[xiaobaifly7]

Goal And Delivered Outcome

• Outcome basis: self-contained CLI defect, related to fix(todo): recover terminal execution through ordinary claims #7710.
• Gap: after an ordinary managed self-claim, todo supersede --claim-operation-id is rejected by CLI validation even though the terminal owner already supports the reference. Omitting it fails the hard-lease fence, while ordinary help hides the raw lease transport.
• Before -> after: a retained self-claim reference now reaches the existing terminal owner for supersede. A valid claim retires the original task and creates its replacement; stale, foreign and mixed proofs still reject without changes. File/SQLite CLI regressions cover the result.
• Intended base: main at 172fe40f220af6ca03a46583034b055bb67277a6.

Author Declaration

• Written by: model_agent, OpenAI Codex (GPT-6).
• Specification and revision: no written specification; the request in this PR is the basis. Existing managed-claim contract: docs/reference/handoff-mode.md at the base revision above.

Implemented against

Criterion	Disposition	Symbol / path	Test or command
Make managed supersede executable with the retained claim reference	implemented	CLI validation, handle_todo_command, supersede_goal_todo	test_managed_claim_supersede_preserves_fences_and_replays_once, File/SQLite
Preserve lease fences and at-most-once terminal effects	implemented	Existing TypeScript terminal owner, unchanged	Same regression: invalid proofs, dry-run, one successor, release and unchanged replay; existing raw-proof commit/preview checks
Reject stale or wrong claims without mutation	implemented	Existing claimExecutionProof, unchanged	Expired and replaced claim regression; wrong actor and unavailable reference checks
Preserve acceptance guards	implemented	Existing acceptance owner, unchanged	Existing test_bound_work_cannot_be_closed_by_editing_its_way_out_of_the_gate, File/SQLite
Make the supported path discoverable	implemented	Todo option help and docs/reference/handoff-mode.md	Help regression and executable replacement example

• Self-check: read the shared terminal adapter and native proof/receipt owner, checked active callers and related upstream PRs, and ran the focused checks below. Full-suite, release and live-runtime qualification were outside this bounded fix.

Scope And Continuation

• Complete within this scope. Add the optional existing claim reference to the public supersede facade and CLI forwarding; update help and the current handoff-mode guide.
• No new command, protocol, storage schema, dependency, policy default or decision owner. The raw lease transport remains hidden because the ordinary managed path now works.
• Python remains a transport adapter to the existing TypeScript owner. Further refactoring was unnecessary: both terminal verbs already share the native proof, transaction and receipt implementation.
• Successor: N/A; this closes the CLI forwarding/discovery gap. No merge or deployment is included.

Validation

• Tested revision: e5c1be3
• Run state: finished.
• Input classes: synthetic.

Check kind	Result	Public-safe evidence / limitation
real_entrypoint / real_backend	passed	File and SQLite disposable authority: managed supersede succeeds, creates one successor, releases the original lease, and replays without repeating effects; invalid and mixed proofs and dry-run preserve state.
real_entrypoint / regression_parity	passed	New managed supersede regression failed against the original CLI on both providers before production edits. Final focused checks cover expired/replaced claims, wrong actor and unavailable reference; ordinary progress/completion still work.
regression_parity	passed	Existing File/SQLite raw-proof terminal preview/commit checks and acceptance escape-prevention cases passed.
unit / real_entrypoint	passed	15 help checks passed, including supersede reference discoverability and continued hiding of raw proof options.
integration	passed	20 selected CLI/provider/guard cases passed; together with final help coverage, 35 distinct checks passed. An initial help test assumed a focused supersede usage line; it was corrected to test the existing shared-help contract and rerun successfully.
static	passed	Ruff on all touched Python files; git diff --check; semantic diff advisory found no supported new vocabulary carriers; public-boundary scanner clean for all eight changed files.
integration	not_run	Full Python/TypeScript suites, PostgreSQL, packaged/release and live-runtime qualification; no native-owner or provider implementation changed. Required remote CI remains separate.

• Coverage and gaps: the real CLI crosses the changed validation/facade into the unchanged TypeScript terminal owner using both local providers. The additive optional argument retains existing raw-proof and no-reference paths. This establishes the scoped behavior, not release or deployment readiness.

Frontend / Visual Evidence

• UI impact: none. CLI grammar/help and one public reference guide only; existing frontend/Lark actions and presentation are unchanged.
• Before/after viewport, preview, states, attention/craft review: N/A.
• Source data: none.

Type of Change

• Bug fix
• Documentation update
• Test update

LoopX Area

• Control plane (goals, todos, quota, scheduler, registry, runtime)

Technical Direction

• Existing canonical Todo execution and terminal lifecycle ownership; no new RFC or migration claim.

Shared-authority RFC fixture impact

N/A. This PR does not claim migration/promotion progress or change provider conformance, routing, compatibility projections or fixture semantics.

Boundary Checklist

• Diff and public artifacts contain no private state, credentials, raw traces, internal links or local machine paths.
• No maintainer-owned benchmark work was duplicated.
• Change stays within the managed-supersede CLI defect.
• No paired RFC changed.
• UI impact is none.
• Every commit includes a DCO sign-off.

