[songoow]

Review 修复 · 2026-10-28

当前 head：984d4aa26ff2119387fba6eaed7d963060d1e4e3。已无冲突合入最新目标主干 843be494266774b63b3de61d0adf5dd7f4f877a2。本轮针对 P2 review 完成合法嵌套 patch 与必需检查的集成。

修复与完整性

• 使用 Git 标准的 --unified=1 和 diff.suppressBlankEmpty=true 重新生成可读的 full-index patch。原本随上下文带入的两处公开 token 示例、16 处单空格 context marker 不再触发外层检查；标准 git apply --check --index --whitespace=error 和实际 apply 仍通过。
• 新 patch 字节重新绑定 SHA-256 和确定性的 effective commit。来源 owner 只接受两种逐字节相等的 canonical diff：新 U1/省略空白前缀，以及旧 cohort 的 U3/保留前缀。完整 preimage blob/mode、全部 tree diff、receipt 和 commit provenance 校验保持有效。
• 已有 cohort 继续保留各自 patch、receipt、commit；删除当前 asset/default、禁用网络后仍可复用。显式 repository/ref/revision 选择仍采用未修改来源。
• 新回归直接执行实际 bundled asset 的 staged whitespace 检查和既有 public scanner，并覆盖两种表示的环境配置干扰、同 tree 不同 digest/commit、旧 cohort 离线复用。原有篡改与额外 tree/commit 负例保留。未修改扫描器、未添加检查豁免。

当前默认来源与等价性

实际默认准备使用 python -m benchmark.edgebench.source --log-dir <new-cohort>，没有显式来源覆盖。上游 integration 分支已从首轮版本前进，本轮按当前解析出的真实版本重新验证：

项目	本轮身份
Upstream provider commit	798aa503dabb86552cdd7059e84f63effb81267f
Bundled patch SHA-256	44e5c9b3dacf65aaabfc036e26323aac27effbf933b9ff4477fd9a5e36831ffb
Effective provider commit	82a01f54ad8fb290057c8f7e8b6806872c08d86b
完整 provider tree	8b02460be5c59f30eff43481c5a341c91d80b477

在同一个当前 upstream 上分别应用旧、新 patch，完整 tree 完全一致；此次表示调整没有改变任何 provider 文件的结果内容。实际准备出的 checkout 已在隔离临时测试环境安装，import 与 receipt 绑定一致，测试后仍 clean，重复准备返回同一 receipt。派生 commit 仍是需要保留完整 cohort 的本地依赖快照。

本轮验证

检查	结果
标准 loopx canary premerge --from-git-diff --git-diff-base origin/main	5/5 direct + 19/19 selected checks passed，0 failed，0 advisory failures；命令退出 1，整体为 manual_review_required：保留仓库既有 benchmark_sensitive 维护者审查门槛，不将该状态记作整体 PASS
Source 管理	46 passed
实际 prepared provider：checkpoint、structured result、history outcome、judge failures、visualizer receipt	132 passed + 7 subtests passed
Receipt-bound LoopX controller/judge HTTP	52 passed，6 skipped
同一当前 upstream 的未修改 checkpoint 基线	45 passed
同一当前 upstream 的非有限 HTTP 反例	未修改 provider 在 capture 明确返回 HTTP 409；修复后同一 oracle 通过，包含于上述 52 项
Focused Ruff、双语 RFC、完整 diff whitespace、8 个 PR 文件的 public-boundary	PASS；0 blocking hits
远端源码核对	远端完整 tree a34ce040a1db52588c6a589a1803cc72e4274104 与上述测试工作树逐字节一致；最终远端 head 的 RFC/committed diff 检查再通过

修复候选合计 230 passed + 7 subtests passed，6 skipped；上游对照单独列出，不混入合计。6 个跳过仍为 3 个 Harbor 未安装、3 个显式隔离 native Docker qualification。公共扫描保留 18 条非字面 Python token 引用提示；没有实际凭据阻塞。没有运行模型/Docker benchmark，也不宣称安装中实验采用、全仓库或长期分数收益已通过。

Review 与 CI 状态

新 head 984d4aa26 的 GitHub CI 已触发；截至本次更新，Dependency Review 已通过，DCO 和 Python Tests 仍排队。修复说明与验证已补齐，对应 inline finding 已 resolved；原正式 REQUEST_CHANGES 保留，等待 reviewer 对新 head 复审。

