多编码代理共用状态调度内核
为loopx打分
给出您宝贵的评分：
收藏到合集
手机端可长按上方图片保存到相册,或点击「下载/分享」分享到微信
使用 loopx，你可以：
面向长期运行AI代理团队轻量状态内核，跨多种编码代理，支持持久目标、自动唤醒、任务日志与任务交接。
用户评论 (0)
2026年08月06日
2026年08月06日
2026年08月06日
2026年08月26日
2026年09月02日
2026年08月23日
2026年08月14日
2026年08月11日
2026年08月07日
2026年06月24日
v1.0.2
2026年09月09日
LoopX 1.0.2 — single-owner Todo authority, automatic recovery, and faster workspaces
At a Glance
LoopX 1.0.2 completes a major authority-boundary step after 1.0: promoted Todo
lifecycle decisions now have one TypeScript business owner, missing generated
Todo displays recover automatically without making Markdown authoritative, and
large workspaces spend less time rescanning history.
Upgrade
loopx update check
loopx update plan
loopx update apply
loopx --version
loopx doctor --deepHighlights
- Complete, supersede, and archive promoted Todos through one provider
transaction that also settles successor, lease, and receipt state. Python
remains an adapter instead of deriving a second set of terminal rules
(#4053,
#4068,
#4113). - Reconstruct missing generated Todo sections for promoted Goals during normal
projection delivery while preserving the Goal narrative and the canonical
provider as authority (#4097). - Preserve causal wait work before Todo compaction and stop broad guards from
blocking legitimate agent writeback or hiding typed fence failures
(#4059,
#4079,
#4084). - Bound global recent-run reads and avoid redundant transcript scans. The
isolated large-history checks measured roughly 2.6× faster recent-run
aggregation with about 94% less peak memory, and roughly 40× faster
generated-id chat append on a 10,000-message fixture
(#4092,
#4099). - Make host recovery clearer with Desktop readiness diagnostics, stable DSH
lineage identities, profile-neutral turn guidance, and version-aware
workflow-skill readback
(#4066,
#4073,
#4078,
#4080,
#4086).
Release Decision
Who should upgrade: Operators of promoted Goals, long-running workspaces,
Desktop or DSH hosts, managed workflow skills, PR review automation, or the
benchmark toolkit should upgrade now. Stable small CLI-only workspaces may use
their normal maintenance window.
What this release solves: It removes duplicate Python/TypeScript Todo
lifecycle decisions, repairs missing promoted Todo displays, preserves causal
waits through compaction, improves recovery diagnostics, and bounds hot reads
over large histories.
Breaking changes: No. Existing Goal state and supported CLI contracts stay
compatible. Promoted Goals may now recreate missing generated Todo sections;
unpromoted Goals remain unchanged. No provider is promoted by default, and no
new daemon, database, or migration is introduced.
How to verify: Upgrade the package and managed host material, then confirm
version 1.0.2, deep runtime readiness, and the relevant Goal or workflow-skill
readback.
Contributors: Prepared by @huangruiteng with @vlean, @Duang777,
@xyx2002OvO, @cocolord, @liubf21, @now-ing, and @cweiai; see Community
Contributors below.
loopx --version
loopx doctor --deep
loopx workflow-skills --install
loopx workflow-skills --format jsonState Kernel & Control Plane
- Promoted Todo completion, supersession, archive, successor derivation,
lease handling, and receipt publication now commit through one
TypeScript-owned provider transaction. Stable operation replay, changed
intent, duplicate create rejection, crash recovery, and domain rejection
remain distinct typed outcomes
(#4053). - Todo lifecycle admission and terminal fences now share the same TypeScript
owner across public entry points. The migration keeps provider selection,
promotion, CAS, and receipt semantics unchanged while deleting duplicate
Python decisions (#4113). - The coarse completion transaction was restored for the remaining legacy
path, and canonical Todo/RFC descriptions were aligned with the shipped
boundary (#4068,
#4093,
#4119). - Boolean-looking append sequences and ambiguous spawn-authority values now
fail closed instead of being coerced into a different meaning
(#4050,
#4089).
Capabilities & Workflows
- Promoted Goals automatically rebuild missing generated Todo sections during
successful projection delivery. Recovery is limited to Todo sections,
preserves narrative text, and never falls back to Markdown authority
(#4097). - Causal wait coverage is derived from the shared Vision read model before
completed Todo compaction, so actionable successor work stays visible to
quota, projection, and semantic writeback
(#4059). - Workflow-skill installation records the packaged revision and reports stale
or mismatched host material; PR review results bind the exact installed
policy revision and require rule-ownership evidence for retained or migrated
findings (#4086,
#4065). - Benchmark monitors can preserve a private, provisional
benchmark_case_observation_v0with provider-neutral traceability while a
case is active. It never invents a score and remains separate from the final
scored insight (#4070).
Quality & Testing
- Stage 2C end-to-end tests now run with four file-distributed workers; the
measured suite was about 38% faster while retaining process-level coverage
(#4053). - The Todo authority refactor was compared against an 8,680-decision
production-derived snapshot with zero behavior differences, plus real
PostgreSQL, file-provider, baseline, mutation, crash, retry, and split-root
coverage (#4053,
#4113). - Stage 2C test modules no longer collide under concurrent collection, and
Sonar guard assertions now prove the intended semantics instead of matching
incidental syntax (#4096,
#4098). - Safe checkpoint recovery now applies on the first refresh instead of waiting
for a second read (#4052).
Benchmarks & Integrations
- Generated-id chat append skips redundant full-transcript scans while
explicit idempotency keys retain replay deduplication
(#4092). - Global recent-run merge reads only the requested window while preserving
total counts, per-Goal counts, and stable ordering
(#4099). - DSH turn identities now derive from stable Goal/Agent/Todo lineage rather
than mutable display values, and Desktop surfaces distinguish readiness
errors from a hung service
(#4066,
#4073,
#4078). - Chat serving defaults are consistent across supported entry points
(#4060).
Documentation & Compatibility
- The single-owner loop daemon proposal and bounded computer-use proposal are
recorded as RFCs without silently enabling either runtime
(#4054,
#4115). - Public documentation now distinguishes canonical Todo authority from display
recovery and links restrained benchmark evidence from the README
(#4093,
#4119,
#4120). - Ordinary use of the word “authorization” no longer looks like a credential,
and generic CLI turn guidance no longer instructs unsupported hosts to use a
Codex App-only flag (#4079,
#4080).
