fix(work-items): read progress-review digests through the canonical owner

[JasonBuildAI]

Goal And Delivered Outcome

• Outcome basis / optional anchor: reproduced defect — the required TypeScript
  architecture guard on current main reports three restatements of the bare
  SHA-256 shape, and the merged required check fails because of it.
• Goal/source and gap: loopx/control_plane/work_items/progress_review_evidence.ts
  states /^[a-f0-9]{64}$/ itself for criteria_sha256, contract_digest and
  todo_semantic_digest instead of reading that shape from its owner
  loopx/control_plane/content_digest.ts, so a second owner of the same policy
  exists and the guard refuses the head. main currently carries the failure:
  typescript-core (1/3) ends # fail 1 and checks fails with
  ValueError: typescript-coverage must be success, which makes merge-gate
  red for every pull request based on current main.
• Observable before → after, with the validation row that proves it: the same
  guard command reports one failing assertion listing the three sites before the
  change and # pass 17 / # fail 0 after it (rows regression_parity and
  integration).
• Issue/task and intended base: Closes [Bug]: main's TypeScript digest-owner guard fails — progress_review_evidence.ts restates the bare SHA-256 shape #6117. Intended base main.

Author Declaration

• Written by: model_agent — an OpenAI Codex agent working in the fork owner's
  worktree at the owner's request, under the owner's direction and review.
• AI disclosure: this change was drafted with AI assistance at my request, under
  my direction and review.

Implemented against

• Specification and revision: the digest owner loopx/control_plane/content_digest.ts
  ("one owner for the two shapes a stored SHA-256 digest takes in a record") and
  its TypeScript guard tests/control_plane_ts/content_digest_single_owner.test.ts,
  as they stand at the worktree base c2b17b3e1 (current main 27090f049
  carries the same file contents for both).
• Criteria:

Criterion (spec clause)	Disposition	Symbol / path	Test or command
A second whole-value digest matcher must not be reachable outside recorded exceptions	implemented	BARE_SHA256_PATTERN in loopx/control_plane/work_items/progress_review_evidence.ts	tests/control_plane_ts/content_digest_single_owner.test.ts
The owner's readers are a pinned set, each reading a canonical export	implemented	CANONICAL_CONSUMERS in the same guard	same guard
The accepted digest shape must not change	implemented	same three fields	tests/control_plane_ts/progress_review_evidence.test.ts

• Self-check before submission: I read the guard, the owner module and the three
  call sites, and confirmed the two spellings admit the same digests (same
  character class, one anchored group, no flags), so no accepted or rejected
  input changes. I did not touch the unrelated pre-existing failure in
  tests/architecture/test_content_digest_single_owner.py, and I did not move the
  dashboard call sites, which the guard does not scan.

Scope And Continuation

• Completed scope and remaining work: complete within this scope. The guard
  passes again on the repaired head, and the module reads the shape from its owner
  as the guard requires.
• Slice boundary / successor: N/A. The failing required check named one cause and
  this change removes it. A separate platform observation — the guard's
  PACKAGE_ROOT uses new URL(..., import.meta.url).pathname, which does not
  resolve on Windows, so the guard cannot run there — is not part of this change
  and is reported as a limitation below rather than silently bundled.

Validation

• Tested revision: c772d8435d18564a2df46d5486df02ba0ebfe8ea
• Run state: finished
• Input classes: synthetic

Check kind	Result	Public-safe evidence / limitation
static	passed	npm run typecheck:control-plane on the tested revision: exit 0, no diagnostics.
integration	passed	node --no-warnings --experimental-sqlite --experimental-strip-types --test tests/control_plane_ts/content_digest_single_owner.test.ts → # tests 17, # pass 17, # fail 0. This is the guard whose failure is the defect.
regression_parity	passed	Same guard file, same machine, before the change: 1 failing assertion with control_plane/work_items/progress_review_evidence.ts:50, :56, :58. After the change: 17 pass. The pre-existing failing run on the merged head is public: https://github.com/loopx-project/loopx/actions/runs/38026035693 (typescript-core (1/3), not ok 233, # fail 1).
unit	passed	node --no-warnings --experimental-sqlite --experimental-strip-types --test tests/control_plane_ts/progress_review_evidence.test.ts → # tests 2, # pass 2, # fail 0.
static	failed	Adjacent Python guards: uv run --extra test python -m pytest -q tests/architecture/test_content_digest_single_owner.py tests/architecture/test_content_digest_production_owner.py → 252 passed, 1 failed (test_no_consumer_holds_a_regex_this_file_cannot_read, cli_output_semantics). That row also fails on unmodified main at the same base commit, so it is pre-existing and unrelated to this TypeScript-only change; it is left alone.

