feat(goal-channel): compose scoped claims and private reconnect context (#5198)

[LIHUA919]

Result and scope

Related to #5198 (S3/S6/S9). Integrated head: 784e41bb687288f75c565ed176e740a65f5c3214; base: main at be15bf4ffb3bf354fb255853a96f14b047874bb8. The stated main base was merged append-only with a signed merge commit; the proposal changed 28 files relative to that base. This proposal joins existing Goal Channel delivery, canonical Todo claims and private read-only Turn Recall. It delivers the local legacy-profile stage; the full live collaboration acceptance remains open.

goal-channel work project|claim publishes content-minimal orientation and historical claim receipts with current ownership. offer|revoke grants one revision-bound native claim interaction to explicit principals; the existing default-off collector verifies provider membership, originating card, source route, registered Agent, binding and expiry. Exact retries recover the canonical receipt; transport recovery only repairs the result card.

work resume reads current channel identity, canonical work and an admitted Turn, retrieves scoped context anew, then rereads authority and quota. Changes discard earlier observations, context and references. Only explicitly requested scoped artifact pointers covered by current verified recall receipts are carried. The private packet sends no room message, accepts no claim, renews no lease, spends no quota and skips memory-ingest reconciliation.

Ownership and compatibility

Reuse the existing typed Todo, Goal Channel, collector and recall owners. No new store, provider, scheduler or configuration editor. Existing Agent connection and Reward Memory editors remain sufficient for this explicit CLI path. No authored frontend or public first-screen change; native card screenshots remain unqualified.

Promoted direct claims deliberately reject foreign bound_agent. Both existing claim wire versions and the domain owner reject explicit unqualified goal_ref before provider or historical-receipt access. Source-session business effects remain closed: lifetime-bound head/receipts, retirement serialization and old-writer fencing must first qualify under the existing shared-authority/Goal-instance owners. That later profile boundary is not a prerequisite for the supported legacy-profile local stage.

Future-facing pass: reuse shared typed admission/readback and the public quota loader; keep private offers outside Todo lifecycle authority. Collector feature-off behavior and ordinary recall defaults remain unchanged.

Validation

Synthetic Lark/provider transport and disposable real File/SQLite stores; no active Goal was promoted or used for testing.

• 110 room/claim/callback/restore regressions passed. Competition now uses two source CLI processes with separate TS runtimes; a new client/runtime retries the winning tuple, followed by separate direct CLI ownership readback. One transition and one result card; no private content or execution grant.
• 58 outbound-guidance and runtime UTF-8 checks passed after repairing a stale loader mock and explicit UTF-8 offer reading. Changed Python Ruff and diff checks passed.
• At integrated head 784e41bb687288f75c565ed176e740a65f5c3214, 177 focused room/claim/reconnect, registry-I/O and Lark callback Python tests passed; 22 focused TypeScript tests, control-plane typecheck and diff checks passed. A local merge-tree check against current main dbbca15b5 found no conflict. This qualifies the source path only; live Lark/OpenViking acceptance remains open.
• Previous-head Python Tests on a23d368f1 completed red: 69 failed test IDs and terminal reasons all matched its integrated main base, which had 70 failures. No PR-only Python failure appeared in those two runs; that does not make the new head green.
• Exact-head Python Tests on 784e41bb6 completed red: shards 1, 2 and 4 failed, shard 3 was cancelled, and pytest/merge-gate failed downstream. The available failed-job log shows nine failed test IDs across source-session registry denial, status rollout snapshots and Lark reply handoff. A focused local run reproduced those failures on both this head and its exact integrated base be15bf4ffb3bf354fb255853a96f14b047874bb8 (11 failures and 15 passes on the same selected set in each checkout). This attributes the observed failures to the integrated baseline, without claiming the cancelled shard or the full suite is clear. DCO, PostgreSQL Integration, Frontstage Pages, Release Artifacts and Dependency Review succeeded. GitHub reports MERGEABLE, but the PR remains draft and review is required; remote green CI and merge readiness are not claimed.

Negative coverage includes stale/duplicate claims, revoked principals/Agent/binding, Bot/message/card mismatch, expiry, authority loss, retrieval-time scope/quota/selection/revision changes, expired/foreign memory and read-only ingest isolation. No PostgreSQL provider changed; local evidence does not qualify shared-service operation.

Remaining gates

Keep draft status and maintainer merge ownership. Untested: authorized native non-production rendering/listener, independently authenticated hosts, live daemon reconnect, scoped OpenViking retrieval and arbitrary external artifact target access. Reuse #3245, #4339 and #3964 for their existing authority, handoff and provisioning boundaries. A merged PR alone does not close #5198 or the RFC.

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @LIHUA919.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @LIHUA919.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @LIHUA919.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork