[loopx-agent]

Passing a stale expected SHA-256 to research checkpoint verification currently returns “Effect runtime handler failed unexpectedly.” The artifact owner now reports “checkpoint reviewed digest mismatch” as a request rejection across verification, basis reads, and materialization. The three operations use the same digest check.

The regression runs through the managed Effect runtime and the public CLI. It confirms that a mismatched request publishes no destination and preserves the checkpoint. The correct digest still verifies the full artifact, while a basis read still carries no integrity or execution claim.

Validation

• The new transport regression failed on the base revision with an internal error and passed with this change.
• The same sealed checkpoint returned identical successful CLI verification and basis data before and after the change. All three wrong-digest calls produced the existing request rejection and left the destination absent.
• 21 TypeScript tests and 6 Python tests passed. The opt-in native Codex host test was skipped. Ruff and git diff --check passed.

[loopx-agent]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

Reviewer: model_agent · gpt-6.1-sol · OpenAI · runtime_reported · max

本次评审对应提交 fb1fca6344a4a931b9bfda2b448ccf9b4301c812。

动机 / Motivation

需要根据已审摘要验证或准备接收 research checkpoint 的操作者和自动化调用方。核对已审 checkpoint 时，调用者若带上旧 SHA-256，CLI 只返回运行时内部失败。操作者很难区分传错摘要、文件损坏和运行时故障。校验、读取 basis、物化三个入口现在返回同一个 checkpoint reviewed digest mismatch 请求拒绝。正确摘要仍能完整校验并物化原文件。校验、读取 basis、物化三个入口现在返回同一个 checkpoint reviewed digest mismatch 请求拒绝。正确摘要仍能完整校验并物化原文件。验证范围为隔离文件、真实 CLI 和 Effect runtime；原生 Codex 会话的准入与运行留给其既有验证。

改动思路 / Approach

保留 artifact owner 和现有错误类型，把共同的摘要比较放在清单读取处。只调整传入摘要与已验证清单不相同的分支。保持成员校验、接收副本和后续执行准入各自的边界。 先按原有规则读取和校验清单，再比较调用者给出的 SHA-256。三条路径使用同一个判断，调用者传错摘要时由 Effect runtime 返回现有的请求拒绝类型。

具体改动 / Changes

关键代码讲解

以 docs/reference/research-checkpoint.md @ 3a5899f 为准。REVIEWED-SHA、INTEGRITY-SCOPE、FAIL-CLOSED-PUBLICATION 均经实测。readReviewedManifest 校验原清单并比较已审摘要。verify 随后核对文件和目录成员，物化前后都继续用它验证。read_basis 返回声明内容，integrity_verified 与 execution_authority_granted 均为 false。本地用一次封存的相同文件对照两个提交，刻意换一个摘要字符，再分别损坏一个成员和清单，最后验证副本的原始字节。

对主干的风险 / Risks

可能的风险是把真实文件损坏误报为调用方摘要过期。实测使用正确摘要但改动成员时，完整校验和物化在两个版本都报告 state_conflict。改动清单后两版都拒绝，三个错误入口都没留下目的目录或 staging；恢复原字节后能校验并物化完全一致的副本。

语义与 CI 对齐

21 项 TypeScript 测试、4 项相关 Python 测试、类型检查、diff、DCO 及双语检查通过。真实 CLI 在基线报运行时内部失败，当前返回明确的摘要错误，退出码仍为 1。已核对三个 Effect 入口的相同诊断。

我的整体评价 / Verdict

本次改动满足诊断目标，未发现阻塞问题。传错摘要时，操作者能据此回到原 checkpoint 记录核对 SHA。验证覆盖隔离文件和实际 CLI。 本次可见变化在研究 checkpoint CLI 的拒绝诊断。 验证使用隔离文件和真实 Effect runtime。

English verdict: APPROVE. At fb1fca6, all three artifact operations reject the stale reviewed digest as a request error. Correct verification, declaration scope and fail-closed materialization match the base.