[hhyykk]

Goal And Delivered Outcome

A public quota read composes several existing typed decisions. When the caller has no outer executable-revision scope, each decision rescans the TS code tree. Global summaries and Todo views pay this cost repeatedly, although the runtime already supports a bounded request scope.

Put that existing scope at build_quota_should_run, the shared public decision interface. The compatibility facade and global-view adapters inherit it. Status remains a caller-supplied snapshot; provider/callback reads retain their existing behavior. No decision result or source fact is cached by this change.

Basis: TypeScript control-plane migration RFC Stage 3 caller adoption at 1a9933cce84d9ad94d3eb83490b4404741c7834a; target main. Observable before → after: repeated code-identity scans become one per quota read while native calls, decisions, pause/refusal signals and view coverage remain unchanged.

Author Declaration

• Written by: model_agent, OpenAI GPT-6 Codex, for the requesting operator.

Implemented against

Specification: docs/architecture/rfcs/typescript-control-plane-migration-v0.md, revision 1a9933cce84d9ad94d3eb83490b4404741c7834a.

Criterion	Disposition	Symbol / evidence
Reuse existing typed transport from actual callers	implemented	public quota/should_run.py interface; facade/global views
Verify complete costs rather than infer gain from RPC counts	implemented	matched complete SQLite global-summary CLI plus File/SQLite behavior parity; RPC sequences unchanged
Preserve authority and source facts	implemented	current pause wins in nested and independent reads; normal decisions and view outputs retain parity
Replacement-first economics	implemented within this scope	+3 product lines including whitespace, two executable statements; existing scope owner reused, no new bridge/cache/semantic implementation; semantic deletion 0
Complete T0–T4, R1–R3 or provider/default promotion	out_of_scope	no such qualification or routing change claimed

Self-check: production/test/docs guard review, related tests, real disposable providers, historical regression sensitivity and normal installed artifacts. No live task or external provider execution was launched.

Scope And Continuation

• One existing module owns the bounded decision's code identity; no per-view copies, new helper, dependency, config option, wire operation, schema, public argument or permission.
• Existing outer scopes join as before. Normal quota should-run, Chat workers and the proposed perf(portfolio): share executable revision across one evidence read #6990 portfolio outer scope already provide this lifetime; their gains are not counted here. The benchmark uses previously unscoped global views on main without perf(cli): reuse selected dispatch for manager Inbox commands #6989/perf(portfolio): share executable revision across one evidence read #6990.
• The next independent quota read resolves current code again. Changed status inputs and callbacks remain subject to existing admission; a paused result cannot become a runnable cached result.
• Reviewed the 48-PR discovery inventory and refreshed the 47 still open before publication. tracking: land research continuity as small PRs into main #6838 shares should_run.py but changes acceptance guard logic; it adds no executable request scope. Its related acceptance hunks are already represented on this base. perf(portfolio): share executable revision across one evidence read #6990 changes the portfolio parent lifetime, perf(cli): reuse selected dispatch for manager Inbox commands #6989 changes Inbox CLI dispatch, Add projection envelopes to global todos and risks #5598 changes global projection envelopes, and refactor(todos): compose full readback in one TypeScript transaction #6874/perf(control-plane): reuse acceptance reads within one Todo snapshot #6984 change Todo reads. This changes distinct production/test hunks and does not repeat those implementations. Shared RFC edits are separate paragraphs.
• Complete within this public-reader scope. Coarse TS transaction consolidation and remaining migration/qualification stay separate; no speculative bridge or follow-up project is added.

Validation

• Tested revision: cdc0c89e13c13a7f53427b60ad881c18583d6049 on a590609a357f7cde17289b5ceba9f85a9fcb46cc. Performance dataset predates this Lark-only rebase; measured quota/native/global/CLI files have unchanged hashes. The 189 related tests and installed artifacts were rerun on this final head.
• Run state: finished. Input classes: synthetic, public_fixture.