Community Contributors
- @vlean — first contributions: repaired broad
writeback/public-safety guards and made turn-start guidance host-neutral
(#4079,
#4080). - @Duang777 — stricter append/spawn values,
preserved monitor fence errors, and bounded chat/recent-run hot paths
(#4050,
#4084,
#4089,
#4092,
#4099). - @xyx2002OvO — first-refresh checkpoint
recovery, the single-owner loop daemon RFC, and Desktop status readiness
(#4052,
#4054,
#4078). - @cocolord — causal wait coverage before Todo
compaction (#4059). - @liubf21 — stable DSH session lineage identity
(#4066). - @now-ing — actionable Desktop bootstrap failure
reporting (#4073). - @cweiai — first contribution: version-bound
workflow-skill installation and mismatch detection
(#4086).
Optional Capability Activation & Use
Promoted Todo lifecycle
Activation: There is no new 1.0.2 toggle. The transaction applies only to a
Goal already promoted through the separately reviewed canonical-authority
procedure. coordination-shadow bootstrap remains pre-promotion qualification;
it does not promote a provider.
Validation: Read the Goal and Todo projections from the active authority and
confirm the provider/mode reported for that Goal.
Disable / rollback: Before promotion, preview and then execute a
revision-fenced candidate rollback. After promotion, do not bypass the writer
fence or use the pre-promotion rollback; use the provider's reviewed
export/downgrade procedure. There is no per-command Python fallback.
Authority boundary: The selected canonical provider owns Todo state. Python
adapts CLI/host context and Markdown remains a display; neither may derive a
second terminal decision.
Docs: Shared Goal Authority RFC at v1.0.2.
GOAL_ID=<goal-id>
loopx --format json status --goal-id "$GOAL_ID"
loopx --format json todo list --goal-id "$GOAL_ID"
loopx --format json coordination-shadow rollback \
--goal-id "$GOAL_ID" --provider-revision <exact-revision>Versioned workflow skills
Activation: Refresh the packaged managed skills after upgrading LoopX.
Validation: Inspect the recorded source and installed revision; ready=true
must refer to the current Python distribution.
Disable / rollback: Remove only unchanged LoopX-managed workflow skills with
the uninstall command, or reinstall the previous trusted LoopX package and run
its installer. Modified user files are preserved.
Authority boundary: Skill installation writes host instruction material
only. It does not modify project Goal state or grant repository, network,
credential, or merge authority.
Docs: Installing LoopX at v1.0.2.
loopx workflow-skills --install
loopx workflow-skills --format json
loopx workflow-skills --uninstall --dry-runRevision-bound PR review
Activation: Install the loopx-pr-review project skill explicitly for each
host surface that should use it.
Validation: Read back the managed copy and require the installed source and
policy revision to match the current package/project declaration.
Disable / rollback: Preview, then execute project-skill uninstall for the
same project, skill, and host surface. This removes only the managed copy.
Authority boundary: The workflow produces review evidence and a decision;
it grants no merge, push, provider, or cross-Agent authority. A stale or missing
policy revision cannot certify approval.
Docs: PR review capability at v1.0.2.
loopx project-skill install --project . --skill loopx-pr-review \
--surface codex --execute
loopx project-skill status --project . --skill loopx-pr-review \
--surface codex --format json
loopx project-skill uninstall --project . --skill loopx-pr-review \
--surface codexTraceable benchmark observations
Activation: A benchmark monitor may explicitly emit the optional
benchmark_case_observation_v0 private artifact after a bounded active-runtime
readback. Core does not create it automatically.
Validation: Require a healthy exact-job receipt and live owner before using
the provisional observation, then check the artifact against the documented
schema and private/public boundary.
Disable / rollback: Stop emitting the provisional observation; no canonical
score, slot, or runner state needs migration. A project-local benchmark skill
can be preview-uninstalled independently.
Authority boundary: The artifact is provisional and private. It cannot
score, launch, stop, retry, reconcile, or release a benchmark run, and public
projections must omit raw trace, span, URL, path, and provider-session data.
Docs: Benchmark toolkit at v1.0.2.
loopx benchmark runtime-observation --admission-active \
--job-receipt-state resolved --runner-owner-state alive \
--require-healthy --format json
loopx project-skill uninstall --project . --skill loopx-benchmark \
--surface codexDesktop readiness diagnostics
Activation: Start the existing local dashboard/Chat surface; 1.0.2 adds no
remote endpoint or background-service opt-in.
Validation: Run the deep doctor probe and require the managed TypeScript
runtime readiness/lifecycle projection to be healthy before trusting the UI.
Disable / rollback: Stop the foreground dashboard process. To roll back the
diagnostic behavior, reinstall the previous trusted LoopX package and refresh
host material; project state is not deleted.
Authority boundary: Readiness diagnostics report local runtime health and
public-safe error codes. They do not mutate Goals, Todos, credentials, external
systems, or provider authority.
Docs: Install and runtime diagnostics at v1.0.2.
loopx doctor --deep
loopx dashboard --no-openInstall / Update
Python 3.11+ and Node.js 22.6+ are required.
python3 -m pip install --upgrade loopx==1.0.2
loopx workflow-skills --install
loopx doctor --deep
loopx --versionFor pipx, use pipx upgrade loopx, then refresh workflow skills and run the
same doctor/version readback. Source and archive installations should follow
their existing trusted-owner update path; do not mix installation owners.
Validation
The exact release commit is qualified independently from mutable main before
the tag moves. Release automation rebuilds wheel and source distribution,
checks metadata and checksums, installs the wheel in a clean environment,
validates the managed TypeScript runtime and workflow-skill lifecycle, uploads
attested artifacts, and verifies PyPI when publishing is enabled.
