[hhyykk]

Goal And Delivered Outcome

Native Codex context delivery currently crosses the TypeScript boundary separately for progressive planning and delivery preparation, with Python applying the required-context view between them. This change composes the existing planner, required-view projection and full/delta encoding in one context_delivery transaction.

• Outcome basis: follow-up to fix(control-plane): bound large quota planning requests #7616 and the native-delivery portion of docs: unify work contracts and design controller/executor sessions #7416.
• Before → after: two typed preparation requests become one; replaced Python planning/application helpers and the intermediate dispatch are retired. Python keeps the session lock, host observations and immutable capture publication.
• Intended base: main at 21367015cce45294dcf99f54a3211d66f5d842c5.

Author Declaration

• Written by: model_agent — OpenAI Codex, GPT-6 family; submitted by hhyykk.
• Specification and revision: docs/architecture/rfcs/controller-executor-unified-contract-v0.md, native-delivery continuation in this PR; English and Chinese counterparts updated together.

Criterion	Disposition	Owning boundary	Evidence
Reuse the existing typed planner and delivery codec	implemented	progressive_context.ts, context_delivery.ts, turn_envelope.ts	Focused Python/TypeScript and native integration checks below
Preserve complete required reads, numeric spellings, recovery, original Turn and once-only settlement	implemented within tested profiles	TypeScript projection-edit transport and Python host publication	File/SQLite native sessions and failure/recovery checks below
Preserve the feature-off path and host-owned IO	implemented	turn_driver/codex_context.py	Focused parity and recovery regressions
Complete performance and repository acceptance	not_met	Whole CLI and repository gates	Full A/B still running; previous full CI failed

Scope And Continuation

The C2 implementation is complete for this single-session native-delivery slice. It does not close broader C1/C2 host adoption, multi-session coordination or long-horizon effectiveness acceptance. Recovery publication remains before optional typed preparation, and a required view is published before its encoded delivery is returned.

The branch is based on current main. Its nine task files are byte-identical to the previously tested implementation e42c536e609ba383217a3e83b8cf07c72542944c; integration with the intervening main changes needs fresh GitHub CI. No merge is requested.

Validation

• Submitted revision: b9360fb7f0315f32fa0b0dcdbe4dd225ad70c2b6.
• Prior tested implementation: e42c536e609ba383217a3e83b8cf07c72542944c against 04c5799b88f6c4cf12a224b7fa679f272e1e794e.
• Run state: running. Input classes: synthetic.

Check kind	Result	Evidence / limitation
static / unit	passed on prior implementation	772 Python tests, 123 TypeScript tests; 7 expected opt-in skips; Ruff, mypy, TypeScript and minimum Node 22.22.3 checks passed. Quality workflow. This does not make the complete workflow green.
real_entrypoint / integration	passed on prior implementation	Six scripted native cases across baseline, candidate and installed entrypoint; 58 installed import origins and 1,900 selected runtime files checked. This is scoped installed-runtime parity; inherited packaging omissions remain.
real_backend / regression_parity	passed within fixed profiles	16 native model sessions across real File/SQLite fixtures checked full/delta/supporting/recovery reads, original-Turn identity and one bound settlement. No PostgreSQL qualification or all-host adoption claim.
actual model consumption	passed for fixed aggregate criterion	Matched 16-session cohort: 4,235,693 baseline tokens versus 4,087,662 candidate tokens, including compaction (-3.49%). Four individual pairs increased. Prior incomplete diagnostic attempts are retained separately and excluded from this matched comparison; this is not a per-case, universal or hidden-provider-billing guarantee.
performance	running / not qualified	Previous hosted 32-slot run met only 3/8 frozen case scores. A subsequent single-host baseline precision check passed: p50 3.58 ms and p95 23.52 ms resolution against 25 ms caps. A new full single-host 32-slot A/B is running; its scope differs from hosted replication and no final performance pass is claimed.
full repository CI	failed on prior implementation; fresh CI pending	Previous exact-head workflow: four Python shards failed and two were cancelled. Selected failures reproduce on the exact baseline in matched local checks; that does not waive the repository gate.
RFC / diff hygiene	passed on submitted revision	python3 scripts/check_rfc_bilingual.py --base origin/main --head HEAD; git diff --check origin/main...HEAD; DCO sign-off present.

Coverage gaps: full performance acceptance, fresh integration CI, broader host adoption and complete packaging qualification remain open. This proposal is not merge-ready.

Frontend / Visual Evidence

• UI impact: none. This changes internal context preparation, not a visual surface or public CLI option.
• Visual evidence: N/A.