• Coverage and gaps: the changed production line is covered by the guard that
  named the defect, and the module's own behavior test still passes. Limitation:
  the guard file cannot resolve its package root on Windows
  (new URL("../../loopx", import.meta.url).pathname yields /D:/..., and the
  joined path becomes D:\D:\...), so my local before/after runs needed a
  local-only, uncommitted path adjustment on this Windows host; the authoritative
  run of the unmodified guard is the Linux typescript-core job, which this pull
  request triggers.

Frontend / Visual Evidence

• UI impact: none

Rebase Addendum (2026-10-10)

• Merge conflict with main resolved by rebasing onto upstream/main at 5de71093c. The only conflict was two adjacent additions to CANONICAL_CONSUMERS in tests/control_plane_ts/content_digest_single_owner.test.ts (replan_context.ts from main, progress_review_evidence.ts from this PR); both are kept, in sorted order. No other conflicts.
• Additional main-introduced failure surfaced after the rebase: control_plane/capabilities/goal_capability_organization.ts:94 restated the stored SHA-256 envelope /^sha256:[a-f0-9]{64}$/u instead of reading the owner (commit 30d244002, merged to main after this PR opened). The single-owner guard reports that site, so the required typescript-core check stays red even with the original three-site fix. This branch now also reads ENVELOPED_SHA256_PATTERN from loopx/control_plane/content_digest.ts and pins that module in CANONICAL_CONSUMERS.
• Re-validated on base 5de71093c: content_digest_single_owner.test.ts -> 17 pass / 0 fail; goal_capability_organization.test.ts 11 pass; progress_review_evidence.test.ts 2 pass; npm run typecheck:control-plane exit 0.
• Head: 084b985bb. Commits: e77bc42a2 (original fix, rebased) and 084b985bb (second offender). Both keep the DCO Signed-off-by trailer.

English: the main merge conflict is resolved by rebasing onto the latest main; a second, main-introduced digest restatement (goal_capability_organization.ts:94) is also fixed so the required TypeScript digest-owner guard (typescript-core) can go green.

[loopx-agent]

Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; reasoning_effort=xhigh

Independent review of exact head c772d84, immutable base c2b17b3.

动机

维护贡献者需要让持续集成中的摘要校验架构检查恢复，并保持现有进度回执的合法输入和拒绝规则。 原有检查发现三个调用点各自重复定义同一种摘要格式并停止；复用唯一规则后检查恢复通过，合法回执仍可读取，非法摘要和跨任务绑定仍会拒绝。 独立验证了未经修改的架构检查从 base 的一项失败恢复为 head 全部通过，并通过真实 TypeScript 运行进程和文件回执证明行为保持。 本 PR 只归一三个摘要格式校验及其消费者登记，不修改进度判断、模型调用、权限、调度或回执格式；未查询远端 CI。

改动思路

三个校验点属于既有 TypeScript 摘要 owner；直接导入无状态的公共正则，删除重复定义，是最小且完整的归一。 本 PR 边界为格式规则与消费者登记共同修复，保留原解码、绑定校验和文件读写 owner，不扩成迁移或新能力。

先读取 issue #6117 的原文；spec_ref: github:loopx-project/loopx:issue:6117；spec_revision: issue-6117-body-sha256:e1b7967b077937743b26aba7a99018194bda2714863e51af3fa7894001fcdf14。验收项：single-owner — The three fields are validated through BARE_SHA256_PATTERN from the owner.; pinned-consumer — The module is added to the guard's pinned CANONICAL_CONSUMERS.。这是既有调用入口的有界修复，不新增父 roadmap 验收或权限。仓库召回的分阶段恢复 RFC 经验在本变更不适用；实际用户结果仍独立判断，不声称召回已证明长期收益。