中文摘要
LoopX 1.0.2 完成了 1.0 之后一轮关键的权限边界收敛：promoted Todo 的生命周期判断
由 TypeScript 单一业务 owner 负责；缺失的 Todo 展示可自动恢复，但 Markdown 不会变成
authority；长历史与长聊天的热路径也显著减负。
升级决策
**谁需要升级：**使用 promoted Goal、长周期 Workspace、Desktop 或 DSH 宿主、托管
workflow skill、PR review 自动化或 benchmark toolkit 的 operator 建议立即升级；仅使用
小型稳定 CLI Workspace 的用户可按常规维护窗口升级。
**解决了什么：**本版本删除了 Python 与 TypeScript 两套 Todo 生命周期判断，恢复缺失的
promoted Todo 展示，避免因压缩丢失 causal wait，增强宿主恢复诊断，并限制大历史热读范围。
**是否有破坏性变更：**无。已有 Goal 状态与受支持 CLI 合约保持兼容。promoted Goal
现在可能自动重建缺失的生成 Todo 段落；未 promoted Goal 不变。没有 provider 被默认
promote，也没有新增 daemon、数据库或迁移。
**如何验证：**升级 package 与托管宿主材料后，确认版本为 1.0.2、deep doctor 就绪，
并读回相应 Goal 或 workflow skill 状态。
**贡献者：**本版本由 @huangruiteng 与 @vlean、@Duang777、@xyx2002OvO、
@cocolord、@liubf21、@now-ing、@cweiai 共同完成；详见下方社区贡献者。
loopx --version
loopx doctor --deep
loopx workflow-skills --install
loopx workflow-skills --format json状态内核与控制平面
- promoted Todo 的 complete、supersede、archive、successor、lease 与 receipt 由同一个
TypeScript provider transaction 提交；Python 只保留外部上下文与兼容适配
(#4053,
#4068,
#4113)。 - Todo admission 与 terminal fence 已收敛到同一 owner，provider selection、promotion、
CAS 与 receipt 语义不变；布尔 append/spawn authority 的歧义输入改为 fail closed
(#4050,
#4089,
#4093)。
能力与工作流
- promoted Goal 在正常投影投递时自动恢复缺失的生成 Todo 段落，只恢复 Todo、保留叙事，
且绝不回退到 Markdown authority
(#4097)。 - causal wait 在 completed Todo 压缩前从共享 Vision read model 推导，继续对 quota、投影与
semantic writeback 可见 (#4059)。 - workflow skill 安装记录 package revision，PR review 结果绑定精确 policy revision；
benchmark monitor 可保存私有 provisional observation，但不能冒充最终得分 insight
(#4086,
#4065,
#4070)。
质量与测试
- Stage 2C 真实子进程测试改为 4 个按文件分发的 worker，实测约快 38%；同时保留 crash、
retry、split-root、mutation 与真实 PostgreSQL 覆盖
(#4053)。 - Todo authority 重构使用 8,680 个 production-derived decision 做差分，结果零差异，并通过
baseline、file-provider、PostgreSQL 三臂验证
(#4113)。 - 并行 Stage 2C module collision 与 Sonar 断言语义缺口已修复
(#4096,
#4098)。
Benchmark 与集成
- 10,000 条消息 fixture 上，generated-id chat append 的隔离基准约快 40×；全局 recent-run
merge 在 100×1,000 synthetic runs 上约快 2.6×，峰值内存约下降 94%
(#4092,
#4099)。 - DSH turn identity 改为稳定 Goal/Agent/Todo lineage；Desktop 能区分可诊断启动失败与服务
卡死 (#4066,
#4073,
#4078)。
文档与兼容性
- single-owner loop daemon 与 bounded computer-use 以 RFC 形式沉淀，均未静默启用
(#4054,
#4115)。 - 文档明确区分 canonical Todo authority 与 display recovery，并更新公共 benchmark 证据入口
(#4093,
#4119,
#4120)。
社区贡献者
- @vlean — 首次贡献：修复过宽的 writeback/public-safety guard，
并让 turn-start 指引兼容不同宿主
(#4079,
#4080)。 - @Duang777 — 严格化 append/spawn 输入，保留 monitor fence
错误，并限制 chat/recent-run 热路径
(#4050,
#4084,
#4089,
#4092,
#4099)。 - @xyx2002OvO — 首次 refresh checkpoint recovery、
single-owner loop daemon RFC 与 Desktop status readiness
(#4052,
#4054,
#4078)。 - @cocolord — Todo 压缩前的 causal wait coverage
(#4059)。 - @liubf21 — 稳定 DSH session lineage identity
(#4066)。 - @now-ing — 可操作的 Desktop bootstrap failure reporting
(#4073)。 - @cweiai — 首次贡献：version-bound workflow skill 安装与
mismatch detection (#4086)。
可选能力启用与使用
Promoted Todo lifecycle
**启用：**1.0.2 没有新增开关。该 transaction 只适用于已通过独立评审流程 promoted 的
Goal；coordination-shadow bootstrap 仍只是 promotion 前资格验证，不会 promote provider。
**验证：**从 active authority 读回 Goal 与 Todo 投影，确认该 Goal 的 provider/mode。
**停用 / 回退：**promotion 前，先预览再执行绑定精确 revision 的 candidate rollback；
promotion 后不得绕过 writer fence 或使用 promotion 前 rollback，须走 provider 已评审的
export/downgrade 流程。不存在逐命令 Python fallback。
**权限边界：**选中的 canonical provider 拥有 Todo 状态；Python 只适配 CLI/宿主上下文，
Markdown 只是展示，两者都不能推导第二份 terminal decision。
文档：v1.0.2 Shared Goal Authority RFC。
GOAL_ID=<goal-id>
loopx --format json status --goal-id "$GOAL_ID"
loopx --format json todo list --goal-id "$GOAL_ID"
loopx --format json coordination-shadow rollback \
--goal-id "$GOAL_ID" --provider-revision <exact-revision>Versioned workflow skills
**启用：**升级 LoopX 后刷新 packaged managed skills。
**验证：**读回 source 与 installed revision；ready=true 必须对应当前 Python distribution。
**停用 / 回退：**用 uninstall 只移除未被用户修改的 LoopX-managed workflow skills；或重装
上一个可信 LoopX package 并运行其 installer。用户修改过的文件会保留。
**权限边界：**skill 安装只写宿主 instruction material，不修改项目 Goal 状态，也不授予
repository、network、credential 或 merge authority。
文档：v1.0.2 安装指南。
loopx workflow-skills --install
loopx workflow-skills --format json
loopx workflow-skills --uninstall --dry-runRevision-bound PR review
**启用：**为每个需要使用该能力的 host surface 显式安装 loopx-pr-review project skill。
**验证：**读回 managed copy，要求 installed source 与 policy revision 匹配当前
package/project declaration。
**停用 / 回退：**对相同 project、skill 与 host surface 先预览、再执行 project-skill
uninstall；只移除 managed copy。
**权限边界：**workflow 只产生 review evidence 与 decision，不授予 merge、push、provider
或跨 Agent 权限。stale/missing policy revision 不能证明 APPROVE。
文档：v1.0.2 PR review capability。
loopx project-skill install --project . --skill loopx-pr-review \
--surface codex --execute
loopx project-skill status --project . --skill loopx-pr-review \
--surface codex --format json
loopx project-skill uninstall --project . --skill loopx-pr-review \
--surface codexTraceable benchmark observations
**启用：**benchmark monitor 在有界 active-runtime readback 后，可显式写入可选的私有
benchmark_case_observation_v0；core 不会自动创建。
**验证：**使用 provisional observation 前，要求 exact-job receipt 已解析且 owner 存活，
再按文档 schema 与私有/公共边界检查 artifact。
**停用 / 回退：**停止产出 provisional observation 即可；canonical score、slot 与 runner
state 无需迁移。project-local benchmark skill 可独立预览卸载。
**权限边界：**artifact 是 provisional 且私有的，不能 score、launch、stop、retry、
reconcile 或 release benchmark run；公共投影不得包含 raw trace、span、URL、path 或
provider session 数据。
loopx benchmark runtime-observation --admission-active \
--job-receipt-state resolved --runner-owner-state alive \
--require-healthy --format json
loopx project-skill uninstall --project . --skill loopx-benchmark \
--surface codexDesktop readiness diagnostics
**启用：**启动已有本地 dashboard/Chat surface；1.0.2 不新增远程 endpoint 或后台服务开关。
**验证：**运行 deep doctor probe，在信任 UI 前确认 managed TypeScript runtime 的
readiness/lifecycle 投影健康。
**停用 / 回退：**停止前台 dashboard process。若需回退诊断行为，重装上一可信 LoopX
package 并刷新 host material；不会删除项目状态。
**权限边界：**readiness diagnostics 只报告本地 runtime 健康度与 public-safe error code，
不修改 Goal、Todo、credential、外部系统或 provider authority。