Check kind	Result	Public-safe evidence / limitation
integration	passed	189 related Python tests: quota parity, request scope, paused precedence, global summary/Todo/risk views, CLI entrypoint and Todo source precedence
regression_parity	passed	new public-facade/bounded-reader test uses actual native IPC and fingerprint filesystem IO; independent reads resolve fresh code and observe pause; nested reads reuse caller code identity
regression_parity	passed	same final test source fails on the pinned baseline's repeated scans and passes on HEAD; actual source roots verified
real_entrypoint	passed	150 fresh source-verified timed CLI processes and 120 direct global-summary samples, plus supporting global-Todo readback
real_backend	passed	real File and SQLite canonical stores; 1/8 Goals, registered worker, one open Todo per Goal created through the public mutation owner; indexed JSON/Markdown observation artifacts exist
integration	passed	normal wheel/sdist builds, independently installed environments and actual console from empty-project cwd without source PYTHONPATH; both providers, summary/Todo readback, unknown Goal denial, unchanged registry/state bytes
static	passed	scoped Ruff, control-plane typecheck, bilingual staged/head checks and whitespace check; diff-scoped semantic advisory found no supported new vocabulary carrier

Early fixture/test construction failures were corrected before qualification. Incomplete artificial frontier rows, missing run-artifact profiles and small exploratory timings are excluded; the final fixture uses native public Todo creation and real observation files. No failing scenario was removed to obtain a passing result.

Complete-command performance

Pinned main 1a9933cce84d9ad94d3eb83490b4404741c7834a versus this HEAD; Linux, Python 3.11, Node 24.21.0 / SQLite 3.53.4. Same disposable fixture and sequential arms, 15 samples per arm; nearest-index p95. Each sample starts a new Python CLI process and includes startup/imports, parser, real status/quota reads, public source scanning, view projection and output. The managed native runtime is warm.

Both complete packages are precompiled with the same interpreter and get one untimed CLI warmup; bytecode writing is disabled during timed CLI children. Compiled module sets are checked equal. This measures a prepared installation/cache state, not first-ever compilation or cold native startup. Each CLI proves its actual Python and TS roots.

Initial CLI timings had four extra setup-module bytecode files in the candidate and are excluded from gain claims. The primary row is the controlled rerun. Earlier post-import view timings remain supporting experiments; all their behavior and method observations remain in parity checks.

Provider	Goals	Complete CLI p95 ms, base → head	Whole-view code scans
sqlite	8	6960.3 → 1851.9 (-73.4%)	346 → 10

Global views still perform their status read and final envelope sealing separately; this does not claim one scan for the whole view. Native method sequences/counts are unchanged. The speedup removes repeated executable-tree IO, not RPCs, state reads or scheduling checks.

Every public output matches across arms and samples after normalizing only the top-level observation timestamp and projection-envelope read/serve clocks and elapsed-age fields. Null clock/age values remain null. Persisted progress timestamps, source-updated times, freshness/coverage/alert flags, Goals/Todos, reasons, omissions and boundary fields remain in the comparison. The unconfigured local global-directory source is disclosed identically by both views; no all-healthy or complete global-inventory claim is made. Raw local samples remain private.

This measures local evidence-read overhead, not long-horizon task quality, model/token savings, cold native startup, PostgreSQL or all of LoopX. Already-scoped consumers should not be credited with another equivalent speedup.

Portable reproduction

Save the three scripts outside both checkouts. Install their Python test dependencies and run npm ci in both checkouts. Select the same Python and qualified Node version, use empty output directories, and run sequentially on an idle host:

python3 setup_goals.py HEAD_CHECKOUT FIXTURE_DIRECTORY
python3 -m compileall -q BASE_CHECKOUT/loopx HEAD_CHECKOUT/loopx
python3 qualify_global.py BASE_CHECKOUT FIXTURE_DIRECTORY BASE_OUTPUT --samples 15
python3 qualify_global.py HEAD_CHECKOUT FIXTURE_DIRECTORY HEAD_OUTPUT --samples 15
python3 qualify_cli.py BASE_CHECKOUT FIXTURE_DIRECTORY/sqlite-8 BASE_CLI_OUTPUT --samples 15
python3 qualify_cli.py HEAD_CHECKOUT FIXTURE_DIRECTORY/sqlite-8 HEAD_CLI_OUTPUT --samples 15