具体改动

1. progressReviewEvidenceScope 保留 coverage、相对文件路径、origin 和 Goal/Agent/Todo 绑定校验，仅将 criteria_sha256、contract_digest、todo_semantic_digest 三处字面正则改用同一个公共导出。返回字段、校验顺序和异常类型不变。
2. BARE_SHA256_PATTERN 仍是锚定的 64 位小写十六进制，没有 g/y 等可变匹配状态。字符类书写顺序不同不构成另一种格式。
3. 既有架构检查的 CANONICAL_CONSUMERS 增加真实消费者，不缩小扫描根、不添加重复规则豁免。生产 lazy handler 和 Python receipt normalization/write/load 继续复用现有调用链。

正向路径：合法当前绑定 → 真实 Python→TypeScript 请求 → 规范化 scope → 回执写文件 → 独立加载。负向路径：非法摘要、跨 Goal/Agent/Todo、路径越界 → 完整既有 typed 错误；非法回执首次写入没有文件，修正后写入、读回及重写稳定。

对主干的风险

未经改写的 TypeScript 本地检查 base 为18通过/1失败，完整列出原三个重复规则；head为19通过。36类相同输入在真实 TypeScript runtime 每类重复3次，完整结果/错误一致；真实临时文件回执的规范化、独立加载、拒绝无文件、重写字节相同。两边完整 control-plane typecheck通过。语义 diff advisory无支持范围内的新词汇，完整 semantic smoke通过；空 advisory不等于语义安全证明。

相邻 Python检查两边都是262通过/同一项失败，完整失败身份为 cli_output_semantics.py 的 line50 search BinOp 无法被旧静态扫描折叠。此 PR不触及该逻辑，改变的 TypeScript 格式不变量有独立通过证据；保留此既有失败，不声称修好了它。首次额外矩阵因我的末尾换行预期写错在两边中止；修正脚本预期后完整矩阵通过，原失败记录保留，产品源码与测试未更改。原生 Windows guard URL pathname 问题未在本机验证/修复，不冒充跨平台资格。没有数据库 owner改动或模型调用，未把观察当作授权。

标准 risk-based premerge 针对完整 diff 的 13 项选择检查及 3 项直接检查全部通过；无 manual hold，公共边界按本次分类覆盖。 使用不可变 base 与实际 head，原始失败及未测保留。最新 main 对本 PR 相关 owner 与协议路径无额外改动，没有继承旧 head 的批准。第一次 premerge 参数使用了不支持的 --changed-from，在任何检查前被 parser 拒绝；按现有 help 改用 --git-diff-base 后执行，未改产品或 gate。

我的整体评价

APPROVE。单一 owner 维护收益和真实回执行为保持都有证据；相邻 Python 旧失败单独保留。相关未来维护检查已采用删除三处重复规则，不需要新增抽象或迁移任务；不会把批准视为运行时合并授权。 三个校验点属于既有 TypeScript 摘要 owner；直接导入无状态的公共正则，删除重复定义，是最小且完整的归一。 本 PR 边界为格式规则与消费者登记共同修复，保留原解码、绑定校验和文件读写 owner，不扩成迁移或新能力。

English verdict: APPROVE - c772d84. The unmodified TypeScript owner guard recovers from18pass/1fail to19pass;36 real RPC input cases repeated3times and actual file receipt write/load/rewrite preserve full results and errors. Both typechecks and semantic checks pass. The identical unrelated Python guard failure is retained; no CI consulted or merge performed.