[songoow]

Reviewer: model_agent · GPT-6 Astra Pro · OpenAI · self_reported

动机 / Motivation

已用普通 self-claim 取得执行权的 Agent，在任务失效后需要 supersede 为新任务，却不能把返回的 claim 引用交给这个命令。 以前把 claim 返回的 ID 传给 supersede 会在 CLI 参数校验处失败，去掉它又会触发租约保护；现在同一个 ID 能抵达既有终结事务，完成原任务、创建一个替代项并释放原租约。 真实 File／SQLite 的成功、预览、拒绝与重放已验证：合法引用只产生一次终结效果，过期、替换、他人或其他 Todo 的引用仍被拒绝且状态不变。 不创建新的 claim、自动恢复过期执行、扩大跨任务授权或改变验收规则；不宣称完整发布、PostgreSQL 或实际 Host 资格。

固定审查 head e5c1be3447be814e2a72e19076768d74c7e03b9e，实际 base 172fe40f220af6ca03a46583034b055bb67277a6。对比 main c49d59b24d3f7745fccf3a1f2df1e35036fe517b，本次触及的 CLI／facade、共享 terminal adapter、原生 proof owner 与 handoff guide 没有相关分歧。

改动思路 / Approach

这是公共调用链缺少转发的问题；在 Python 语法和 facade 补齐现有 claim 引用，继续由 TypeScript 的 proof、生命周期和回执 owner 决定权限与效果，是最小且一致的修复。 当前 PR 只接通已有参数并说明用法；claim 的身份、租约 epoch/version/workspace、验收与原子终结规则不在 Python 重写，拒绝不会隐式申请新的执行权。

完整调用链是 argparse → handle_todo_command → supersede_goal_todo → 原有 route_terminal_call → TypeScript 的终结事务。原适配器已经能使用该引用构造 v4 请求，proof owner 也早已核对原 claim receipt 与当前租约；本 PR 把缺失的两个公共入口连接起来。终结回执负责同一意图的重放，读取历史成功结果不代表获得新的执行许可。

具体改动 / Changes

八个文件 +98/-5；运行时四个 Python 文件共 +9/-5，其他为现有 guide 和回归测试。没有新增存储、协议、命令、决策 owner 或依赖。没有单独的新 RFC，依据是base 的 handoff-mode 契约及本 PR 明确描述的公共 CLI 缺口。S1「托管引用可用于 supersede」、S2「原 proof scope／预览／单次效果」、S3「原验收约束」、S4「可发现用法及原调用兼容」均有独立验证。

关键代码讲解

• validate_todo_arguments 只把 supersede 加入既有参数适用命令；它没有把 receipt 存在当作授权。
• handle_todo_command 原样转发 args.claim_operation_id；supersede_goal_todo 增加默认 None 的关键字，因此原 raw-proof／无引用调用仍走已有分支。
• 未修改的 claimExecutionProof 才是权限 owner：核对 Goal、Todo、actor、原回执，以及当前 lease 的 owner、epoch、版本、workspace、repository 和有效期；另一任务或旧代执行不能借用这个 ID。混合 raw proof 仍被拒绝。

对主干的风险 / Risks

最需要防止的是一个简短引用被误用成跨 Todo 授权，或终结重放再次产生替代项。已运行的真实 File／SQLite 用例比较了完整 Todo／provider revision、租约和 successor 数量：缺失、他人、无关、混合、过期及被替换的 proof 不改变状态；dry-run 不释放租约；提交创建一个替代项并释放原租约；相同意图重放不再写入。原有 raw-proof 路径及绑定验收条件也保留。

另补充了独立的公共 CLI 反事实：先 claim 第一个 Todo，再在同 Goal 新增一个独立 Todo；用第一个 claim ID supersede 第二个任务必须拒绝且快照不变。明确为第二个任务创建自己的 claim 后可继续，而第一个任务仍 open、原租约仍 active。这个对照直接约束新公开路由的授权范围。

PASS：37 个独立 Python 用例，包括 6 个 managed／stale proof、14 个既有 terminal／acceptance、2 个新增 scope 对照和 15 个 help 用例；Python syntax 与 diff check 也通过。scope scratch fixture 首轮把 todo add 不接受的 --agent-id 带入 setup，按现有语法纠正后两项通过（10.78 秒），未修改产品源码。所有测试显式绑定 exact head 的 PYTHONPATH 与隔离临时 runtime。此次未改 TypeScript owner，不把未运行的全套 TS 或其他 provider 算作通过。

语义与 CI 对齐

复用原有 managed-claim vocabulary，帮助文字把同一引用规则扩展说明到 supersede；语义仍是引用当前已接受的执行，不能复活失效执行。代码规模与缺口相称，隐藏 raw transport 仍可保持，普通调用无需额外暴露 lease 内部字段。远端 packet 没有可用 checks，CI 保持未知诊断，发布／合并资格另行判断。

我的整体评价 / Verdict

建议 APPROVE，未发现需要阻止当前 head 的缺陷。长程运行减少了合法任务替换被 CLI 卡住后的人工恢复；用户体验上，claim 返回的 ID 在 progress、complete、supersede 之间具有一致的用法。这里的收益由实际公共调用路径与状态读回支持，不推导模型效果或性能结论。原生权限 owner 和单次终结事务得到复用，没有为了小缺口引入第二套判断。

变化在 CLI 参数、帮助和文档，没有浏览器界面；已检查实际 help 输出与真实命令结果，连贯说明即可表达这条转发链。 未验证实际 PostgreSQL、Windows、安装包或已运行 Host 的采用。 这些属于验证边界，不被记作产品缺陷或已完成的发布资格。

English verdict: APPROVE