The fixture directory is shared deliberately so persisted source bytes and identities remain comparable. Setup creates synthetic canonical stores and public Todos only; it performs no work attempt. The qualifier disables usage pings, records every sample/native method/source proof and stops its managed runtime. A small explicit public scan directory keeps unrelated repository scans out of both arms.

setup_goals.py SHA256: 338c2b0e33b541107bbb41b43dd6b5fc375fc10c61a91c147745d640f0b71165.

import argparse,json,os,sys,tempfile
from pathlib import Path
from datetime import datetime,timezone,timedelta
p=argparse.ArgumentParser();p.add_argument('repo');p.add_argument('root');a=p.parse_args();repo=Path(a.repo).resolve();root=Path(a.root).resolve();root.mkdir(parents=True,exist_ok=True);tmp=root/'tmp';tmp.mkdir(exist_ok=True);os.environ.update(TMPDIR=str(tmp),TEMP=str(tmp),TMP=str(tmp),LOOPX_USAGE_PING='0');tempfile.tempdir=str(tmp);sys.path[:0]=[str(repo),str(repo/'tests/control_plane')]
from canonical_authority_fixture import initialize_canonical_authority
from loopx.control_plane.coordination.runtime_shadow import build_todo_runtime_shadow_projection
from loopx.status import collect_status
from loopx.control_plane.todos.mutation_api import add_goal_todo
from loopx.control_plane.coordination.coordination_state_contract import TODO_DOMAIN_READ_RECORD_SCHEMA_VERSION,TODO_DOMAIN_RECORD_FIELDS
from loopx.control_plane.quota.should_run import build_quota_should_run
from loopx.control_plane.effect_runtime import effect_runtime_request_scope,restart_effect_runtime
for provider in ('file','sqlite'):
 for count in (1,8):
  folder=root/f'{provider}-{count}';runtime=folder/'runtime';goals=[]
  for i in range(count):
   goal=f'goal-{i}';project=folder/goal;project.mkdir(parents=True);state=project/'state.md';state.write_text('---\nstatus: active\n---\n# Goal\n## Agent Todo\n')
   projection=build_todo_runtime_shadow_projection(goal_id=goal,todos=[],handoff_mode='soft_claim');projection['todo_read_model'].update(schema_version=TODO_DOMAIN_READ_RECORD_SCHEMA_VERSION,contract_fields=list(TODO_DOMAIN_RECORD_FIELDS));initialize_canonical_authority(runtime,goal,projection,state_path=state,provider=provider)
   goals.append({'id':goal,'domain':'quota-read','status':'active','repo':str(project),'state_file':str(state),'adapter':{'kind':'generic_project_goal_v0','status':'connected'},'coordination':{'registered_agents':['worker'],'agent_model':'peer_v1'},'authority_sources':[],'quota':{'compute':1.0,'window_hours':24,'slot_minutes':1,'allowed_slots':100}})
   index=runtime/'goals'/goal/'runs/index.jsonl';index.parent.mkdir(parents=True,exist_ok=True);jp=index.parent/'fixture.json';mp=index.parent/'fixture.md';row={'run_id':f'fixture-{i}','goal_id':goal,'agent_id':'worker','generated_at':(datetime.now(timezone.utc)-timedelta(minutes=1)).isoformat(),'classification':'read_only_refresh','recommended_action':'Inspect the bounded fixture.','json_path':str(jp),'markdown_path':str(mp)};jp.write_text(json.dumps(row));mp.write_text('# Synthetic read observation\nNo task completion is claimed.\n');index.write_text(json.dumps(row)+'\n')
  registry=folder/'registry.json';registry.write_text(json.dumps({'schema_version':1,'common_runtime_root':str(runtime),'goals':goals}))
  with effect_runtime_request_scope():
   for g in goals:
    created=add_goal_todo(registry_path=registry,goal_id=g['id'],role='agent',text='Inspect the bounded fixture.',priority='P1',task_class='advancement_task',action_kind='implement',claimed_by='worker',agent_id='worker',operation_id='fixture-create:'+g['id']);assert created['ok'],created
   status=collect_status(registry_path=registry,runtime_root_override=None,scan_roots=[],limit=40,include_public_boundary_scan=False);assert status['ok'],status.get('contract')
   q=build_quota_should_run(status,goal_id='goal-0',agent_id='worker');print(provider,count,q.get('state'),q.get('decision'),q.get('reason'),flush=True)
restart_effect_runtime()

qualify_global.py SHA256: e9e8343c7c7cf5e243adbfdd756b0cd1101bcd796ef2f9b54f66a2fb79cf07af.