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @JasonBuildAI.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[JasonBuildAI]

冲突已解决 —— 先说明这条评论的含义

截图里的评论来自 mergify[bot]，它是自动化的合并冲突提示，不是有人在评审这份代码，也没有要求改代码。它的意思只有一句：这个分支和最新的 main 有冲突，需要 rebase/merge 到最新 main 解决后才能合并。按它给的步骤处理即可。

已处理

• 在干净的 worktree 里把分支 rebase 到最新 upstream/main（5de71093c）。
• 唯一冲突在 tests/control_plane_ts/content_digest_single_owner.test.ts 的 CANONICAL_CONSUMERS：main 新增了 replan_context.ts，本 PR 新增了 progress_review_evidence.ts，两者插在同一位置。保留两条、按字母序排列即可，无其它冲突。
• 两个提交都保留 DCO Signed-off-by。
• 现在 PR 的 mergeable 已从 CONFLICTING 变为 MERGEABLE，冲突消除，只剩必需的检查/评审门禁。

顺带发现并修复了 guard 的第二个失败（否则本 PR 仍会红）

rebase 后我在最新 main 上跑了这个 TypeScript guard，发现除了本 PR 修的那三个 bare 摘要，它还有一个独立失败：

not ok 1 - no second whole-value digest matcher ... 
actual:   'control_plane/capabilities/goal_capability_organization.ts:94 /^sha256:[a-f0-9]{64}$/u'
expected: []

它来自 main 上较新的提交 30d244002（本 PR 打开之后才合入 main）：planCapabilityImprovement 又把 sha256: envelope 形态写死，而没有读 owner。只 rebase 不修这个，typescript-core 依旧失败、本 PR 依然无法合并，所以我在本分支追加了一个同样最小、行为保持的提交：改用 owner 的 ENVELOPED_SHA256_PATTERN，并把该模块登记进 CANONICAL_CONSUMERS。

验证（基于最新 base 5de71093c）

• node --test tests/control_plane_ts/content_digest_single_owner.test.ts → # pass 17 / # fail 0（rebase 前同一 guard 有 1 个失败：goal_capability_organization.ts:94）
• goal_capability_organization.test.ts 11/11、progress_review_evidence.test.ts 2/2 通过
• npm run typecheck:control-plane 退出 0

提交：e77bc42a2（原修复 rebase 后）、084b985bb（第二个重复形态修复）。

两点说明：

1. 本机是 Windows，guard 里的 PACKAGE_ROOT = new URL(..., import.meta.url).pathname 在 Windows 上会解析成 D:\D:\...，这是既有平台限制；我为本地验证只用了临时改 fileURLToPath 的副本运行，PR 中该行未改动，Linux CI 不受影响。
2. 如果维护者更希望把第二个修复拆成独立 PR，我可以立即拆出；否则这个分支已经是最新 main 上的最小完整修复。

English: the mergify comment is an automated merge-conflict notice, not a code review. Rebased onto latest main and resolved the single CANONICAL_CONSUMERS conflict; also fixed a second, main-introduced digest restatement (goal_capability_organization.ts:94) so the required typescript-core guard can pass. Guard 17/17, typecheck clean.

[loopx-agent]

Reviewer: model_agent; runtime_reported; gpt-6.1-sol; OpenAI; reasoning_effort=xhigh

动机

维护者在为正常代码改动执行完整 TypeScript 检查时，会被四处重复的摘要格式定义挡住。 主干虽然已有统一格式定义，两个调用方仍复制正则，归属检查因此失败；本次让四处检查都读取同一个定义，恢复完整验证。 当前 head 已通过完整验证，并保持能力试用反馈及进度评审回执的原接受、拒绝和读写行为。 本 PR 只修复摘要格式的重复归属，不改变能力默认值，不完成 SQLite 默认切换或旧 writer 退役。

评审固定 head 084b985bb55375cf4f576e355ec662885e844773、base 5de71093cee3217c66cc32394fd841f6c831f5e2。旧 head 的批准不沿用；当前整体 diff 是两个调用方及归属检查，共3文件、8行新增、4行删除。冲突已由贡献者正常解决，保留两个当前 consumer 和既有 replan_context.ts，无需再改写历史。

改动思路

两个格式已经有稳定的 TypeScript owner，直接复用即可去掉四份重复规则，无需新配置、状态或抽象。 本 PR 完整交付两个真实调用方的四处格式复用及归属约束；包内 CLI 和回执读写经过独立验证。 格式 owner 只描述存储摘要的两种形态：bare64位小写十六进制与带 sha256: 前缀的形态。调用方原有的类型、试用基准比较、路径和 Goal/Agent/Todo 一致性仍归各自 owner。能力关闭、失败隔离、纠正后恢复及回执重放不增加步骤、状态或权限。最小改法就是直接 import，不能靠扫描豁免或放宽断言隐藏原失败。