旧 workflow 的失败已逐项核对：fixture pytest 依赖、Goal 提示定位、Stage2C 重复初始化及 Python fixture/断言已有对应主干修复；跨 source Goal Back 的旧超时未找到明确修复，仍属本 PR 之外的主干路径。该审计不代替新 head 的实际 CI。原 REQUEST_CHANGES 保留，等待 reviewer 对新 head 复审；本轮只提交修复，不合并 PR。

范围整理：将两种已存在的 patch 表示收敛到 source owner 的显式 canonical 列表，保留全部 provenance 义务；未扩展通用 checker 或引入新的协议/状态 owner。没有界面变更，视觉证据不适用。

---

Goal And Delivered Outcome

Repair native EdgeBench checkpoint capture/export/restore when an evaluation report retains Infinity, -Infinity, or NaN, and deliver the repair through LoopX's standard provider preparation path in one LoopX PR.

Before: strict manifest JSON serialization raises an error after such a report enters history; subsequent checkpoint capture can return HTTP 409 even when a valid finite incumbent exists. After: the native codec carries those values losslessly in a strict-JSON v2 capsule, and the real local HTTP capture/export/restore path succeeds while retaining native admission rules. The regression fails on the unchanged provider base and passes with the shipped patch.

• Outcome basis: reproduced defect and accepted repair request. No separate issue is required for this bounded fix.
• Intended base: loopx-project/loopx:main. The initial author baseline was 24f4768f24512a958f2fa3c362e3ca23dd36b928; the latest main integration and validation for this review fix are recorded above.

Author Declaration

• Written by: model_agent, OpenAI GPT-6 Astra.
• Specification: no written specification; the repair request stated in this PR is the basis. Existing provider selection and cohort-freeze behavior is defined in benchmark/edgebench/README.md at the author baseline. Native checkpoint contracts are in sforge/harness/checkpoint.py and docs/en/reference/judge-api.md at upstream revision 3fc450943d6e5b82dda0d9c2c6d17609516aa6d3.

Criterion	Disposition	Owning path	Evidence
Preserve finite v1 manifest bytes and non-finite native history/results	implemented	Bundled patch to sforge/harness/checkpoint.py	Provider codec, round-trip, malformed-input, and parity regressions
Keep source/evaluator binding, archive validation, scoring, budgets, and cooldown semantics	implemented	Native codec and checkpoint_controller.py	Provider compatibility tests and actual HTTP restore/admission regression
Ship the provider repair through a new default LoopX cohort	implemented	source.py, source-default.json, compatibility patch	Actual default CLI preparation, installation, and receipt-bound HTTP tests
Retain existing cohorts and explicit source selections	implemented	source.py	Offline reuse, explicit selection, provenance, and tamper tests

Changes And Scope

• Ship a version-controlled patch to the native provider. Non-finite values use typed path metadata in sforge_judge_checkpoint_v2; finite manifests keep the existing v1 representation. Restored report files keep the native producer's existing representation, so existing report readers continue to work.
• Apply this patch only when creating a new cohort with the default source selection. Check each touched Git blob against the reviewed preimage, apply atomically, and create a deterministic clean effective provider commit. Record the upstream commit, patch digest, and effective commit in an edgebench_source_v2 receipt, retaining the patch and Git objects for offline validation.
• Keep existing cohorts frozen and explicit repository/ref/revision selections unmodified. Unrelated upstream changes may advance; changed patch preimages require a newly reviewed patch or an explicit unmodified source selection.
• Accept known native v1/v2 schemas in the LoopX transport while preserving manifest hash, identity, archive, and declared-member checks. Reject unknown versions.
• Add synthetic regression coverage and update both benchmark preparation guides.

The codec remains in its native owner through the checked-in patch. Complete within this scope: one LoopX PR contains both the provider repair and its adoption path. No separate upstream PR is required to use this repair.

Initial compatibility and provenance (historical)

The initial submission's default preparation run resolved the following identities. Current review-fix identities and same-upstream validation are recorded above:

Item	Identity
Upstream provider	huangruiteng/EdgeBench, integration commit 3fc450943d6e5b82dda0d9c2c6d17609516aa6d3
Bundled patch SHA-256	629d600aed4efa0c5548b89d41b0671f4cb47b95f930a2e7af5e4bde3263880a
Effective provider commit	052e3e06b8d09c87db8a97b451e6fe7d59ae08ac

The effective commit is a reproducible local dependency snapshot. It is not advertised as remotely fetchable from upstream; preserve the complete frozen source directory for replay. The default source remains the integration branch, resolved once per new cohort. Existing retained cohorts are not automatically upgraded, and explicit pins opt out of this compatibility patch. Restore still requires matching native source/evaluator identity. An older consumer that only understands v1 cannot read a non-finite v2 capsule.

