[loopx-agent]

Goal And Delivered Outcome

OpenViking 0.5.2 rejects the optional timeout body field emitted by the existing CLI when LoopX invokes write --wait --timeout. A normal memory sync therefore fails before creating its target. This fixes that transport incompatibility in the existing context provider and makes sync subprocesses share the caller’s total deadline.

• Outcome basis: reproduced content-write failure, with isolated OpenViking 0.5.0/0.5.2 comparison.
• Before → after: the unchanged baseline returns provider_sync_write_failed_absent on 0.5.2; this head writes and independently reads back the same fixture, including when the write response is deliberately discarded.
• Intended base: main (baseline 920f18809d906b840325c4f40013e9224e4a3a2e).

Author Declaration

• Written by: OpenAI GPT-6 model agent.

Implemented against

• Specification: the reproduced defect described above; existing loopx/capabilities/reward_memory/README.md experimental activation and OpenViking identity boundary at baseline 920f18809d906b840325c4f40013e9224e4a3a2e.

Criterion	Disposition	Owner	Evidence
Compatible content write and exact readback	implemented	OpenVikingContextProvider.sync	Real CLI 0.4.23 against separate 0.5.0 and 0.5.2 services
Bounded waits and uncertain-result reconciliation	implemented	_run, _preflight, _reconcile_uncertain_sync_write	Shared-budget negative cases; real backend response-discard and replay
Explicit execution and actor isolation	implemented	Existing scope/activation owners	Preview performs no write; default-off caller tests; normal-user isolation readback

Self-check included the complete diff, provider and caller tests, standard premerge, source-scoped public scan, and the real backend comparison.

Scope And Continuation

• Content writes omit the optional server timeout on supported versions. add-resource retains its existing server timeout. Subprocess budgets, including preflight and reconciliation, now consume one monotonic sync deadline.
• Existing create/readback/conflict handling remains in the same provider. No version-string dispatch, new setting, capability, or UI is introduced. The small related refactor threads the deadline through the existing runner instead of duplicating command execution.
• Complete within this compatibility scope. Merge and deployment remain separate maintainer actions; this does not qualify a whole OpenViking upgrade, semantic-model quality, crash recovery, or exactly-once writes.

Validation

• Tested revision: 37a6289bf4b4a1e3793eaabb7569b88519c8063f; runtime replay used byte-identical provider/test sources before committing.
• Run state: finished. Input classes: synthetic.

Check kind	Result	Evidence / limitation
unit	passed	58 provider/registry tests and 91 activation, ingestion, and Decision Context caller tests; disabled paths do not construct/call providers
regression_parity	passed	New regression set fails 14 cases on the baseline and passes on the fix; ingestion timeout and existing scope rejection remain covered
real_backend	passed	Eight isolated baseline/head cases using native CLI 0.4.23 with OpenViking 0.5.0/0.5.2, separate data and normal users. Fixed writes read back correctly; replay adds no write; a different user receives 403
real_entrypoint	passed	Actual provider sync preview/apply/replay, native default write arguments, and deliberate response discard after a real committed write. Supplemental vector-only cases use local embeddings; no external model call
static	passed	Ruff, compile, bilingual RFC check, semantic advisory (no detected new carriers), public scan, and standard premerge
static	failed, repaired	First premerge lacked repository TypeScript dev dependencies; after the documented dependency setup the full standard gate passed

Coverage limits: response discard is controlled fault injection, not a server-crash or lost-submission qualification. Candidate servers were stopped; the existing service and binding were unchanged. The general loopx check also reported unrelated legacy Goal migration errors; its scan of both changed public files was clean. No raw runtime evidence, private configuration, credentials, or local paths are included.

Frontend / Visual Evidence

• UI impact: none. This repairs the existing provider used by activation/ingestion and Decision Context; there is no layout, navigation, or caller-facing control change. Before/after viewport and preview: N/A. Source data: synthetic.

Type of Change

• Bug fix
• Test update

LoopX Area

• Capability or extension (providers, adapters, skills)

Technical Direction

Existing optional-memory provider boundary and bounded failure recovery; no new roadmap milestone or shared-authority promotion is claimed.

Shared-authority RFC fixture impact

N/A: no authority backend, routing, or migration contract changes.

Boundary Checklist

• No private state, credentials, raw traces, internal links, or local paths in the diff or public evidence.
• No maintainer-owned benchmark work duplicated.
• Scoped to the demonstrated compatibility defect and its total timeout boundary.
• No paired RFC changed; bilingual diff check passed.
• UI impact marked none.
• Every commit has a DCO sign-off.