loopx doctor --deep
loopx dashboard --no-open安装 / 更新
需要 Python 3.11+ 与 Node.js 22.6+。
python3 -m pip install --upgrade loopx==1.0.2
loopx workflow-skills --install
loopx doctor --deep
loopx --versionpipx 用户先运行 pipx upgrade loopx，再刷新 workflow skills 并执行同样的
doctor/version 读回。source 与 archive 安装沿用各自可信 owner 的升级路径，不要混用安装
owner。
发布验证
tag 移动前，会针对不可变的精确 release commit 做独立资格验证，而不是依赖可变 main。
发布自动化会重建 wheel/sdist、检查 metadata 与 checksum、在干净环境安装 wheel、验证
managed TypeScript runtime 与 workflow-skill 生命周期、上传带 attestations 的 artifacts，
并在启用 PyPI 发布时从 PyPI 回读验证。
v1.0.1
2026年09月08日
LoopX 1.0.1 — reliable Goal Channels, recovery, and typed control-plane boundaries
At a Glance
LoopX 1.0.1 makes the 1.0 Workspace safer to operate: multi-Agent Goal
Channels are resumable, Agent-requested reports use typed intents instead of
keyword matching, Desktop failures are diagnosable, and more Todo authority is
atomic and recoverable.
Upgrade
loopx update check
loopx update plan
loopx update apply
loopx --version
loopx doctorHighlights
- Ask an addressed Agent for a report in a bound Goal Channel. The Agent makes
the semantic decision and records an exact, provider-neutral, replay-safe
request; LoopX does not classify messages with keywords or regexes
(#4001,
#4037,
#4040). - Connect several Agents to one Lark Goal Channel through a resumable batch,
with verified bot mentions and a distinct compatible App for each Agent
(#4004,
#4039,
#4046). - Diagnose and recover Desktop startup/update failures with bounded copyable
evidence, visible startup progress, safer update-journal cleanup, and
package-time runtime-entry checks
(#4014,
#4021,
#4022,
#4027,
#4031,
#4041). - Read measured per-Goal Codex usage without inventing missing cost or token
values; historical snapshots receive a provenance-bound compatibility path
(#4016). - Keep ownership mutations atomic and projections recoverable: promoted Todo
claim+lease, canonical-journal Markdown recovery, Stage 2C management, and
completion policy now share stronger typed transaction boundaries
(#3985,
#4032,
#4038,
#4044). - Frozen host bundles can install the same version-bound LoopX workflow skills
as wheel/source installations, and Goals can opt into earlier completed-Todo
review without changing the default cadence
(#4063,
#4045).
Replan Fixes
- Declared Vision fallback gaps remain visible in the frontier instead of
disappearing behind compact projection
(#3979). - Post-writeback composition failures retain typed source identity and
retryability instead of collapsing into generic failure
(#3978,
#4025). - Goals with short Todo chains can request review after 1–5 completions; the
shipped default remains five
(#4045).
Contributors
- @now-ing — governed amendments, Vision/replan
visibility, typed post-writeback recovery, Todo identity, Desktop recovery,
and Reward Memory diagnostics
(#3883,
#3976,
#3978,
#3979,
#4000,
#4011,
#4020,
#4021,
#4022,
#4025,
#4026,
#4027,
#4030,
#4033). - @wchwawa — recoverable Stage 2C capture,
qualification, fencing, and rollback
(#3985). - @Duang777 — corrupt-lease rejection,
refreshed event-store reads, and stricter status/config value validation
(#3993,
#4013,
#4035,
#4036). - @liubf21 — provenance-bound Codex usage
snapshots and measured Workspace usage
(#4016). - @huashuai — first contribution: localized
projected Workspace status copy
(#4019). - @steven-kid — visibly active Desktop startup
progress (#4041). - @KevinBarrus — first contributions:
runtime topology-drift detection and 1.0 status alignment
(#4042,
#4043). - @AI-Scarlett — first contribution:
canonical DSH plugin repository metadata
(#4047). - @xyx2002OvO — first contribution:
concurrent Todo add/update serialization coverage
(#4048).
Release Decision
Who should upgrade: Goal Channel, periodic-report, Desktop, measured-usage,
Reward Memory, frozen-bundle, or Stage 2C qualification users should upgrade;
stable CLI-only users unaffected by these paths may wait for their normal
maintenance window.
What this release solves: It closes the main post-1.0 reliability gaps in
multi-Agent channel onboarding, typed report requests, recovery diagnostics,
usage provenance, Todo ownership/projection recovery, and installed workflow
skill parity.
Breaking changes: No. The supported stable contract and persisted Goal
state remain compatible. The experimental loopx benchmark agent-phase and
benchmark_toolkit.external_agent bridge were intentionally removed; affected
runners must invoke their solver directly or migrate governed execution to the
Turn contract. Existing result files are not rewritten, and Stage 2C remains
default-off.
How to verify: After upgrading, version and doctor must report 1.0.1; the
weekly report profile must remain active/generation-allowed, and workflow-skill
readback must be ready for the installed package.
Contributors: Prepared by @huangruiteng with @now-ing, @wchwawa,
@Duang777, @liubf21, @huashuai, @steven-kid, @KevinBarrus, @AI-Scarlett, and
@xyx2002OvO; see Community Contributors below.
loopx --version
loopx doctor
loopx periodic-report inspect-profile --preset weekly --format json
loopx workflow-skills --install
loopx workflow-skills --format jsonState Kernel & Control Plane
- Promoted Todo ownership can atomically acquire its hard lease; omission of
lease options preserves the old claim-only contract
(#4032). - Canonical authority journal entries now recover Markdown Todo projections
after commit-before-render failures, without making Markdown authoritative
(#4038). - Completion successor policy moved into the coarse TypeScript transaction,
while registry/source projection and legacy persistence remain Python
adapters (#4044). - Stage 2C capture and rollback now preserve management locks, cursor lineage,
full writer fencing, and typed remediation. This qualifies a default-off
candidate; it does not promote file, NoKV, or PostgreSQL authority
(#3985). - Corrupt lease expirations and invalid boolean/numeric API inputs fail closed,
while claim-rejection details and event-store freshness are preserved
(#3993,
#4000,
#4013,
#4020,
#4035,
#4036).