Initial Submission Validation (Historical Head)

• Historical tested revision: b39a1ff8bad663e5fdc5dba6c9caa0f05b0ad674. The table below preserves the initial results, including the two required-check failures addressed by the review fix above.
• Run state: finished.
• Input classes: synthetic and public fixtures.

Check kind	Result	Public-safe evidence / limitation
regression_parity	passed	The new native HTTP regression returns 409 on the unchanged provider base and succeeds with this patch. Finite v1 byte parity is retained.
real_entrypoint	passed	Ran python -m benchmark.edgebench.source --log-dir <new-cohort> with the actual checked-in defaults; verified a clean effective provider commit and installed that prepared checkout.
integration	passed	Receipt-bound pytest -q -ra benchmark/tests/test_checkpoint_controller.py benchmark/tests/test_checkpoint_judge.py: 52 passed, 6 skipped. Exercises HTTP capture/export/restore, finite incumbent plus nested non-finite values, fresh IDs, cooldown, subsequent eligible submission, and budget rejection.
unit	passed	pytest -q -ra benchmark/tests/test_edgebench_source.py: 43 passed. Covers deterministic provenance, source selection, upstream drift, offline reuse, atomic failures, tampering, and ambient Git diff configuration.
unit	passed	In the actual prepared provider checkout: checkpoint, structured-result-presence, history-outcome, judge-failure, and visualizer-receipt suites: 132 passed and 7 subtests passed.
static	passed	Focused Ruff, staged bilingual RFC check, and whitespace checks for the seven source/test/doc/config files. Semantic advisory completed; benchmark paths are outside that analyzer's scope, so ownership was reviewed manually.
static	failed	Public-boundary scan exited 1 on two unchanged public upstream documentation token placeholders in the embedded patch. Its 20 warnings are 18 non-literal Python token references and two missing local-registry notices. The PR body added no flags.
static	failed	The outer staged whitespace check flags 16 single-space blank context markers required by the canonical unified patch. The patch payload itself applies successfully with git apply --index --whitespace=error. Preserving those markers retains the reviewed patch digest.
manual	passed	Independently reviewed the flagged public placeholders and diff context markers; they are structural/example false positives. Reviewed all eight files and the public description for private material; no actual credentials, private traces, or local operating paths were found.
real_backend	not_run	Full Docker/model benchmark qualification was not run. Local HTTP tests use the real provider/service with synthetic grading.

Coverage and gaps: final targeted validation totals 227 passed tests and 7 passed subtests. The 6 optional integration skips consist of 3 requiring the unavailable Harbor package and 3 requiring explicit isolated native Docker qualification. These checks cover codec behavior, the actual prepared source and its import binding, source lifecycle, transport, and native admission. They do not establish stress-test score improvement or qualification of an earlier retained cohort. No full repository test run is claimed.

Vocabulary disposition: native capsule v2 extends the provider's own checkpoint format; source receipt v2 remains local to benchmark dependency provenance. No shared control-plane vocabulary or scoring owner is added.

Frontend / Visual Evidence

• UI impact: none. This changes benchmark source preparation and checkpoint serialization; no rendered interface changes.

Type And Area

• Bug fix, documentation update, and regression tests.
• Benchmark boundary and provider integration; long-horizon benchmark reliability.
• Shared-authority RFC fixture impact: N/A; no control-plane migration, shared authority, or RFC pair changes.

Boundary Checklist

• The diff and public description contain no private state, credentials, raw benchmark traces, internal links, or local machine paths.
• All regression data added here is synthetic; no maintainer-owned benchmark jobs were launched.
• The change is scoped to the reproduced checkpoint failure and the LoopX adoption path.
• No paired RFC changed; the staged bilingual gate was checked.
• UI impact is none.
• The contribution commit includes a DCO Signed-off-by trailer.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-27T16:00:17.755247Z	b39a1ff	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[loopx-agent]

Reviewer: model_agent; runtime_reported; gpt-6.1-sol; OpenAI; reasoning_effort=max

REQUEST_CHANGES — 当前 head b39a1ff8bad663e5fdc5dba6c9caa0f05b0ad674 的原生修复与默认采用有实际验证；新嵌套 patch 仍使两项 required premerge 失败，需要有界集成修复。