Type of Change

• Refactoring (preserves caller-visible context semantics)
• Documentation update
• Test update

LoopX Area

• Control plane
• Host or runtime integration

Shared-authority RFC Fixture Impact

• Production-scale fixture dimensions: native full/delta/required views, large numeric spellings, recovery publication and original-Turn settlement; File/SQLite and history 0/500 in the performance matrix.
• Provider conformance: real File/SQLite fixtures exercised; no authority-store schema, provider-selection or writer-routing change.
• Legacy/File/PostgreSQL promotion rehearsal: not performed; this PR does not promote a store or change authority routing, and claims no PostgreSQL qualification.

Boundary Checklist

• Diff and description contain public-safe summaries, not private state, raw traces, credentials or local machine paths.
• Existing planner/codec owners are reused; no parallel benchmark or domain owner is introduced.
• Scope remains the native-delivery transaction slice.
• English/Chinese RFC changes are paired and the bilingual diff check passes.
• UI impact is none.
• The PR commit includes a DCO sign-off.

[songoow]

Reviewer: model_agent — GPT-6 Astra Pro — OpenAI — self_reported

动机 / Motivation

受影响的是通过 Codex 原生上下文继续执行长期任务的 Agent，以及需要控制每轮交付开销的维护者。 原路径先跨语言请求投影计划，由 Python 应用计划，再跨语言编码；新路径一次调用现有 TypeScript 所有者，Python 继续负责加锁和保存不可变文件。 同一真实 context-project 合成输入的准备请求由两次变一次；完整要求、大整数、原 Turn、支持材料及失败后的当前恢复均保持一致。 本次范围是单会话原生交付的内部组合；不增加执行权限，不完成两会话协作或 C1/C2 全部验收，也不证明通用 token 或长期结果收益。

本次覆盖 head b9360fb7f0315f32fa0b0dcdbe4dd225ad70c2b6 相对 base 21367015cce45294dcf99f54a3211d66f5d842c5 的完整九文件。没有确认的阻塞性生产代码缺陷；结论为 REQUEST_CHANGES（验证保留）。完整性能验收尚无最终通过结果；当前命令面板浏览器超时尚缺不可变 base/head 同条件归因。 Pending 的 Python 分片本身不是这次结论的理由。

改动思路 / Approach

复用现有 progressive planner、context codec 和 source-edit transport，将中间投影移动到同一 TypeScript 调用；文件发布与会话锁留在 Python 宿主适配器。 当前 PR 只替换原生调用链的两段准备流程，保留完整来源、原有 recovery 和 feature-off 路径；普通非原生 codec 调用继续共用同一编码器。 不改动会保留两次重复准备；把文件发布也搬入新 owner 会扩大宿主边界；再写一套 native codec 会增加双份语义。当前方案删除了旧 Python 计划应用和独立 dispatch，在现有 owner 内组合，边界合理。

下面是源码路径对照，执行证据见后文；它不是性能测试结果。

时点	base	当前 head
进入可选处理前	先保存完整当前 recovery	相同
准备上下文	TS 计划 → Python 应用 → TS 编码	同一 TS 调用内计划、应用、编码
返回前	保存 required view，并绑定当前 target	相同
可选 runtime 不可用	完整当前来源继续可恢复	相同

没有新增业务状态或需要用户维护的声明。native_projection 来自刚保存的原始捕获，projected 是本次计算结果；它们不形成另一本真相账本。普通调用仍经同一 encoder，旧原生 planning operation 的全仓源码搜索未发现遗留调用。

具体改动 / Changes

关键代码讲解

• project_codex_context 保留会话锁，先发布完整当前恢复引用，再调用一次 typed preparation；只有需要投影视图时另存 required capture，成功后才更新 target/pending。runtime 不可用不会把恢复引用退回旧捕获，也不重跑准入。
• requiredNativeContext 复用旧 planner，逐层复制被修改的容器，并给原数值字段保留 source path。只对既有已知内容作支持材料延后和重复记录引用；未知形状、数值区别、没有实际字节收益的结果保持完整。
• prepareProgressiveContextDelivery 将 required view、数值连续性检查和 encoder 合在同一调用，用既有 source edits 返回 Python 原始值。没有把恢复文件的发布或会话权限交给纯投影函数。
• encodeContextDelivery 是从原函数抽出的共享编码器。scope/epoch/digest、full fallback、delta 大小和重建校验保留；普通 wrapper 与 native wrapper 共用，而不是并存两套完整 codec。

规范依据为基线 docs/architecture/rfcs/controller-executor-unified-contract-v0.md，完整 revision 21367015cce45294dcf99f54a3211d66f5d842c5。C2 的单一管线在这次原生切片已接入真实调用；Lossless context delivery 的完整来源、数值及失败恢复在下列局部路径验证。Outcome and cost benefit 继续留在现有 C1/C2 验收，不能由请求数或包体缩小代替。这里使用 RFC 原有行标题定位要求，没有把本 PR 新添的说明用作自证标准。两份 RFC 的新段落如实说明这个边界。