Capabilities & Workflows
- User outcome: an addressed Agent can naturally understand a report
request and carry it into the governed report pipeline. Shipped layer: a
manifest-discovered provider adapter validates the exact source and records a
provider-neutral typed request. Last-mile boundary: the Agent still owns
semantic interpretation; configured delivery authority and provider readback
remain separate gates
(#4001,
#4037,
#4040). - User outcome: one setup flow can bind multiple Agents and Apps to a Goal
Channel and resume partial progress. Shipped layer: Lark owns membership,
mention validation and per-Agent App selection behind typed batch transport.
Last-mile boundary: group/app permissions and a live message round trip
still require provider authorization and exact readback
(#4004,
#4039,
#4046). - Reward Memory delivery guidance now fails open on irrelevant destinations,
proves destination matches, and rejects unsatisfiable required references
without granting send authority
(#4010,
#4011,
#4018,
#4030,
#4033). - Frozen executables can deliver version-bound workflow skills from the same
bundle, with no ambient checkout fallback
(#4063).
Quality & Testing
- Stage 2C CI now preserves full correctness coverage while running independent
E2E, installed-package, and mutant lanes in parallel
(#4064). - PR review policy now requires caller-observable semantic parity, executable
migration evidence, canonical producer evidence, design challenge, and
approval proof instead of accepting self-referential outputs
(#4017,
#4034,
#4057,
#4062). - Concurrent Todo add/update serialization is now explicitly covered
(#4048).
Benchmarks & Integrations
- The experimental external-agent subprocess bridge and
benchmark agent-phase
command were removed. Existing runners should invoke solvers directly; use
loopx turn planandloopx turn run-once --executeonly when a supported
host/adapter and independent validator provide governed execution. The
continuation decision, integrity, study, scoring, and result-file surfaces
are unchanged
(#4067). - The Workspace now distinguishes absent usage from measured zero, and binds a
Codex model to the exact snapshot event instead of inferring later context
(#4016). - DSH plugin metadata now names its canonical repository
(#4047).
No benchmark uplift, scoring change, leaderboard claim, or live-model result is
claimed by this release.
Community Contributors
- @now-ing — governed amendment/vision semantics,
post-writeback recovery, Todo identity, Desktop update safety, and Reward
Memory diagnostics
(#3883,
#3976,
#3978,
#3979,
#4000,
#4011,
#4020,
#4021,
#4022,
#4025,
#4026,
#4027,
#4030,
#4033). - @wchwawa — recoverable Stage 2C management and
writer-fence parity
(#3985). - @Duang777 — stricter lease/state/config
validation and fresh canonical reads
(#3993,
#4013,
#4035,
#4036). - @liubf21 — provenance-bound measured Goal usage
(#4016). - @huashuai — first contribution: localized
Workspace status projection
(#4019). - @steven-kid — visible Desktop startup progress
(#4041). - @KevinBarrus — first contributions: runtime
topology-drift detection and release-status alignment
(#4042,
#4043). - @AI-Scarlett — first contribution: canonical
DSH repository metadata
(#4047). - @xyx2002OvO — first contribution: concurrent
Todo mutation coverage
(#4048).
Documentation & Compatibility
- Existing Goal state and stable CLI contracts remain compatible. No provider
promotion or data migration is required. - The TypeScript migration RFC now makes compatibility and ownership transfer
expectations explicit; Stage 2 governed amendment proposals remain opt-in
and authority-neutral
(#3976,
#3883). - Desktop diagnostics export only bounded categories, exit status and identity
booleans—not raw logs, paths, environment variables, credentials, or Goal
content (#4014). - The experimental benchmark bridge migration is documented above and in the
versioned Benchmark Toolkit guide
(#4067).
Optional Capability Activation & Use
Agent-authorized periodic reports
Activation: Bind the exact Goal, Agent, App and Goal Channel; after the
Agent semantically decides that one addressed source message requests a report,
record that source with periodic-report request --execute.
Validation: Inspect the weekly profile, preview the exact request, and read
the pending consumer before executing it. A repeat must preserve the same
request and adapter owner.
Disable / rollback: This is a per-source action, not a persistent switch;
stop issuing requests. Disable the effective periodic-report subscription or
pause its host Automation to revoke recurring delivery.
Authority boundary: Source validation does not grant report generation,
network, credential, archive, or sink authority. Delivery still requires an
enabled subscription, exact route/sender binding, provider readiness and
readback.
Docs: https://github.com/huangruiteng/loopx/blob/v1.0.1/loopx/capabilities/periodic_report/README.md
loopx periodic-report inspect-profile --preset weekly --format json
loopx periodic-report request --goal-id "$GOAL_ID" --agent-id "$AGENT_ID" --source-ref "$SOURCE_REF"
loopx periodic-report request --goal-id "$GOAL_ID" --agent-id "$AGENT_ID" --source-ref "$SOURCE_REF" --execute
loopx periodic-report consume-pending --goal-id "$GOAL_ID" --agent-id "$AGENT_ID"Multi-Agent Goal Channel onboarding
Activation: In Workspace notification settings, choose one compatible Lark
App per registered Agent and save the connection batch for the selected Goal
and group.
Validation: Confirm every Agent/App binding and listener is ready in the
Workspace, then send a new addressed message and drain the exact Goal/Agent
inbox.
Disable / rollback: Choose Disconnect for that Goal connection. This
removes its route without deleting Goal state, sessions, history, Todos, or
other connections.
Authority boundary: Configuration is not provider authorization. The batch
preflights membership and permissions; capture scope and inbox mode do not
grant cross-topic or cross-Agent reply authority.
Docs: https://github.com/huangruiteng/loopx/blob/v1.0.1/docs/guides/personal-workspace-user-guide.md
loopx dashboard
loopx lark-inbox drain --goal-id "$GOAL_ID" --agent-id "$AGENT_ID"Completed-Todo review cadence
Activation: Preview and then apply a Goal-local completion threshold from
1–5; values 2 or 3 request earlier review.
Validation: Read execution_profile.replan_after_completed_todos back with
the settings inspection command.
Disable / rollback: Set the value to 5 to restore the shipped default.
Authority boundary: The setting only changes when LoopX asks for Goal
review after qualifying completions. It does not schedule a host, spend quota,
change task authority, or bypass writeback/evidence rules.