[loopx-agent]

Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; reasoning_effort=max

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

动机

已启用记忆的用户让 Agent 保存一条可复用经验时，会经过现有 OpenViking provider。旧版本在 OpenViking 0.5.2 上因多余的 timeout 字段失败；修复后，同一内容可以写入、独立读回，重放不会再次写入。两版隔离服务上的真实 CLI 调用验证了写入、预览无写入、响应丢失后的回读和重放去重；这里只验收该兼容修复。本 PR 不升级现有服务、不更改启用权限，也不声称已经证明语义模型质量、崩溃恢复或严格恰好一次。

没有阻塞性发现。实际问题是存储请求在入口被拒绝，原样重试无法得到成果；这次修复使已经获得权限的记忆写入恢复正常，而不是要求用户换一套配置或增加操作步骤。

改动思路

兼容字段、命令超时和不确定结果回读都属于现有 provider IO；沿用同一执行入口，避免按版本复制协议或新增配置权威。本次只修复 content-write 参数兼容和 sync 总等待预算，保留既有启用、身份、create 与回读规则。不修改会留下可复现的严格请求校验失败；仅删参数虽然能解决拒收，却不能约束多个探测和回读命令累计耗时，因此同时把总 deadline 传到原有命令入口是合理的同域修复。这里没有引入版本分支、新存储状态、独立编辑器或第二个调度 owner。

下面是 37a6289 的实现说明表，不替代实际运行证据：

情况	原路径	当前路径
0.5.2 content write	多余 timeout 字段被拒绝	省略该可选字段，由进程预算约束等待
多步探测/回读	每条命令可重新取得名义预算	同一次 sync 共享截止时间
写入结果未知	回读后判断，不能盲目重写	保留回读，并限制总回读时间

具体改动

规范依据是 loopx/capabilities/reward_memory/README.md，不可变版本 920f18809d906b840325c4f40013e9224e4a3a2e。experimental-activation 对应显式启用、真实写入和精确回读，本次已实现；openviking-identity-boundary 对应私有 peer 与 actor 的相等约束及当前版本检查，本次保持并验证。修复对象是该规范现有 provider 的兼容失败，不是宣布规范中未来的完整记忆效用已经达成。

关键代码讲解

1. _run 保留原来的 UTF-8、环境与 subprocess 执行方式，增加可选 deadline。它把每条命令的 timeout 与剩余总时间取较小值；已耗尽时直接进入原有超时路径，不再启动下一个命令。检索调用不传 deadline，保留此前的执行预算。
2. sync 从同一次请求计算总 deadline，先验证来源和身份，再按原规则读取既有内容。只有目标确实需要写入时才发 create；content-write 省略服务端已移除的 timeout 字段，resource ingestion 仍保留该字段。成功后的下一次 sync 读取已存在的内容并返回零次写入；内容冲突仍拒绝覆盖。
3. _reconcile_uncertain_sync_write 把精确读取、tree 与目录探测放进同一回读预算，并受总 deadline 限制。真实写入完成后刻意丢弃响应的测试仍能依靠实际后端内容确认结果；回读不可用时维持 manual_reconcile，不能把超时解释成服务端一定没有执行。

新增测试放在既有 provider 测试文件，覆盖三类 memory URI、旧/新服务协议、预览无写入、响应丢失、重放、冲突与总预算耗尽；另一个用例保护 add-resource 的既有服务端 timeout。158 行测试对应独立的兼容和负面分支，没有新增临时 smoke 或公共测试服务。

对主干的风险

主要风险是移除服务端等待参数后，服务端可能在本地进程超时后继续处理；这次保留 create、先读后写和未知结果回读，不能据此承诺取消远端任务或严格恰好一次。短预算会更早返回既有的 unavailable/partial/manual_reconcile，这是修复总预算的有意变化；默认关闭的调用仍不解析或构造 provider，没有新增指令、权限、调度或 quota 效应。

验证采用同一内容指纹，在 OpenViking 0.5.0 和 0.5.2 的独立服务、普通用户和私有作用域上执行实际 CLI 0.4.23。八组调用保留了旧版失败与新版结果：基线 0.5.2 拒收 body.timeout，修复版完成写入及独立读取，后续重放零写入，另一普通用户读取为 403。响应丢失用例是在真实提交后注入，不是崩溃测试；冷启动与热缓存不同，因此不做性能提升宣称。

58 项 provider/registry、91 项调用方测试，以及四项基线/当前关闭路径对照通过；标准 premerge 在精确 head 通过。最初因缺少 TypeScript dev dependency 失败，按仓库环境要求安装后完整重跑通过；测试准备阶段的 user_key 字段和错误 Python 环境问题保留为 harness 失败。公共源文件扫描干净，通用 check 另报的旧 Goal 迁移错误不属于本次改动。按当前 wait_for_ci=false，未查询、等待或轮询远端 CI。

我的整体评价

本次兼容修复范围内 goal_achieved，长程续作与使用体验均判断 improved：记录可在后续调用复用，不需要用户每次绕过一个被拒绝的参数，也没有增加配置和确认轮次。实际提升限于已测的写入与续作路径，不等于完整长期记忆效果或新服务升级已验收。检查了 provider、Reward Memory 的 activation/ingestion 及既有 editor 接口；本次没有渲染、布局、导航或控件变更。未进行整套服务升级、语义质量、崩溃恢复或长时间使用验收。

设计与代码规模相称；bounded refactoring 已应用在既有 runner 的 deadline 传播，没有形成平行规则。语义变动局限于 provider IO，未新建共享词表或持久状态。原身份/启用规则、resource ingestion 和结果包字段继续由既有 owner 负责。回滚可直接撤销该 commit；合并和部署仍须独立的维护者授权。

English verdict: APPROVE — 37a6289. No blocking finding. Native CLI writes/readback/replay passed on isolated OpenViking 0.5.0/0.5.2; deadline, disabled-path and scope regression coverage plus exact-head local premerge passed. Controlled response discard does not qualify crash recovery or exactly-once processing. Maintainer merge authorization remains separate.