import argparse,hashlib,json,os,statistics,subprocess,sys,tempfile,time
from pathlib import Path
p=argparse.ArgumentParser();p.add_argument('repo');p.add_argument('fixtures');p.add_argument('out');p.add_argument('--samples',type=int,default=15);p.add_argument('--providers',default='file,sqlite');p.add_argument('--counts',default='1,8');a=p.parse_args()
repo=Path(a.repo).resolve();fixtures=Path(a.fixtures).resolve();out=Path(a.out).resolve();out.mkdir(parents=True,exist_ok=True);tmp=out/'tmp';tmp.mkdir(exist_ok=True);os.environ.update(TMPDIR=str(tmp),TEMP=str(tmp),TMP=str(tmp),LOOPX_USAGE_PING='0',PYTHONDONTWRITEBYTECODE='1');tempfile.tempdir=str(tmp);sys.path.insert(0,str(repo))
import loopx
from loopx.summary_all import build_summary_all
from loopx.global_todos import build_global_todos
from loopx.control_plane import effect_runtime as er
assert Path(loopx.__file__).resolve()==repo/'loopx/__init__.py';assert er._control_plane_root().resolve()==repo/'loopx/control_plane'
original=er._runtime_fingerprint;request=er._request_with_info;scans=[];methods=[]
def scan():
 r=original();scans.append(r);return r
def rpc(*args,**kw):methods.append(kw['method']);return request(*args,**kw)
er._runtime_fingerprint=scan;er._request_with_info=rpc

def normalize(value,path=()):
 if isinstance(value,dict):
  result={}
  for k,v in value.items():
   if path==() and k=='generated_at':result[k]='<observation-time>'
   elif 'projection_envelope' in path and k in {'observed_at','served_at','last_read_at'}:result[k]=None if v is None else '<observation-time>'
   elif 'projection_envelope' in path and k in {'age_seconds','staleness_seconds'}:result[k]=None if v is None else '<elapsed>'
   else:result[k]=normalize(v,(*path,k))
  return result
 if isinstance(value,list):return [normalize(v,(*path,str(i))) for i,v in enumerate(value)]
 return value