Docs: https://github.com/huangruiteng/loopx/blob/v1.0.1/docs/quota-allocation.md
loopx configure-goal --goal-id "$GOAL_ID" --execution-replan-after-todos 3
loopx configure-goal --goal-id "$GOAL_ID" --execution-replan-after-todos 3 --execute
loopx configure-goal --goal-id "$GOAL_ID"
loopx configure-goal --goal-id "$GOAL_ID" --execution-replan-after-todos 5 --executeFrozen-bundle workflow skills
Activation: A distributor builds a frozen executable with the complete
version-pinned share/loopx/skills tree; the operator installs those skills
from that executable.
Validation: Read back the same command without --install; expect
source.kind: frozen_bundle, ready: true, and the bundle's LoopX version.
Disable / rollback: Run workflow-skills --uninstall; to roll back, keep
the previous sidecar and reinstall its matching skills.
Authority boundary: Skill installation changes host command discovery
only. It does not enable schedulers, launch Goals, grant repository/network
writes, or search ambient Python installations when bundled data is missing.
Docs: https://github.com/huangruiteng/loopx/blob/v1.0.1/docs/guides/getting-started.md
loopx-sidecar workflow-skills --install --skills-dir ./host-skills
loopx-sidecar workflow-skills --format json --skills-dir ./host-skills
loopx-sidecar workflow-skills --uninstall --skills-dir ./host-skillsStage 2C authority shadow management
Activation: Enable the Goal-local file shadow, preview bootstrap, then
execute the exact bootstrap into an empty candidate lineage.
Validation: Inspect source/candidate parity and run bounded qualification;
candidate reads never become a decision source in this stage.
Disable / rollback: Preview and execute rollback with the exact provider
revision from inspect, then clear the Goal-local shadow setting.
Authority boundary: This is a default-off local qualification surface.
File, NoKV and PostgreSQL candidates are not promoted, and local canonical
state remains authoritative.
Docs: https://github.com/huangruiteng/loopx/blob/v1.0.1/examples/shared-goal-authority-e2e/correctness.md
loopx configure-goal --goal-id "$GOAL_ID" --local-authority-shadow-file --execute
loopx coordination-shadow bootstrap --goal-id "$GOAL_ID"
loopx coordination-shadow bootstrap --goal-id "$GOAL_ID" --execute
loopx coordination-shadow inspect --goal-id "$GOAL_ID"
loopx coordination-shadow rollback --goal-id "$GOAL_ID" --provider-revision "$REVISION" --execute
loopx configure-goal --goal-id "$GOAL_ID" --clear-local-authority-shadow --executeOutbound guidance recall
Activation: Enable the existing Agent-scoped Reward Memory experiment for
outbound_message.before_send, exact destination refs and automatic recall.
Validation: Read experiment status, then preview a Goal/Agent-bound Lark
send with provider preflight and no --execute.
Disable / rollback: Set automatic recall false or clear the Goal's Reward
Memory config and Agent allowlist.
Authority boundary: Recalled guidance is advisory and destination-bound.
It neither authorizes sending nor forwards raw outgoing message content into
the recall query.
Docs: https://github.com/huangruiteng/loopx/blob/v1.0.1/loopx/capabilities/reward_memory/OUTBOUND.md
loopx configure-goal --goal-id "$GOAL_ID" --reward-memory-config "$REWARD_CONFIG" --reward-memory-agent "$AGENT_ID" --execute
loopx reward-memory experiment-status --goal-id "$GOAL_ID" --agent-id "$AGENT_ID"
loopx configure-goal --goal-id "$GOAL_ID" --clear-reward-memory-config --executeDesktop recovery diagnostics
Activation: Install the signed stable Desktop build and open Recovery &
Updates when startup, runtime repair, or update installation fails.
Validation: Inspect the visible failure category and copyable bounded
diagnostics, then run package/runtime identity checks.
Disable / rollback: Use Restore previous version when a verified backup is
available, or reinstall the prior signed App and its matching runtime; restart
after recovery.
Authority boundary: Diagnostics exclude raw logs, environment variables,
paths, credentials and Goal content. Only explicit native actions install or
restore software.
Docs: https://github.com/huangruiteng/loopx/blob/v1.0.1/docs/guides/personal-workspace-user-guide.md
loopx --version
loopx doctor --deepInstall / Update
New and existing PyPI users use the package-native path:
python3 -m pip install --upgrade loopx
loopx workflow-skills --install
loopx slash-commands --install
loopx doctorExisting installs can preserve the active pip, pipx, or archive owner:
loopx update check
loopx update plan
loopx update apply
loopx doctor
loopx extension doctor --all-enabled --execute中文摘要
LoopX 1.0.1 重点修复 1.0 Workspace 的实际运行可靠性：多 Agent Goal Channel
建联可恢复，Agent 周报请求使用 typed intent 而非关键词识别，Desktop 故障可诊断，
更多 Todo 权限变更具备原子性与恢复路径。
- 在已绑定 Goal Channel 中，用户可以自然地 @ 指定 Agent 请求周报；Agent 负责语义
判断，LoopX 记录精确来源和 provider-neutral typed request
(#4001,
#4037,
#4040)。 - 一次选择多个 Agent 及其各自 Lark App，批量建联可在部分失败后安全续跑，并验证
bot mention、群成员与绑定
(#4004,
#4039,
#4046)。 - Desktop 恢复页提供受限、可复制的诊断，启动进度和更新 journal 处理更可靠；Goal
用量只展示真实测量值，不把缺失数据伪装成 0
(#4014,
#4016,
#4021,
#4022,
#4027,
#4031,
#4041)。 - Todo claim+lease、Markdown 投影恢复、Stage 2C 管理与 completion policy 形成更完整的
typed transaction 边界
(#3985,
#4032,
#4038,
#4044)。 - frozen host bundle 可交付同版本 workflow skills；Goal 可选择更早的 completed-Todo