具体改动

契约依据 github:loopx-project/loopx:issue:6117，revision issue-6117-body-sha256:e1b7967b077937743b26aba7a99018194bda2714863e51af3fa7894001fcdf14；并核对当前共享 owner 和全树 guard。SINGLE-OWNER：三处 bare 校验改用既有定义。PIN-CONSUMERS：两个真实 caller 均加入固定 import 列表。FOUR-SITE-RESTORATION：补齐同一全树故障中的 capability enveloped 校验。三项均在当前 head 独立验证，不把作者声称当作验收。

planCapabilityImprovement 在 goal_capability_organization.ts:47 保留原来的关闭、缺失 gap、直接能力及反馈分支；第95行仅用 ENVELOPED_SHA256_PATTERN.test 替换私有正则。progressReviewEvidenceScope 在 progress_review_evidence.ts:43 继续先校验 path/coverage/origin，随后第50、56、58行复用 BARE_SHA256_PATTERN；run identity 与各失败边界原样保留。两个共享正则没有 g/y 可变状态；字符类顺序及原 enveloped /u 对该 ASCII 语言无差异。

CANONICAL_CONSUMERS 增加两个当前 reader，静态全树扫描、例外及失败断言均未缩减。Python 仍是已存在的回执 IO/typed runtime adapter，不新增决策 owner。旧无 scope 回执仍能正常写入和读回，无数据迁移。

对主干的风险

最强反例是引入格式复用时偷偷归一化大小写，或校验通过却让非法回执落盘。完整 wheel 的实际 CLI 和 Python 公共回执入口均连接真实 Node owner：同一固定 harness 在不可变 base 和最终 head 执行，10个 CLI、33个回执用例的完整输出、错误与 cause、有效回执存储字节和 reload 完全相等；非法输入不创建文件，重复写入/readback 与纠正后恢复通过。两个独立 toLowerCase 语义变体均使实际公共路径的拒绝 oracle 失败，之后安装文件按字节恢复。这里没有用 helper mock 代替待证明行为。

本次独立验证：npm run typecheck:control-plane 通过；npm run test:control-plane 为4371通过、0失败、37跳过；3文件聚焦 TS 为30通过，实际 capability/progress-review Python 路径为29通过。不可变 base 的归属检查独立失败并列出全部四处，head 全树恢复通过。语义 advisory 在全树 smoke 前运行，没有支持的新词汇候选（保留其扫描限制）；全树语义 smoke、原生 canary 的3项直接检查及13项风险检查通过，严格质量回执为 pass。

验证准备阶段遇到路径拼写和 build asset 不完整/不匹配，已保留失败并用正确路径、正常 build:chat 及完整 wheel 重做；没有放宽 bundle witness。37项跳过是未启用的既有 integration fixtures，Windows、真实 PostgreSQL 事务和付费模型行为未在本次资格化；此 diff 未改变它们的 IO、事务或权限。没有查询、轮询或等待 CI；配置要求以独立本地证据评审。新 Python、UI、协议、状态、默认开启或领域义务均未引入。

我的整体评价

当前完整四处修复是一个可独立回滚的完整结果，已有真实调用方，也减少下次格式改动的维护成本。相邻边界的未来向重构已体现在复用现有 typed owner，继续增加 wrapper 或抽象没有必要。当前 head 的相关不变量和整套必要检查均得到证明，结论 APPROVE。

这是代码评审结论；公开合并资格及实际合并执行还须独立读回。当前受保护合并执行入口的可用性是单独的操作边界，不能把资格检查或本评审当成已合并。

English verdict: APPROVE - 084b985; all four private digest matchers now reuse the existing canonical owner without widening caller semantics. Full TS/typecheck, installed base/head CLI and File receipt parity, negative/mutation evidence and exact-scope quality qualification pass; optional backend/platform gaps and actual merge execution remain separate.