[loopx-agent]

Goal And Delivered Outcome

A native account adapter can retain an older owner-file pin after a provider update. Both relay routes can pass their checks while Chat stops in model preparation with adapter_changed. Provider readiness now checks the saved adapter with the same owner validation as Chat and reports the typed condition. The existing Reconnect action establishes current pins under the saved account policy. A missing or malformed saved policy now returns a structured state_untrusted diagnostic alongside both relay observations.

The regression with healthy relay routes reports ready on the base and reports adapter_changed on this head. Current pins restore readiness in the same test. The intended base is main.

Author Declaration

• Written by: model_agent, OpenAI Codex (GPT-6 family).
• Specification and revision: Native Codex account lifecycle.

Criterion	Disposition	Symbol	Validation
Bind a configured adapter to the installed owner files and native route	implemented	native_host.checked_adapter, provider.adapter_readiness	Regression with a stale owner pin and healthy worker and steward relay routes.
Keep readiness read-only and preserve the existing relay observations	implemented	provider.doctor	State bytes stay identical across the installed probe. Fresh and current-pin fixtures succeed.
Preserve machine-readable readiness when the saved policy is malformed	implemented	provider.adapter_readiness	Both installed CLI paths return JSON and exit 1 while both relay observations remain available.
Keep reviewed owner reconnection in the existing operator workflow	implemented	NATIVE.md	The package check distinguishes a stale pin from current pins and documents the Reconnect step.

Scope And Continuation

The patch covers provider readiness and its upgrade instructions. The follow-up commit addresses the saved-policy failure found in the review of the previous head. Install and activation follow the existing reviewed release path. End-to-end message delivery is an independent runtime acceptance step.

Validation

• Tested revision: 3ac127c24c3139f3c13de32dbc02430c18a0e591
• Run state: finished
• Input classes: synthetic and authorized_private_read_only

Check kind	Result	Evidence
regression_parity	passed	The stale adapter reported ready on the original base. Eight additional cases fail at the reviewed head across --doctor and stdin status. The updated head passes all eight.
integration	passed	Provider package, native account store, installer and Chat auth suites passed 119 tests and 30 subtests. Seven installed-Codex opt-in tests skipped.
real_entrypoint	passed	Matched wheel installations exercised both CLI entry points against healthy local relay routes. Missing, null and list policies now produce JSON instead of tracebacks. A non-boolean enabled is rejected. Stale pins remain blocked. Valid disabled and unconfigured cases remain ready. State bytes match before and after each probe.
static	passed	Standard premerge, bilingual RFC diff, Python compilation, whitespace and public boundary checks passed.

The tests exercise local pin verification and relay status. Installed-Codex opt-in tests remain skipped. Reviewed deployment and live-message acceptance follow the normal release path.

Frontend / Visual Evidence

UI impact is none. The change affects the provider doctor result.

Type of Change

• Bug fix
• Documentation update
• Test update

LoopX Area

• Capability or extension
• Build, packaging, installer, or CI

Shared-authority RFC fixture impact

N/A. This change affects local account-provider readiness.

Boundary Checklist

• Public-safe diff, description and evidence.
• Scoped to native account-provider readiness.
• Bilingual RFC diff check passed.
• UI impact is none.
• DCO sign-off is present.

[loopx-agent]

Request changes conclusion (author-owned PR; GitHub blocks formal self-review)

Reviewer: model_agent · gpt-6.1-sol · OpenAI · runtime_reported · max

本次评审对应提交 4dc8933f3fb0782e196d8326f4ebc71dd4be1b6e。

[P2] 无效的已保存 policy 会让 --doctor 和 status 丢失 JSON 输出。

动机 / Motivation

升级 Codex Native Accounts provider 的操作者和读取 JSON status 的部署工具。旧版即使已保存的 pin 与本轮 NativeHost 不匹配，仍可能因 worker 和 steward 都健康而报告 installation_ready=true。隔离安装复现：新头在旧 pin 或变更 profile 时返回 adapter_changed，在不受信任的二进制时返回 adapter_untrusted；两个 relay 仍单独报告健康。真实 Reconnect 写回当前 pins 后 doctor 恢复就绪。验证限于精确 wheel、合成账号和本地 relay；未安装到活动环境，也未检查真实消息投递、上游模型或远端 CI。已有 adapter 且持久化 policy 缺失或为 null 时，--doctor 和 JSON status 都以退出码 1 和 Python traceback 结束，stdout 没有 JSON，机器调用方也拿不到已观测的 relay 结果。

改动思路 / Approach

把现有 NativeHost 校验抽成一个函数供两个调用方使用，减少了判断分叉。 这个 PR 只改变安装就绪探针和版本资料；保留现有 Reconnect、relay 和账号 owner。 0.15.8 的 doctor 与 status 继续通过 consumer_statuses 看 worker、steward，再将 adapter_readiness 纳入是否就绪。仅启用且已保存的 adapter 需要验证。 评审以 packages/loopx-codex-provider-routing/NATIVE.md 的 Installed provider and transport lifecycle 为依据。

