diff --git a/docs/architecture/rfcs/live-team-workspace-v0.md b/docs/architecture/rfcs/live-team-workspace-v0.md index 9cae93496d..f8ff36e196 100644 --- a/docs/architecture/rfcs/live-team-workspace-v0.md +++ b/docs/architecture/rfcs/live-team-workspace-v0.md @@ -1,7 +1,7 @@ # RFC: Live Team Workspace v0 - **RFC status:** Draft; proposed product and presentation decisions. -- **Delivery maturity:** Partial implementation: bounded team inspection is shipped; the readable result/comparison slice is proposed in [#4828](https://github.com/loopx-project/loopx/pull/4828). Spatial streaming remains a design, not production qualification. +- **Delivery maturity:** Partial implementation: bounded team inspection and the Goal Chat readable result/comparison slice in merged [#4828](https://github.com/loopx-project/loopx/pull/4828) are shipped. Managed non-Chat result readback and spatial streaming remain unqualified. - **Owners:** existing workspace presentation, collaboration and runtime owners. - **Created / normative revision:** 2026-09-20. - **Implementation baseline:** `e7ef75c08`. @@ -327,6 +327,47 @@ stack the reader below it. Explicit artifact choices survive delivery refresh an are revalidated by operation, reference and hash; automatic reads do not take keyboard focus. Acceptance and requester adoption remain separate in details. This qualifies report readback, not mixed-team launch or stop/recovery. + +**Managed runs need a separate result readback.** The original Goal Chat report +reader is requester-scoped to a delegation operation. A managed non-Chat Turn +has no such conversation, and a run-history entry or completed Todo alone does +not identify a readable, currently accepted deliverable. The managed result +slot in Goal Files must remain empty for a Todo without a verified output; +it must not turn a run observation into a file or attach an unrelated open +Todo to it. + +The managed result slice captures a bounded, public-safe result reference +at the managed Todo completion and acceptance boundary: Goal, accountable +producer, exact output reference and digest, current acceptance identity, and +the requester/audience allowed to read it. A read-only Goal result projection +should expose that reference to both CLI and the packaged workspace, then +revalidate the output and acceptance on read. The presenter may show a readable +report and its source/acceptance trail only after that readback succeeds. A +missing source, changed digest, revoked acceptance, unreadable page or failed +provider read must clear the earlier report and show the specific unverified +scope. The reader must not infer a report from filesystem discovery, completion +text, run history or a Chat session belonging to another requester. Reuse the +existing authority and artifact-read boundaries; do not create a second result +writer or broaden Goal access as a side effect of presentation. + +[PR #4978](https://github.com/loopx-project/loopx/pull/4978) proposes that first +local producer and reader. `todo complete --result-file` binds declared output +bytes and their digest to the canonical completion/acceptance receipt under the +existing Goal/Todo writer; `todo result-read` verifies the current acceptance +basis and exact bytes. A loopback-only Goal-scoped API revalidates each requested +page and exact read, and the packaged Goal Files view opens a readable report. +Missing, changed or stale output is withheld and clears an earlier displayed +body. Completion without a declared, currently verified output creates no +result row. This proposal does not grant a remote audience or create a second +writer. + +Local File/SQLite producer and CLI readback, packaged desktop/mobile Files +readback, stale/rejected output and bounded pagination have focused validation +on the proposed head. Maintainer review and exact-head CI remain open. The +original requester conversation still lacks a return route for managed runs; +that route needs its own audience identity, restart and unauthorized-read +qualification. Neither this local Files reader nor acceptance of one Todo +proves requester adoption, mixed-team launch or whole-team stop/recovery. Merged [#4814](https://github.com/loopx-project/loopx/pull/4814) adds confirmation of one canonical team plan from manager and Goal Lark cards. Authenticated card bindings and the shared decision owner prevent a second click from creating a diff --git a/docs/architecture/rfcs/live-team-workspace-v0.zh-CN.md b/docs/architecture/rfcs/live-team-workspace-v0.zh-CN.md index 0ea2d8f720..9d701a0ef6 100644 --- a/docs/architecture/rfcs/live-team-workspace-v0.zh-CN.md +++ b/docs/architecture/rfcs/live-team-workspace-v0.zh-CN.md @@ -1,7 +1,7 @@ # RFC：团队实时工作区 v0 - **RFC 状态：** Draft；产品与展示决策提案。 -- **交付成熟度：** 部分实现：有界团队检查已交付；可读成果/对照切片在 [#4828](https://github.com/loopx-project/loopx/pull/4828) 提案中。空间流式展示仍是设计，不代表生产资格已完成。 +- **交付成熟度：** 部分实现：有界团队检查及已合并 [#4828](https://github.com/loopx-project/loopx/pull/4828) 的 Goal 对话可读成果/对照切片已交付。托管非 Chat 成果回读与空间流式展示仍未完成资格验证。 - **Owner：** 既有工作区展示、协作与 runtime owner。 - **创建 / 规范修订：** 2026-09-20。 - **实现基线：** `e7ef75c08`。 @@ -264,6 +264,34 @@ Codex MCP 执行与真实模型纠偏/验收/采用资格，原工具审批阻 用户所选产物在交付刷新后保留，并按操作、引用和哈希重新核验；自动读取不抢夺 键盘焦点。验收与请求方采用在详情中分别呈现。该切片验证报告回读，不代表混合 团队启动或停止恢复已完成。 + +**托管运行需要独立的成果回读。** 原 Goal 对话的报告阅读器按委派操作限定请求方 +范围。托管非 Chat Turn 没有这样的对话；仅凭运行历史或已完成 Todo，无法指向 +一份可读且当前验收有效的成果。没有可核验输出的 Todo，在 Goal「文件」中的 +托管成果位置必须为空，不能把运行观测伪装成文件，或挂上一条无关的未完成 Todo。 + +托管成果切片在 Todo 的完成与验收边界记录有界、可公开安全展示的结果 +引用：Goal、负责的产出者、精确产物引用与摘要、当前验收身份，以及允许读取的 +请求方 / 受众。只读 Goal 成果投影同时供 CLI 与打包工作区使用，读取时重新核验 +产物和验收。只有回读成功，展示层才能呈现可读报告及其来源、验收关系。来源丢失、 +摘要变化、验收撤销、页面不可读或 provider 读取失败时，必须清除旧报告并说明 +无法核验的范围。阅读器不能从文件系统扫描、完成文案、运行历史或其他请求方的 +Chat 会话推断报告。复用现有 authority 与产物读取边界，不另建成果写入 owner， +也不因展示而扩大 Goal 访问权限。 + +[PR #4978](https://github.com/loopx-project/loopx/pull/4978) 提议首个本地产出与 +读取路径：`todo complete --result-file` 在既有 Goal/Todo 写入 owner 下，将声明的 +输出字节与摘要绑定到 canonical 完成 / 验收回执；`todo result-read` 复核当前 +验收基线与精确字节。仅本机回环可用的 Goal 范围 API 对每个请求页面和精确读取 +重新核验，打包工作区的 Goal「文件」可展开可读报告。来源丢失、变化或过期时 +不显示结果，并清除先前正文。没有声明且当前有效的输出，完成也不产生成果行。 +这一提案不扩大远程受众，也不新增第二个写入 owner。 + +提议版本已对本地 File/SQLite 产出及 CLI 回读、打包桌面 / 手机「文件」读取、 +过期 / 驳回结果和有界分页完成针对性验证；维护者评审与精确版本 CI 仍待完成。 +托管运行仍缺少向原请求方对话回送的路径；它需要独立的受众身份、重启和越权 +读取验收。本地「文件」阅读器和一条 Todo 的验收，都不能证明请求方采用、 +混合团队启动或整队停止 / 恢复。 已合并 [#4814](https://github.com/loopx-project/loopx/pull/4814) 支持从管家和 Goal 飞书卡片确认同一份 canonical 团队计划。认证的卡片绑定和共享决策 owner 防止第二次 点击重复分配。这加强可选请求/干预入口；真实双卡点击仍需安装后验收，不能证明 diff --git a/docs/architecture/rfcs/loopx-overall-roadmap-v0.md b/docs/architecture/rfcs/loopx-overall-roadmap-v0.md index 166c8d921b..eb36cfb51a 100644 --- a/docs/architecture/rfcs/loopx-overall-roadmap-v0.md +++ b/docs/architecture/rfcs/loopx-overall-roadmap-v0.md @@ -457,6 +457,14 @@ including independent objection and useful synthesis, remains open. This qualifies a local execution-facts readback, not the full R2 ladder: assignment receipt integration, provisioning, remote probes, two-cycle continuation and Lark qualification remain open under their existing owners. +For managed non-Chat work, [PR #4978](https://github.com/loopx-project/loopx/pull/4978) +proposes an accepted, exact-version Goal result readback: canonical Todo +completion binds local report bytes, the CLI verifies them, and packaged Goal +Files reads a Goal-scoped loopback projection. The [Live Team Workspace RFC](live-team-workspace-v0.md) +defines this producer-to-reader boundary. Focused local File/SQLite and +desktop/mobile checks pass on the proposed head; maintainer review and CI +remain open. Return to the original requester conversation, mixed-team +continuation and stop/recovery remain separate unqualified outcomes. **Live team experience is a core S5 outcome.** The [Live Team Workspace RFC](live-team-workspace-v0.md) joins a precise command surface with a spatial diff --git a/docs/architecture/rfcs/loopx-overall-roadmap-v0.zh-CN.md b/docs/architecture/rfcs/loopx-overall-roadmap-v0.zh-CN.md index 0681b5bb0a..9598bbb5f1 100644 --- a/docs/architecture/rfcs/loopx-overall-roadmap-v0.zh-CN.md +++ b/docs/architecture/rfcs/loopx-overall-roadmap-v0.zh-CN.md @@ -391,6 +391,12 @@ executor/profile 检查启动条件。任务准入、当前 pinned 验收绑定 验收；包含独立异议和有效综合结论的 L1 仍未通过。 这只验收本地执行事实的读回；计划分配回执 整合、通用创建、远端探针、两轮持续协作及 Lark 等价仍由原 owner 继续推进。 +对于托管非 Chat 工作，[PR #4978](https://github.com/loopx-project/loopx/pull/4978) +提议已验收、精确版本的 Goal 成果回读：canonical Todo 完成时绑定本地报告字节， +CLI 重新核验，打包 Goal「文件」读取按 Goal 限定的本机回环投影。 +[团队实时工作区 RFC](live-team-workspace-v0.zh-CN.md) 定义产出到读取的边界。 +提议版本已通过本地 File/SQLite 和桌面 / 手机的针对性检查；维护者评审与 CI +仍待完成。向原请求方对话回送、混合团队持续协作及整队停止 / 恢复仍需另行验收。 **团队现场是 S5 核心产品目标。** [团队实时工作区 RFC](live-team-workspace-v0.zh-CN.md) 融合精确指挥台与空间研究工作室：展示产物交换、有来源的分歧、结论修订、回放与