[loopx-agent]

The public Codex CLI E2E smoke stopped before its first Host call because its disposable Goal had no canonical authority. Initialize that newly created Goal in the standalone script entrypoint through the existing SQLite canonical fixture and writer fence.

Keep the shared _write_fixture constructor unchanged: existing File/SQLite capture tests deliberately verify admission rejection before initializing their selected provider. Review exposed eight failures when setup was placed in that shared constructor; moving it to main fixes those cases without changing any assertions or production rules.

Validation at c0402b4cb82f04c6c071e9c1b33be1ef8ae0d66f:

• Both complete existing native Host/capture modules: 95 passed, including three committed transactions on one session (start_new, resume, resume), exactly three quota spends, captured-decision failure/retry and effect-free replay.
• Same interpreter on immutable target bd67d651ac175a0ac36b3258e83f97c20a703578: the public E2E fails with canonical authority required; the capture module passes all 10 cases. Historical failures remain recorded.
• Direct default one-transaction run passes with no model call/global sync and no replay effects. Invalid --turn-count 0 exits with argument error.
• Standard premerge: all five direct checks and three selected checks pass, no manual holds. Ruff, semantic advisory and public boundary checks pass.

This repairs an existing public validation path using a synthetic model provider through the real LoopX CLI. It does not migrate a live Goal, loosen an authority gate, qualify a real Codex/model run or establish full-suite health. No rendered UI changes.

[loopx-agent]

Additional qualification gap at d7d5032a577d958b99c0fd22d42c1b9ab3187338: tests/control_plane/test_turn_host_decision_capture.py calls _write_fixture, first asserts canonical_authority_required, and then explicitly initializes its File/SQLite provider. Source inspection confirms that initializing SQLite inside this shared constructor changes that existing contract.

The initialization belongs immediately after the constructor call in main. That refinement and the affected consumer reruns are in progress. The earlier standalone E2E and selected premerge passes remain historical results; they are insufficient to clear this newly identified gap. The exact-head local quality assessment now records the contract conflict as blocking. No assertion or canonical admission rule should be relaxed.

[loopx-agent]

Reviewer: model_agent · gpt-6.1-sol · OpenAI · runtime_reported · max

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

动机

运行公开 Codex CLI 验证脚本的贡献者需要验证多轮提交与恢复。原脚本在首次 Host 调用前因缺少 canonical authority 失败；修复后相同命令能完成三轮提交并无副作用重放。这里 canonical authority 指已有的权威状态存储及写入围栏。修复独立脚本入口，保持共享 fixture 的未初始化约定及 File/SQLite 接收守卫。不修改生产权限或测试断言，不证明真实模型运行或完整测试套件通过。

改动思路

复用现有初始化 helper，只在独立脚本的 main 中、创建一次性数据后调用。评审运行共享 fixture 的全部消费者，发现初稿把初始化放进 _write_fixture，导致原来专门验证“未初始化应拒绝”的八个 File/SQLite 场景失败；当前 head 将调用移到入口，保留这些独立 oracle。无需新增开关、包装层或兼容分支。生产准入、Host、配额与重试 owner 均未修改。

具体改动

规范 docs/development/good-smokes.md，固定版本 bd67d651ac175a0ac36b3258e83f97c20a703578；本次审阅 c0402b4cb82f04c6c071e9c1b33be1ef8ae0d66f 的完整差异为一个既有例子的 9 行新增。

• smoke-cli-boundary：main 创建 fixture 后初始化真实 SQLite owner，原三轮测试仍从公开 CLI 验证提交、续接和计费。
• smoke-semantic-pressure：共享 _write_fixture 与目标主干逐字相同；八个 File/SQLite 原捕获/重试场景及最终无副作用重放都保留。
• smoke-public-safe：默认仍用无模型子进程、临时数据和原 --no-global-sync，不需要私有运行资料。

最终源码运行两个完整模块 95 通过；同一解释器在不可变主干重现原 E2E 拒绝，同时其捕获模块 10 通过。直接默认运行完成一轮，重放四类效果均为 false；--turn-count 0 仍以参数错误退出。没有修改任何断言。

对主干的风险

主要风险是共享构造器被提前转换为某个 provider，令其他消费者失去独立准入验证。此风险已用初稿八个具体失败复现，再用当前相同消费者消除，非仅重跑最容易通过的单一入口。标准 premerge 的五项直接检查、三项选中检查及 Ruff 均通过，未查询或等待远端 CI。测试使用真实 LoopX CLI、权威存储与子进程，模型仍是合成 provider；不会据此宣布真实模型或全量测试已通过。没有新增公共协议词汇或生产权限。

我的整体评价

无当前阻断性发现，APPROVE。多轮状态、一次 debit、失败恢复和无副作用重放被保留；贡献者使用相同命令即可运行既有验证，无需额外准备或确认。examples/loopx-turn-codex-cli-e2e-smoke.py 只改变验证脚本初始化，没有渲染界面变更。真实 Codex/模型服务与完整测试套件不在本次验证范围。本改动完成公开 E2E fixture 的局部修复；#7170 的完整资格及安装采用仍须独立核验，不能由本次批准代替。

English verdict: APPROVE — c0402b4cb82f04c6c071e9c1b33be1ef8ae0d66f restores the standalone canonical fixture at its entrypoint while preserving all shared File/SQLite consumers. 95 native/capture tests, direct default/error cases and standard local premerge pass. Real model and full-suite qualification remain outside this repair.