[loopx-agent]

Goal And Delivered Outcome

An otherwise valid handoff can be rejected when a model puts PR or web links in the file-only inputs field. The normal prompt now puts those links and exact revisions in context. Once the original source has qualified for format review on its original adapter, the existing worker can repair a brief whose inputs are all plain HTTPS links without sending a second model request. It retains the complete original brief as context and leaves file inputs empty. The normal handoff owner still checks the current recipient grant and records the submission receipt. The configured tools-disabled Codex fallback keeps its normal native completion checks.

• Intended base: main.
• Related to #8427, which addresses discovery by the existing recovery worker. This PR handles the distinct format error after that worker admits the original review.

Author Declaration

• Written by: model_agent (OpenAI Codex).
• Specification: App conversation and async inbox RFC, original native result and one reserved format review.

Criterion	Disposition	Owner	Evidence
Preserve original text, ordered recipients and reply audience.	implemented	format_link_metadata_review, existing review validation	Same retained brief and recipient, full original link text preserved, no added file reference.
Keep file, stop, queue and permission boundaries.	implemented	Original review admission and handoff owner	New queued input holds recovery; an ungranted recipient receives no request; qualified URL shapes alone use deterministic formatting, and the canonical codec still enforces the original limits.
Do not replay business or infer delivery from model prose.	implemented	ChatExternalConversations.execute_turn	Baseline required a second model Send; exact candidate completes the narrow format repair on the reserved Turn with one original Send and actual typed receipt.
Verify live installation and original receiver conclusion.	out_of_scope	Existing service adoption and recipient return	Local/isolated qualification only; no production message, model or transport effect was triggered.

• Self-check: reused the canonical brief decoder and existing reserved review. Unknown or mixed inputs retain the tools-disabled review path, and file validation has no exception for URLs.

Scope And Continuation

This is a bounded prevention and repair for link-only format failures. It does not restart the original business, fetch links or settle the receiver's work. Existing worker discovery and deployment protection still govern adoption.

Validation

• Tested revision: 3fab7315ff8ce15f57edc3f10cb251f0ac4c2860.
• Run state: finished.
• Input classes: synthetic, authorized_private_read_only.

Check kind	Result	Public-safe evidence
regression_parity	passed	The original File Chat/provider test shows the base needs two model sends. The candidate retains the original answer and native result, records the handoff and returns its submission receipt to the original audience on the positive fixture, and never sends a second model request for plain links.
real_backend	not_run	A retained original brief was tested with the pure codec; every link and all other fields were preserved. No production worker or transport was invoked.
integration	passed	The exact private Lark, legacy review and Chat adapter regression suite passed 960 cases, including 40 focused recovery cases. Six link-specific cases passed against the installed wheel in an isolated target.
static	passed	Standard premerge and bilingual RFC checks at the exact head.
manual	not_run	Live installation and natural source return await normal review and adoption.

• Coverage: failure, normal reuse, original queue hold, ungranted recipient, query-bearing URLs, oversized descriptions, and the configured Codex fallback. The initial proposal failed both newly added fallback and input-limit counterexamples; the final version passes them. Provider endpoints in integration were isolated fixtures.

Frontend / Visual Evidence

• UI impact: none.
• First viewport and preview: N/A.
• Source data: none.

Type of Change

• Bug fix
• Documentation update
• Test update

LoopX Area

• Capability or extension
• Host or runtime integration

Technical Direction

Operator surface and IM integration: preserve original message and recipient identities during format-only recovery.

Shared-authority RFC fixture impact

N/A; uses the existing Core admission and identity contract.

Boundary Checklist

• No private inputs, credentials, paths or raw traces in the public artifacts.
• The paired English and Chinese RFC changes pass the bilingual gate.
• The commit is signed and carries DCO sign-off.
• No visual changes.

[loopx-agent]

Reviewer: model_agent — OpenAI Codex (OpenAI), self_reported

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

动机 / Motivation

从飞书把工作交给既有 Agent 的管家和原会话。 原答复已送达但委派因文件输入放了链接被拒；新路径在原 adapter 上复用一次已预约的格式复核。 隔离同路径从两次模型 Send 降为一次，原答复保持一份，原会话能读回一份提交回执。 本次不重跑业务、不改变模型路由或投递授权，也不把提交回执当作接收者结论。 线上安装、原 Bot 补办与接收 Agent 的业务结论仍待独立验证。

当前基线的 App 会话 RFC 对应五项：original-proof 保留原答复、原证据和一次预约；canonical-brief 保留原文、顺序及文件输入的含义；queue-authority 保留停止、新消息与接收授权；native-fallback 保留备用模型的原生复核；live-return 需要上线后独验，本次未覆盖。只改提示词不会补回已经被拒的委派；放宽所有文件字段则会改变其他产物入口的语义。

改动思路 / Approach

格式修复放在已有的原消息复核路径，文件校验、执行路由和授权各留在原责任层。 本次只自动格式化原 adapter 上所有输入均为普通 HTTPS 链接的合格 brief。 临时用合法的相对引用跑同一 codec，确认其余字段和描述长度仍合规，然后把完整原 brief 保留为上下文，把文件输入置空。最终仍核验原预约、收件人顺序与当前授权。已经选择备用 Codex 的路径继续执行原禁用工具的纯文本复核。

具体改动 / Changes

_turn_prompt 与 prepare_metadata_review_input 共用链接与文件的字段说明；format_link_metadata_review 只改已知格式；execute_turn 在原分支调用它，然后用原校验与投递入口生成回执。中英文 RFC 同步更新。隔离测试以原消息进入 File Chat 与实际协作契约，模型、飞书传输及收件者环境使用测试替身。归档的原生答复和旧失败记录不变，再次对账也不会多写一份。

对主干的风险 / Risks

最强反例是初版虽能补正链接，却在备用路由里改变会话后不执行原复核，并跳过超长描述校验；两例都在初版失败、当前提交通过。原基线一例因多一次 Send 失败，说明覆盖能捕获所修回归。当前 40 项针对性用例、6 项独立安装包用例及标准提交检查均通过。排队新消息和未授权接收者仍不会提交，普通回执也不会被当作接收者最终结果。上线仍依赖既有保护与原恢复 worker 的自然发现。

我的整体评价 / Verdict

这次改动收口在原始格式复核，不改变文件协议、权限或业务重跑语义，可以按正常流程进入独立审查。采用后还须从原会话独立读回真实回执及结论，才算完成。

English verdict: APPROVE for 3fab7315ff8ce15f57edc3f10cb251f0ac4c2860. The matched recovery now uses one original model Send, retains native fallback and the recipient gate, and passes the focused, installed and standard checks. Production adoption and receiver return remain open.