def percentile(v):return sorted(v)[int((len(v)-1)*.95+.5)]
rows=[]
try:
 for provider in a.providers.split(','):
  for count in map(int,a.counts.split(',')):
   folder=fixtures/f'{provider}-{count}';reg=folder/'registry.json';public=folder/'public';public.mkdir(exist_ok=True);(public/'README.txt').write_text('Synthetic public fixture. No private content.\n')
   kwargs=dict(registry_path=reg,runtime_root_override=None,scan_roots=[public],agent_id='worker',limit=128)
   first=build_summary_all(**kwargs,time_range='24h');assert first['ok'] and first['summary']['runnable_todo_count']==count,first
   supporting=build_global_todos(**kwargs);assert supporting['ok'] and supporting['summary']['matched_todo_count']==count,supporting
   warm=[];full=[];scan_counts=[];calls=[];observations=[];proofs=[];outputs=[]
   for _ in range(a.samples):
    scans.clear();methods.clear();t=time.perf_counter();value=build_summary_all(**kwargs,time_range='24h');warm.append((time.perf_counter()-t)*1000);assert value['ok'] and value['summary']['runnable_todo_count']==count;scan_counts.append(len(scans));calls.append(list(methods));observations.append(value)
   script='''import pathlib,sys,json,loopx
from loopx.control_plane import effect_runtime as er
from loopx.entrypoint import main
expected=pathlib.Path(sys.argv[1]);sys.argv=sys.argv[:1]+sys.argv[2:]
assert pathlib.Path(loopx.__file__).resolve()==expected/'loopx/__init__.py'
assert er._control_plane_root().resolve()==expected/'loopx/control_plane'
scans=[];fingerprint=er._runtime_fingerprint
def scan():
 r=fingerprint();scans.append(r);return r
er._runtime_fingerprint=scan
code=main()
sys.stderr.write('PROOF='+json.dumps({'module':str(pathlib.Path(loopx.__file__).resolve()),'code_scans':len(scans)})+'\\n')
raise SystemExit(code)
'''
   argv=['--registry',str(reg),'--format','json','global-summary','--agent-id','worker','--limit','128','--scan-path',str(public)]
   for _ in range(a.samples):
    t=time.perf_counter();pr=subprocess.run([sys.executable,'-c',script,str(repo),*argv],cwd=repo,env={**os.environ,'PYTHONPATH':str(repo)},capture_output=True,text=True,timeout=90);full.append((time.perf_counter()-t)*1000);assert pr.returncode==0,(pr.stdout,pr.stderr);value=json.loads(pr.stdout);assert value['ok'] and value['summary']['runnable_todo_count']==count;outputs.append(value);proof=json.loads(next(x.removeprefix('PROOF=') for x in pr.stderr.splitlines() if x.startswith('PROOF=')));assert proof['module']==str(repo/'loopx/__init__.py');proofs.append(proof)
   row={'provider':provider,'goals':count,'warm_samples_ms':warm,'cli_samples_ms':full,'warm_p50_ms':statistics.median(warm),'warm_p95_ms':percentile(warm),'cli_p50_ms':statistics.median(full),'cli_p95_ms':percentile(full),'scans':scan_counts,'methods':calls,'source_proofs':proofs,'raw_warm':observations,'raw_cli':outputs,'supporting_todos':supporting,'semantic':normalize(observations[0])};rows.append(row);print(json.dumps({k:row[k] for k in ('provider','goals','warm_p95_ms','cli_p95_ms','scans')}),flush=True)
 (out/'receipt.json').write_text(json.dumps({'revision':subprocess.check_output(['git','-C',str(repo),'rev-parse','HEAD'],text=True).strip(),'product_sha256':hashlib.sha256((repo/'loopx/control_plane/quota/should_run.py').read_bytes()).hexdigest(),'harness_sha256':hashlib.sha256(Path(__file__).read_bytes()).hexdigest(),'rows':rows},indent=2)+'\n')
finally:er.restart_effect_runtime()

qualify_cli.py SHA256: a30c0ad45b31f3c9eb16c0fdcb8cee023a45448af78cf1047d048bac8cd290ef.