review，默认值仍是 5
(#4063,
#4045)。
Replan 修复
- Vision fallback gap 在 frontier 中保持可见
(#3979)。 - post-writeback composition failure 保留来源身份和重试语义
(#3978,
#4025)。 - 短 Todo 链可以配置 1–5 次完成后 review；默认仍为 5
(#4045)。
升级决策
**谁需要升级：**使用 Goal Channel、周报、Desktop、Goal 用量、Reward Memory、
frozen bundle 或 Stage 2C 验证链路的用户应升级；不受这些路径影响的稳定 CLI 用户
可以按正常维护窗口升级。
**解决了什么：**本版本修复多 Agent 群建联、typed 周报请求、恢复诊断、用量来源、
Todo 权限/投影恢复和 workflow skill 安装一致性等 1.0 后的主要可靠性缺口。
**是否有破坏性变更：**无。受支持的稳定合同和已有 Goal 状态保持兼容。实验性的
loopx benchmark agent-phase 与 benchmark_toolkit.external_agent bridge 已删除；
受影响 runner 需直接调用 solver，或迁移到带受支持 host/adapter 和独立 verifier 的
Turn 合同。已有 result 文件不会被改写，Stage 2C 仍默认关闭。
**如何验证：**升级后版本与 doctor 应报告 1.0.1；weekly report profile 应保持
active/generation-allowed，workflow skill readback 应与当前安装包版本一致。
**贡献者：**本版本由 @huangruiteng 发布，并包含 @now-ing、@wchwawa、@Duang777、
@liubf21、@huashuai、@steven-kid、@KevinBarrus、@AI-Scarlett、@xyx2002OvO 的贡献；
详见下方社区贡献者。
loopx --version
loopx doctor
loopx periodic-report inspect-profile --preset weekly --format json
loopx workflow-skills --install
loopx workflow-skills --format json状态内核与控制面
- promoted Todo 可在同一 CAS 中完成 claim+lease；canonical journal 可恢复 Markdown
兼容投影；completion successor policy 归入粗粒度 TypeScript transaction
(#4032,
#4038,
#4044)。 - Stage 2C capture/rollback 加入管理锁、完整 cursor lineage、writer fence 与 typed
remediation；这只是默认关闭的候选验证，不会推广 file/NoKV/PostgreSQL authority
(#3985)。 - 损坏的 lease 过期时间、错误 boolean/numeric 输入 fail closed，同时保留 claim 拒绝
细节和新鲜 event-store 读取
(#3993,
#4000,
#4013,
#4020,
#4035,
#4036)。
能力与工作流
- **用户结果：**用户可在 Goal Channel 中自然地向 Agent 请求周报。已交付层：
manifest 动态发现 provider adapter，验证精确 source 后记录 provider-neutral typed
request。**最后一公里边界：**Agent 仍负责语义判断，交付权限和 provider readback
仍是独立门禁
(#4001,
#4037,
#4040)。 - **用户结果：**一次流程可绑定多个 Agent/App 并恢复部分进度。**已交付层：**Lark
extension 负责成员、mention、App 选择，LoopX 仅传输 typed batch。最后一公里边界：
群/App 权限和真实消息回环仍需 provider 授权与精确读回
(#4004,
#4039,
#4046)。 - Reward Memory guidance 对无关目标 fail open、校验 destination match，并拒绝无法满足的
required refs，但不授予发送权限
(#4010,
#4011,
#4018,
#4030,
#4033)。 - frozen executable 可从自身 bundle 交付版本绑定的 workflow skills，不会回退搜索
环境中的 checkout (#4063)。
质量与测试
- Stage 2C 的 E2E、installed-package 和 mutant lane 在不减覆盖的前提下并行
(#4064)。 - PR review 要求 caller-observable semantic parity、可执行迁移证据、canonical producer
证据、设计挑战与 approval proof
(#4017,
#4034,
#4057,
#4062)。 - 增加 Todo add/update 并发串行化覆盖
(#4048)。
基准与集成
- 删除实验性的 external-agent subprocess bridge 和
benchmark agent-phase。普通 runner
应直接调用 solver；只有具备受支持 host/adapter 和独立 verifier 时才使用
turn plan/turn run-once --execute。continuation、integrity、study、scoring 与已有
result 文件不变
(#4067)。 - Workspace 区分“缺失用量”和“真实测得 0”，Codex model 与精确 snapshot event 绑定
(#4016)。 - DSH plugin metadata 指向 canonical repository
(#4047)。
本版本不宣称 benchmark uplift、scoring 变化、leaderboard 结果或 live-model 收益。
社区贡献者
- @now-ing — governed amendment/Vision 语义、
post-writeback 恢复、Todo 身份、Desktop 更新安全与 Reward Memory 诊断
(#3883,
#3976,
#3978,
#3979,
#4000,
#4011,
#4020,
#4021,
#4022,
#4025,
#4026,
#4027,
#4030,
#4033)。 - @wchwawa — 可恢复的 Stage 2C 管理与 writer-fence parity
(#3985)。 - @Duang777 — lease/state/config 严格校验和 canonical
fresh read
(#3993,
#4013,
#4035,
#4036)。 - @liubf21 — 带来源证明的 Goal 用量展示
(#4016)。 - @huashuai — 首次贡献：本地化 Workspace status projection
(#4019)。 - @steven-kid — 可见的 Desktop 启动进度
(#4041)。 - @KevinBarrus — 首次贡献：runtime topology drift 检测与
release status 对齐
(#4042,
#4043)。 - @AI-Scarlett — 首次贡献：canonical DSH repository
metadata (#4047)。 - @xyx2002OvO — 首次贡献：Todo 并发 mutation 覆盖
(#4048)。
文档与兼容性
- 现有 Goal state 和稳定 CLI 合同保持兼容，无需 provider promotion 或数据迁移。
- TypeScript migration RFC 明确 compatibility/owner transfer；Stage 2 amendment proposal
仍 opt-in 且不增加 authority
(#3976,
#3883)。 - Desktop diagnostics 不包含 raw log、环境变量、路径、凭证或 Goal 内容
(#4014)。 - experimental benchmark bridge 的迁移路径已在上文及版本化 Benchmark Toolkit 文档说明
(#4067)。
可选能力启用与使用
Agent-authorized periodic reports
**启用：**先绑定精确 Goal、Agent、App 与 Goal Channel；Agent 对被 @ 的来源消息做语义
判断后，使用 periodic-report request --execute 记录该来源。
**验证：**检查 weekly profile，preview 精确 request，并在执行前读 pending consumer；
重复请求必须保留同一 request 与 adapter owner。
**停用 / 回退：**这是 per-source action，不是持久开关；停止调用即可。要撤销 recurring
delivery，关闭有效 subscription 或暂停对应 host Automation。
**权限边界：**source validation 不授予 report generation、network、credential、archive
或 sink 权限；交付仍需 enabled subscription、精确 route/sender、provider readiness 和读回。
**文档：**https://github.com/huangruiteng/loopx/blob/v1.0.1/loopx/capabilities/periodic_report/README.md
loopx periodic-report inspect-profile --preset weekly --format json
loopx periodic-report request --goal-id "$GOAL_ID" --agent-id "$AGENT_ID" --source-ref "$SOURCE_REF"
loopx periodic-report request --goal-id "$GOAL_ID" --agent-id "$AGENT_ID" --source-ref "$SOURCE_REF" --execute
loopx periodic-report consume-pending --goal-id "$GOAL_ID" --agent-id "$AGENT_ID"Multi-Agent Goal Channel onboarding
**启用：**在 Workspace 通知设置中，为每个 registered Agent 选择兼容 Lark App，并保存
所选 Goal/群的 connection batch。
**验证：**在 Workspace 读回全部 Agent/App binding 与 listener readiness，再发送新的
定向消息，并 drain 精确 Goal/Agent inbox。
**停用 / 回退：**对该 Goal connection 选择 Disconnect；不会删除 Goal state、session、
history、Todo 或其他 connection。
**权限边界：**配置不等于 provider 授权；batch 会预检成员与权限，capture scope 和 inbox
mode 不授予跨 topic/Agent 回复权限。