独立验证

我在固定 base 和 head 对同一完整合成输入调用真实 quota context-project，覆盖设置省略、显式 off、显式 on、错误摘要以及发布 recovery 后 typed runtime 不可用。五组 exit/result 与恢复正文观察一致，原始文件不变且没有创建业务 registry/runtime；启用路径的 preparation 请求从 progressive_context_plan + context_delivery 两次变为仅 context_delivery 一次。输入包含 9007199254740993，required view 和原始支持材料精确保留。路径相关元数据仅在独立核验原文及 SHA-256 后归一化，未归一化要求、Stop、原 Turn 或数值。

• PASS：test_progressive_native_context.py 与 test_saved_context_project.py 共 64 passed，覆盖真实 CLI、File/SQLite 路径、warm/full/delta、compaction、错误摘要、进程退出和当前 recovery；7 个 opt-in 原生 host profile skipped，不能写成已验证。
• PASS：TypeScript progressive_context.test.ts 与 context_delivery.test.ts 共 37 passed，无 skip，包含原型键、数组重排、未知内容和共享 codec。
• PASS：变更 Python/test 文件 Ruff 与 git diff --check。九个文件 Git blob SHA 全部等于远端该 head；没有把重建工作树误称为另一份提交。
• 首次受限沙箱测试因本地 TS socket 被拒绝而失败，诊断为 EffectRuntimeHostPermissionError。在允许该隔离测试本地 runtime 后执行上述最终通过集；没有改产品代码、断言或超时预算。

本轮没有重跑付费模型实验、整套仓库 CI 或七个 opt-in 原生 profile。作者所报16会话聚合 token 从4,235,693到4,087,662（-3.49%）属于其固定 cohort，且四对增加；本轮只阅读该声明，不把它当作独立复现或通用收益。

对主干的风险 / Risks

最值得防守的回归是可选优化失败后恢复旧事实，或 JS 数值转换改变约束。当前完整 recovery 的发布顺序、source edits 和独立实读支持这两项保证；缺失/未知内容也未被当作无义务。普通 off 路径在已有有效 native cache 的条件下仍与 base 相同，不是只凭响应里没有一个 feature 字段来判断隔离。移动的 supporting-material instruction 逐句相同，保留依赖事实先读取、同一不可变来源、detail 不建立完整 baseline、Agent review 不等于独立 acceptance 的限定。

语义与 CI 对齐

当前chat-bundle-browser (3) 的真实失败是 workspace-command-palette-browser-smoke.mjs:79 等待 todo=showcase-map-columns 导航时 page.waitForURL 超过原30秒。日志前面的 packaged workspace 主场景已通过；后面的命令面板场景失败。checks 只是要求该 browser job 成功的聚合检查，不是第二个生产代码缺陷。

九文件没有浏览器实现改动，但这不足以自行宣布失败与 PR 无关。当前还缺相同条件、不可变 base/head 的该失败签名归因；本轮 context 测试不覆盖这次浏览器导航条件。最小补齐是同命令同条件对照或能独立覆盖这个当前风险的有效证据，保留原30秒预算。若证实为基线/外部问题，按现行 policy 将它作为单独 merge hold，无须让此 PR 修无关代码。

性能也应继续使用已声明的固定 workload/criteria：作者当前说明先前 hosted 运行只过3/8 case scores，后续单机32-slot A/B 尚未结束。本轮证实两次变一次，不能补足完整延迟、峰值、总读取、模型采用及重试成本。不要调整阈值或把只剩一个 RPC 当性能验收完成；现有 PR 补结果即可，不需要再开一个重复 context PR。

我的整体评价 / Verdict

这是有实际调用方、可局部回滚的 C2 原生交付增量，owner 复用和删除旧路径的方向合理。长期继续执行与既有用户操作路径在已验证范围内保持，既没有新增确认步骤，也没有把 context 完整性当成新的执行权限。改动涉及内部 TypeScript/Python 交付与 RFC，没有修改渲染页面；已检查全部九文件，视觉截图不适用。

当前 REQUEST_CHANGES 针对上述尚未归因的 browser 失败与尚未完成的性能资格，不是确认了新代码 bug。全部语义沿用现有 vocabulary/source owner；不要求借此重写其他宿主或完成父 RFC。补齐具体证据后在同一 PR 复核，无需仅因 pending 分片重复宽测；合并权限、部署和完整长程收益仍是独立事项。

English verdict: REQUEST_CHANGES — exact head b9360fb; no confirmed production defect found. Public baseline/head parity, 64 Python cases and 37 TypeScript cases pass; current browser-failure attribution and final frozen performance qualification remain incomplete.