import argparse,hashlib,json,os,statistics,subprocess,sys,time,tempfile
from pathlib import Path
p=argparse.ArgumentParser();p.add_argument('repo');p.add_argument('fixture');p.add_argument('out');p.add_argument('--samples',type=int,default=15);a=p.parse_args();repo=Path(a.repo).resolve();fixture=Path(a.fixture).resolve();out=Path(a.out).resolve();out.mkdir(parents=True,exist_ok=True);tmp=out/'tmp';tmp.mkdir(exist_ok=True)
env={**os.environ,'TMPDIR':str(tmp),'TEMP':str(tmp),'TMP':str(tmp),'LOOPX_USAGE_PING':'0','PYTHONPATH':str(repo),'PYTHONDONTWRITEBYTECODE':'1'}
compile_env=dict(env);compile_env.pop('PYTHONDONTWRITEBYTECODE',None)
subprocess.run([sys.executable,'-m','compileall','-q',str(repo/'loopx')],cwd=repo,env=compile_env,check=True)
script='''import sys,pathlib,json,loopx
from loopx.control_plane import effect_runtime as er
from loopx.entrypoint import main
expected=pathlib.Path(sys.argv[1]);sys.argv=sys.argv[:1]+sys.argv[2:]
assert pathlib.Path(loopx.__file__).resolve()==expected/'loopx/__init__.py'
assert er._control_plane_root().resolve()==expected/'loopx/control_plane'
scans=[];original=er._runtime_fingerprint
def scan():
 r=original();scans.append(r);return r
er._runtime_fingerprint=scan
code=main()
sys.stderr.write('PROOF='+json.dumps({'module':str(pathlib.Path(loopx.__file__).resolve()),'scans':len(scans)})+'\\n')
raise SystemExit(code)
'''
argv=[sys.executable,'-c',script,str(repo),'--registry',str(fixture/'registry.json'),'--format','json','global-summary','--agent-id','worker','--limit','128','--scan-path',str(fixture/'public')]
def invoke():
 t=time.perf_counter();pr=subprocess.run(argv,cwd=repo,env=env,capture_output=True,text=True,timeout=90);elapsed=(time.perf_counter()-t)*1000;assert pr.returncode==0,(pr.stdout,pr.stderr);value=json.loads(pr.stdout);assert value['ok'] and value['summary']['runnable_todo_count']==8;proof=json.loads(next(x.removeprefix('PROOF=') for x in pr.stderr.splitlines() if x.startswith('PROOF=')));assert proof['module']==str(repo/'loopx/__init__.py');return elapsed,value,proof
samples=[];observations=[];proofs=[]
try:
 invoke()
 for _ in range(a.samples):
  elapsed,value,proof=invoke();samples.append(elapsed);observations.append(value);proofs.append(proof)
 receipt={'revision':subprocess.check_output(['git','-C',str(repo),'rev-parse','HEAD'],text=True).strip(),'product_sha256':hashlib.sha256((repo/'loopx/control_plane/quota/should_run.py').read_bytes()).hexdigest(),'method':'all package modules compiled with same interpreter; one untimed CLI warmup; each sample new Python process; warm managed native runtime','python':sys.version,'samples_ms':samples,'p50_ms':statistics.median(samples),'p95_ms':sorted(samples)[int((len(samples)-1)*.95+.5)],'raw':observations,'proofs':proofs,'bytecode_modules':len(list((repo/'loopx').rglob('*.cpython-311.pyc')))};(out/'receipt.json').write_text(json.dumps(receipt,indent=2)+'\n');print(json.dumps({k:receipt[k] for k in ('revision','p50_ms','p95_ms','bytecode_modules')}),flush=True)
finally:
 sys.path[:0]=[str(repo),str(repo/'tests')]
 from managed_effect_runtime_fixture import capture_disposable_effect_runtimes,stop_disposable_effect_runtimes
 stop_disposable_effect_runtimes(out,capture_disposable_effect_runtimes(out))

Coverage/gaps: full repository suite, Windows, PostgreSQL, browser/model roundtrips, live provider delivery and hosted CI results are separate and were not claimed by the local checks. No TS semantic implementation changed; real typed transport and affected Python callers were exercised.

Frontend / Visual Evidence

UI impact: none. Existing read interfaces and output shapes remain unchanged; no new capability or screen is introduced.

Change Area

• Control plane: public quota-reader caller adoption.

Technical Direction

TypeScript migration Stage 3, existing executable request-scope owner. Domain/authority owners and provider routing remain unchanged.

Shared-authority RFC fixture impact

• Schema: 1/8 canonical Goals, registered worker, open Todo from public creation, actual read-observation artifacts, global summary and Todo projections.
• Changed semantic dimensions: none; nested lifetime, independent-read refresh, current pause and refusal remain covered. Existing source limits, coverage and warnings remain visible.
• Provider conformance arms: real File/SQLite; installed artifacts repeat both.
• Legacy/file/PostgreSQL promotion rehearsal: not run. This does not promote or route a backend or change compatibility projection semantics; full D1–D3/R1–R3 qualification remains outside this bounded lifetime fix.

Boundary Checklist

• Public-safe diff/body; no private state, raw traces, credentials, internal URLs or local machine paths.
• Existing PRs reviewed; no duplicated maintainer benchmark project.
• Scoped to the requested measured improvement.
• English/Chinese RFC pair changed; staged/head bilingual checks pass.
• UI impact none.
• DCO sign-off included.