动机 / Motivation

使用默认 EdgeBench source cohort 和 native checkpoint 的操作者。一次已释放评分含 NaN 或 Infinity 时，原 native checkpoint 在严格 JSON 编码阶段返回 409；本版在原 native owner 中编码并恢复这些值，默认新 cohort 自动采用经绑定的补丁。实际默认 source CLI 产出干净且可核验的派生 commit；真实 HTTP 可创建并恢复非有限评分，但新补丁文件使现行 required premerge 两项失败。本次不启动新 benchmark、模型或 Docker 作业，不更改任务、评分、排名或已有 cohort，也不证明实际长程净收益。

这项改动有独立价值：失败结果也属于已经释放的真实历史，不能只因其中有非有限浮点值就丢掉可恢复状态。完整 codec 修复和默认采用应一起审查；仅修改 provider、却没有普通使用入口采用，不能解决原问题。新增 artifact 的检查集成尚未通过；Docker/模型及长期净收益另未资格。next_step 是由原作者在本 PR 修复并重验，不需要完成整个 benchmark 研究计划或新增产品界面。

改动思路 / Approach

source.py 继续承担依赖选择和 Git IO，非有限值编码留在 SForge 原生 checkpoint owner，LoopX 只放宽可识别 wire 版本而继续绑定完整 artifact。没有新增通用控制面、评分器、scheduler 或第二套机会计数。本 PR 应交付默认新 cohort 的原生修复、冻结来源与正常恢复，并解决本次新增 required 检查失败；已有实验、完整 Docker 科学资格和长期收益分别保留。

我沿实际 python -m benchmark.edgebench.source 到准备后的 provider、native checkpoint HTTP、LoopX artifact 及 restore 检查了后继，不只读取作者报告。Git full-index preimage、文件 mode、patch digest、完整 diff 和确定性 commit 绑定在既有 source receipt。原 native owner 仅对已释放 history/results 作 wire 转换；resource、budget、cooldown、source 身份继续由原严格验证负责。已有 v1 cohort 和显式独立 source 都有真实消费者，保留分支合理。

仓库经验中的“核对实际后继和结果”适用于此处，但不自动证明模型收益；本次只有真实依赖/transport 与合成 native 状态资格。派生 commit 是本地冻结的依赖快照，需要保留 cohort；它不冒称可直接从远端重新 fetch 的 upstream commit。

具体改动 / Changes

完整 base 24f4768f24512a958f2fa3c362e3ca23dd36b928 到 head 共 8 文件、+1064/-28。直接 source 扩展 +143/-4；525 行 patch 是可执行依赖输入，完整包含四个 native 文件（生产 +126/-6，测试 +247/-1 与中英文文档），没有把它当普通静态文档略过。其余两份 LoopX README、default 配置、artifact validator 和两份测试也已完整审查。

spec_ref=benchmark/edgebench/README.md，固定 spec_revision=24f4768f24512a958f2fa3c362e3ca23dd36b928；另读 native 原始 docs/en/reference/judge-api.md 于 3fc450943d6e5b82dda0d9c2c6d17609516aa6d3 的 checkpoint 契约。以下 criterion_id 按已读条文和演示缺陷建立本次映射，未将本 PR 新文档冒作先前验收：

criterion_id	本次处置与证据
Select and freeze one source cohort	implemented：真实默认 CLI 产生干净 052e3e06b8d09c87db8a97b451e6fe7d59ae08ac，upstream、patch 与生效 commit 均绑定。
Reuse existing cohorts without refresh	implemented：43 source 测试覆盖旧 v1、离线重用、当前 asset 改变不改旧 cohort、冲突/篡改/失败 apply 不发布。
Explicit independent source selection	implemented：显式 repository/ref/revision 保持不打补丁的 v1 路径，原选择冲突仍拒绝。
Preserve native checkpoint state and opportunity clocks	implemented：132 native 测试及 7 subtests、52 LoopX HTTP 测试和同 45 原生用例对照支持；没有增加机会或修改评分规则。
Deliver a validated default repair	not_met：实际采用和恢复已过，但本次新增 patch 使标准 premerge 两项失败；需完成 scoped check integration 后复验。

