证所有 assistant 私聊旅程。

验证： 执行 provider doctor，再经所选绑定发送合成内容，读回原 source/audience、保留回答与文件投递回执。不可用的私有来源保持不可用，不从其他 App 复制 grant。

停用 / 回退： 撤销受影响绑定并停止所拥有的 collector；disable loopx-lark，或 extension rollback 到保留且已验证的版本。回答/文件结果不明时恢复原 intent，不盲目重发。

权限边界： App 绑定只授予其记录的来源、受众和工作区；Bot transport 不运行模型、不继承个人 user 账号，不授予文档读取或聊天发布，也不导入旧 Goal/认证。

loopx extension install --bundled loopx-lark --execute --format json
loopx extension doctor loopx-lark --execute --format json
loopx capability list --format json
  # Stop/revoke the selected binding before disabling:
loopx extension disable loopx-lark --execute --format json

文档： Versioned guide

Finance source-bound cumulative flow

启用： 从版本化 source checkout 单独安装可选 Finance 包及 manifest，经既有生命周期启用并 doctor 托管 runtime。只调用审阅过的合成 flow-difference 或 period-comparison 输入；此 core release 不发布或自动安装独立 extension 版本。

验证： 执行来源绑定的合成输入，读回派生值、共享期间/版本/accuracy 声明和缺失覆盖；新操作验证声明，不验证来源真实性或投资价值。

停用 / 回退： disable extension；extension rollback 选择保留且已验证的 revision。保留原研究/回执，不改写期间来强行得到派生结果。

权限边界： 能力可用只增加研究计算，不授予 corpus 访问、下单、转账、签署、交易或采纳金融结论；来源、期间与 PIT 未解决项继续显式保留。

python -m pip install ./packages/loopx-finance-value-discovery
loopx extension install --manifest packages/loopx-finance-value-discovery/extension.toml --execute --format json
loopx extension enable loopx-finance-value-discovery --execute --format json
loopx extension doctor loopx-finance-value-discovery --execute --format json
loopx extension run loopx-finance-value-discovery --input-json packages/loopx-finance-value-discovery/examples/flow-difference-v1.json --execute --format json
loopx extension disable loopx-finance-value-discovery --execute --format json

文档： Versioned guide

Automation minimum-interval eligibility

启用： 默认 off。先暂停受影响自动计划，检查绑定 Goal/Agent，用返回的 expected-revision 和 owner-reference 预览 min-interval-minutes，再明确 execute。父子约束取最大；写配置本身不修改 App timer。

验证： 通过 automation-cadence 或设置→自动执行间隔读回有效策略和 UTC next-eligible。Lark /status 先选择授权 Agent。实际 App schedule 只用原工具应用，再 view/readback 后 ACK 原操作。

停用 / 回退： 保持受影响计划暂停，用当前 revision 与 approve-reduction 预览 min-interval-minutes=0，再 execute/readback；父约束仍在，保留自动计划的 prompt/status/通知偏好。

权限边界： eligible 仅代表最短间隔已经过，不授予启动、quota、session health、工具或发布权；实际 App 自动触发接纳仍单独未认证。

loopx --format json automation-cadence --goal-id "$GOAL_ID" --agent-id "$AGENT_ID"
  # REVISION is the revision returned above; preview before adding --execute.
loopx --format json automation-cadence --goal-id "$GOAL_ID" --agent-id "$AGENT_ID" --min-interval-minutes 1440 --expected-revision "$REVISION" --owner-reference owner-daily-cadence
  # Disable preview, using a newly read revision:
loopx --format json automation-cadence --goal-id "$GOAL_ID" --agent-id "$AGENT_ID" --min-interval-minutes 0 --expected-revision "$REVISION" --owner-reference owner-disable-cadence --approve-reduction

文档： Versioned guide

EdgeBench native feedback and explicit controls

启用： 五类 worker 的新 attempt 默认 --feedback native，archive 提交 cooldown 为 3,600 秒。新 attempt manifest 冻结 model/worker/任务预算/feedback/资源策略。--feedback best-only 与 --feedback blind 是明确的控制组，需文档规定的 proxy/隔离；旧 trial 不变。

验证： 检查 runner help 与原私有 attempt manifest/result，feedback、timeout_seconds、eval_interval、submission_cooldown 必须符合冻结策略。pinned client 支持时以 --result ID --details 回读原 accepted result；回复丢失先 --list 对齐原 ID。

停用 / 回退： 通过原 runner 停止拥有的 attempt；新 attempt 可明确选控制组，或 --feedback native --submission-cooldown 120 --eval-interval 300 恢复旧 native 时序。不改旧回执、不盲目重投；单独 --details 会新增 evaluation。

权限边界： feedback 返回 native provider 完整公开结果，未新实现 score-only filter；不增加评分、任务预算、注册、重投或远端写入权。重启 cooldown 连续性和按 run 公平性仍未认证；以下回读不启动 benchmark。

python -m benchmark.edgebench.run --help
  # TRIAL_RECEIPT is the retained private manifest/result of an existing attempt.
jq '{feedback, timeout_seconds, eval_interval, submission_cooldown}' "$TRIAL_RECEIPT"

文档： Versioned guide

Contributors

LIHUA919 and JasonBuildAI
Assets 14
Loading