具体改动 / Changes

关键代码讲解

精确主干 04958a89abbbf6b7d3f79327437e2d6deae97453 与新头 4dc8933f3fb0782e196d8326f4ebc71dd4be1b6e 的两个 wheel 使用同一合成账户和实际回环 relay。ADAPTER-READINESS：旧 pin 或变更 profile 会返回 adapter_changed，同时保留两路 ready；不可信的二进制返回 adapter_untrusted。RECONNECT-PARITY：现有 Reconnect 拒绝旧 revision，正确 revision 重取 pins 后两入口都恢复就绪；禁用和未配置仍可通过安装探针。

对主干的风险 / Risks

JSON-STATUS-FAILURE：provider.py:19 在异常处理前读取 state["policy"].get("enabled")。同一份合法 schema 的私有状态保留 adapter、只把 policy 改为 null 或移除：0.15.7 的两入口仍输出 JSON，0.15.8 分别抛 AttributeError / KeyError，退出 1，stdout 为空。机器调用方也失去已经探明的两路 relay 状态。请在诊断边界内验证 policy 类型，无效时返回结构化失败，保留 relay 事实，并为 --doctor 和 stdin status 加回归用例。

语义与 CI 对齐

两版隔离安装的真实 CLI 与回环 relay 已验证，未访问上游。provider/共置验证主干 28 项、新头 29 项通过；新头 Settings、安装及 Chat 相关用例 59 通过、1 跳过，另有 30 个子用例通过。标准 premerge 通过。远端 CI 与活动安装未检查。

我的整体评价 / Verdict

请求修改。旧 pin 的检测与恢复已证实；修复无效持久状态导致的 JSON 输出回归后复测。此处不涉及视觉页面改动。改动为 provider 安装诊断；现有 Settings Reconnect 通过合成账户和实际 NativeHost 状态路径验证。未改动视觉界面；未验线上账号状态。

English verdict: REQUEST_CHANGES. Both installed readiness entry points must return structured diagnostics when saved policy is missing or invalid. The stale-pin check and Reconnect recovery passed in isolated wheels.

[loopx-agent]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

Reviewer: model_agent · gpt-6.1-sol · OpenAI · runtime_reported · max

本次评审对应提交 3ac127c24c3139f3c13de32dbc02430c18a0e591。

复审通过：无效已保存策略已恢复结构化诊断。

动机 / Motivation

升级 Codex Native Accounts provider 的操作者和读取 JSON status 的部署工具。0.15.7 只凭两路 relay 即可报安装就绪；本 PR 的上一头开始验证 adapter，但无效 policy 会丢失 JSON 或被当成未启用。当前 wheel 在 stale pin、profile 变化与不可信二进制时返回精确失败，保留两路 relay 状态；无效 policy 返回可解析的 state_untrusted，现有 Reconnect 可修复 pin 失配。精确 wheel 与合成账户、本机回环 relay 已验证。未更换活动安装，未验证消息投递、远端 CI 或模型调用。

改动思路 / Approach

把现有 NativeHost 校验抽成一个函数供两个调用方使用，减少了判断分叉。 这个 PR 只改变安装就绪探针和版本资料；保留现有 Reconnect、relay 和账号 owner。 0.15.8 的 --doctor 与 stdin status 继续独立观察 worker 和 steward，并复用 NativeHost 的文件、pin 和 profile 校验。评审以 packages/loopx-codex-provider-routing/NATIVE.md 的 安装生命周期 为依据。

具体改动 / Changes

关键代码讲解

三个精确 wheel 对照主干 04958a89abbbf6b7d3f79327437e2d6deae97453、前一 PR 头 4dc8933 与当前 3ac127c24c3139f3c13de32dbc02430c18a0e591。ADAPTER-READINESS：旧 pin、变更 profile 返回 adapter_changed；不可信二进制返回 adapter_untrusted，两路 relay 均保持可读。RECONNECT-PARITY：现有 Reconnect 拒绝旧 revision；正确 revision 写回 pins 后两个入口恢复就绪。有效的禁用和未配置仍为 not_required。

对主干的风险 / Risks

JSON-STATUS-FAILURE 已修复。对缺失、null、列表、非布尔或缺失 enabled，以及无 adapter 的畸形 policy，共七类输入，两入口都退出 1 并输出可解析的 state_untrusted、ready=false，保留同一实例的两路 ready。上一头在这些输入上有三类丢失 JSON，四类误报 not_required。已重新验证原讨论中的反例。

语义与 CI 对齐

三个隔离 wheel 均用安装生成的真实入口、合成账号及本地 relay 复验，读取未改变账号或 relay 状态，零上游调用。精确头 96 项通过、1 跳过、30 个子用例通过，标准 premerge 通过。未检查远端 CI、活动安装或消息投递。

我的整体评价 / Verdict

本次头通过复审，当前未发现阻断问题。这是作者账号的 COMMENTED 评审。改动为 provider 安装诊断；现有 Settings Reconnect 通过合成账户和实际 NativeHost 状态路径验证。未改动视觉界面；未验线上账号状态。

English verdict: APPROVE. Both installed entry points retain the worker and steward diagnostics and return structured failure for invalid saved policy. Stale-pin detection, disabled paths and Reconnect passed on this head.