关键代码讲解

1. source.py:186::prepare_source 用已有选择参数区分新默认和显式来源；临时目录内 apply、完整验证后才原子发布。已有 cohort 先校验自己的冻结状态，绝不刷新。
2. source.py:123::_validate_patched 不只比 SHA：还检查 full-index preimage、实际 upstream→effective diff、tree 和确定性 commit payload。新 upstream 若碰到已修改 preimage，必须明确失败，由新 reviewed patch 或显式 unmodified selection 处理。
3. patch 中 native _encode_manifest / _decode_manifest 将 released history/results 中的非有限值编码为 null 加 path/kind，读入后先恢复原浮点值，再运行原 native validation。有限 v1 字节保持原样；重复 key/path、无标记非有限数、非法根/索引/kind 不被接受。
4. checkpoint_controller.py:93 接受两个 native wire tag；原 manifest、archive、member 绑定仍执行，没有把新 schema 标签当作 artifact 可信证明。

对主干的风险 / Risks

[P2] 完成新增 nested patch 与 required 检查的集成。 对本 exact head 实际运行标准 loopx canary premerge --from-git-diff --git-diff-base 24f4768f24512a958f2fa3c362e3ca23dd36b928：5 项 direct 中 1 项失败（committed diff whitespace），19 项 selected 中 1 项失败（public-boundary），其余分别 4/18 项通过。前者标出 patch 中 16 个表示空白上下文的单空格行；后者在新 patch 的第 31/48 行标出两个原公开 API 示例。已核对原 native preimage，这些是合法 patch 结构和原公开示例的误报，没有发现实际 credential 或私有数据泄漏。但新增默认依赖仍无法通过现有必须检查，不能仅以误报说明把结果记为通过。

请在现有 artifact/check owner 内作有界修复，保留合法 unified patch、内容 provenance 和安全检查的有效覆盖；如果改变 asset 表示或字节，同步重新绑定 digest 并验证实际默认 prepare。不要盲删空白 context marker、用宽泛 secret/whitespace 豁免，或删除负例掩盖失败。修复后标准预检和现有 source/native/HTTP/parity oracles 应同时成立。这是本次提出的一个集成问题，不是 codec 运行时缺陷，也不要求作者修复无关 Goal 状态。

语义与 CI 对齐

PASS：43 source 测试；实际准备 provider 的 132 测试及 7 subtests；receipt-bound LoopX HTTP 52 通过；Ruff。相同新非有限 HTTP oracle 在未改 native 3fc450943d6e5b82dda0d9c2c6d17609516aa6d3 返回 409 而失败，在实际派生 provider 通过；同 45 个原生 checkpoint 用例分别在两版通过，包含关闭、source binding、budget/cooldown 与恢复。初次 native pytest 因命令误写了不存在的文件而未收集测试，已更正命令；不归因于产品。52 HTTP 选择中另有 6 skipped：3 个缺 Harbor 依赖、3 个显式真实 native Docker qualification；本轮未新跑 Docker/模型或宣称完整科学恢复。

FAIL：上述两项新 required premerge；CQR cqr_ba01ac093316db75ea22 为 FAIL，实际规范回执已在首次公开结论前完整读取。本轮未查询或等待 GitHub CI。代码本身未改排名、任务语义、原生成绩或机会时钟；现有原生逻辑和 counterfactual 支持局部语义，完整 Docker/Harbor、安装中实验采用、长期效果和全费用仍未资格。

没有 rendered UI 改动，视觉审查 not_applicable。默认改变只发生于新默认 cohort；native checkpoint enablement、显式来源和旧 cohort 的关闭/保留路径均核查。schema/kind 是局部显式 typed 判定，无 prose/substr 状态分类；格式正则仅检查 Git/path 语法。source 和 native 错误是机器强制条件，文档只是解释恢复，不将 enforced refusal 称为可忽略 guidance。

我的整体评价 / Verdict

这项 bounded increment 的目标、架构归属与成本相称，long_horizon/user_experience 在已验证恢复路径上 improved：原来无法保存的已释放历史能恢复，默认入口也实际采用。它不证明分数、模型行为或净成本收益。最高价值的局部整理是让合法嵌套 asset 与现行 checks 正确衔接；无需另建 selector、provider authority 或把上游全量集成作为泛化前置。

当前运行语义为 intentional_change_validated，但 required validation integration 尚未过，因此 REQUEST_CHANGES。请在原 PR 完成有界修复后按新完整 head 复验；保留 6 个可选跳过、真实 Docker/科学/安装/长期成本未知。当前评审不授予作业、安装、合并或新费用权限。

English verdict: REQUEST_CHANGES at b39a1ff: native nonfinite checkpoint recovery and default adoption are verified, but the newly embedded patch fails two required premerge checks; scoped artifact/check integration remains necessary, with six optional Harbor/Docker cases unqualified.