**文档：**https://github.com/huangruiteng/loopx/blob/v1.0.1/docs/guides/personal-workspace-user-guide.md
loopx dashboard
loopx lark-inbox drain --goal-id "$GOAL_ID" --agent-id "$AGENT_ID"Completed-Todo review cadence
**启用：**preview 后应用 1–5 的 Goal-local completion threshold；2 或 3 会更早触发 review。
**验证：**通过只读 settings inspection 读回
execution_profile.replan_after_completed_todos。
**停用 / 回退：**设为 5，恢复发布默认值。
**权限边界：**只改变 qualifying completion 后何时请求 Goal review；不调度 host、不花费
quota、不改变 task authority，也不绕过 writeback/evidence 规则。
**文档：**https://github.com/huangruiteng/loopx/blob/v1.0.1/docs/quota-allocation.md
loopx configure-goal --goal-id "$GOAL_ID" --execution-replan-after-todos 3
loopx configure-goal --goal-id "$GOAL_ID" --execution-replan-after-todos 3 --execute
loopx configure-goal --goal-id "$GOAL_ID"
loopx configure-goal --goal-id "$GOAL_ID" --execution-replan-after-todos 5 --executeFrozen-bundle workflow skills
**启用：**distributor 在 frozen executable 中打包完整、版本固定的
share/loopx/skills，operator 从该 executable 安装 skills。
**验证：**不带 --install 再次读回；应看到 source.kind: frozen_bundle、ready: true
和 bundle 的 LoopX 版本。
**停用 / 回退：**运行 workflow-skills --uninstall；回退时保留旧 sidecar，并重装与其
匹配的 skills。
**权限边界：**skill 安装只改变 host command discovery；不会启用 scheduler、启动 Goal、
授予 repository/network 写权限，也不会在 bundled data 缺失时搜索环境中的 Python 安装。
**文档：**https://github.com/huangruiteng/loopx/blob/v1.0.1/docs/guides/getting-started.md
loopx-sidecar workflow-skills --install --skills-dir ./host-skills
loopx-sidecar workflow-skills --format json --skills-dir ./host-skills
loopx-sidecar workflow-skills --uninstall --skills-dir ./host-skillsStage 2C authority shadow management
**启用：**开启 Goal-local file shadow，preview bootstrap，再向空 candidate lineage 执行
精确 bootstrap。
**验证：**inspect source/candidate parity 并运行 bounded qualification；本阶段 candidate
read 不参与 decision。
**停用 / 回退：**使用 inspect 返回的精确 provider revision preview/execute rollback，
随后 clear Goal-local shadow setting。
**权限边界：**这是默认关闭的本地 qualification；file、NoKV、PostgreSQL candidate 均未
promotion，本地 canonical state 始终权威。
**文档：**https://github.com/huangruiteng/loopx/blob/v1.0.1/examples/shared-goal-authority-e2e/correctness.md
loopx configure-goal --goal-id "$GOAL_ID" --local-authority-shadow-file --execute
loopx coordination-shadow bootstrap --goal-id "$GOAL_ID"
loopx coordination-shadow bootstrap --goal-id "$GOAL_ID" --execute
loopx coordination-shadow inspect --goal-id "$GOAL_ID"
loopx coordination-shadow rollback --goal-id "$GOAL_ID" --provider-revision "$REVISION" --execute
loopx configure-goal --goal-id "$GOAL_ID" --clear-local-authority-shadow --executeOutbound guidance recall
**启用：**为 outbound_message.before_send、精确 destination refs 和 automatic recall 启用
已有的 Agent-scoped Reward Memory experiment。
**验证：**读 experiment status，再用 provider preflight 且不带 --execute preview 一个
Goal/Agent-bound Lark send。
**停用 / 回退：**关闭 automatic recall，或 clear Goal 的 Reward Memory config 与 Agent
allowlist。
**权限边界：**recall guidance 只是 advisory 且 destination-bound；不授予发送权限，也不把
raw outgoing message 写入 recall query。
**文档：**https://github.com/huangruiteng/loopx/blob/v1.0.1/loopx/capabilities/reward_memory/OUTBOUND.md
loopx configure-goal --goal-id "$GOAL_ID" --reward-memory-config "$REWARD_CONFIG" --reward-memory-agent "$AGENT_ID" --execute
loopx reward-memory experiment-status --goal-id "$GOAL_ID" --agent-id "$AGENT_ID"
loopx configure-goal --goal-id "$GOAL_ID" --clear-reward-memory-config --executeDesktop recovery diagnostics
**启用：**安装 signed stable Desktop build；发生 startup、runtime repair 或 update installation
失败时打开 Recovery & Updates。
**验证：**检查可见 failure category 和可复制的 bounded diagnostics，再运行 package/runtime
identity check。
**停用 / 回退：**有 verified backup 时选择 Restore previous version，或重装上一版 signed
App 与其 matching runtime；恢复后重启。
**权限边界：**诊断不包含 raw log、环境变量、路径、凭证或 Goal 内容；只有显式 native
action 可以安装或恢复软件。
**文档：**https://github.com/huangruiteng/loopx/blob/v1.0.1/docs/guides/personal-workspace-user-guide.md
loopx --version
loopx doctor --deep发布验证
The exact release source is commit 7f2a020b18d1b5bb00da4044403ae72ddce2d743
with tree db6436c9ab3b5908844a128fe2a7201ec369da3d, package version
1.0.1, and expected tag v1.0.1. Its exact-source qualification is ready for
owner release: change-quality receipt cqr_5ca6f323681e60aed501, premerge
10/10, Linux pytest 6,640 passed / 31 skipped across two shards, native Windows
CI passed, all Stage 2C lanes passed, public smoke fleet 512/512, real Doubao
qualification 21 scenarios × 2 repeats with 6/6 contrasts, install/upgrade/host
validation passed, and the public/private boundary scan found zero violations.
Native Windows frozen execution was validated by repository CI and the Windows
desktop release lane rather than on this macOS host. All three exact-tag release
workflows completed successfully: Python artifacts were built, attested,
uploaded, and published through PyPI Trusted Publishing; macOS and Windows
desktop artifacts were rebuilt and verified; and the signed desktop update
manifest was published. An independent clean environment installed
loopx==1.0.1 from PyPI and read back distribution/runtime version 1.0.1.
The stable branch was then fast-forwarded to the exact tagged candidate. This
full body was read back from GitHub and revalidated against the bilingual
capability-usage and public/private-boundary gates.