fix(chat): continue private bound Sessions through local source admission

[loopx-agent]

Goal And Delivered Outcome

Existing local Chat sends cannot continue a private provider-bound Session: generic submit correctly requires source admission. A normal local send now verifies the current binding and enters that Session's existing queue, preserving its thread, client identity, narrow audience and actual web origin. The immutable base rejects four project/steward HTTP cases that this head accepts.

The intended base is main. This is the existing R3/App conversation path, separate from upgrade orchestration.

Author Declaration

• Written by: model_agent — Codex, OpenAI GPT-6 family.
• Implemented against: App conversation RFC and TS placement guidance at base a0fb547af9aac4e4d36f59fb05cb64eb56fd750f; paired RFC checkpoint updated in this PR.

Criterion	Disposition	Implementation / evidence
Preserve the original bound conversation and reusable async queue	implemented	Typed resolveBoundConversation; native_chat/queued_admission.py; real HTTP/store thread, replay and busy-FIFO tests
Fresh audience/source authority and independent execution grants	implemented	Provider observation outside the publication fence, exact recheck through queue commit; typed validateSourceIngress; coordination-root source policy; revocation/group/wrong-source tests
One TS decision owner, Python IO	implemented	Existing binding/scope/source owners reused; controller API retained; legacy provider parity tested
Complete packaged discovery, live shared-provider adoption, recipient collaboration and original result return	deferred	Existing presentation/collaboration RFC acceptance remains open; this independently testable Core/API prerequisite does not certify that journey

Self-check: read the owning RFC, callers and repository rules; ran the offline and installed-package checks below. Localize queue IO in the existing native Chat boundary and share verified context adaptation. HTTP avoids repeated provider IO; one-observation and publication-fence tests cover that refactor. The existing sandbox test now inspects the permission-bearing thread/start, preserving the assertion when native thread naming follows startup.

Scope And Continuation

Use the existing POST /api/chat/sessions/{session_id}/turns with message and stable client_turn_id; delivery: "queue" remains optional. No new Session, Goal, auth system, ledger, scheduler or execution grant is introduced. Groups and direct steering retain source guards. The request body cannot supply owner/provider/origin claims. Steward provenance stays at the registered coordination root and uses the existing source policy. New local ingress records its actual web origin; existing provider receipts retain their shape.

This closes local source admission at the Core/API boundary. Packaged frontend discovery and live adoption remain with the existing presentation/collaboration owners and RFC acceptance; no parallel follow-up program is created. The slice can be independently tested and reverted without changing provider delivery or upgrade primitives.

Validation

• Tested revision: ed8b41a21cbf1b20686efc130145f71fd06eccb6.
• Run state: finished. Inputs: synthetic and public fixtures; no paid model/provider calls or live installation.

Check kind	Result	Evidence / limitation
regression_parity	passed	Four HTTP cases fail before the fix. The permission-bearing fixture passes on verified immutable base source and final head; no permission assertion was weakened.
real_entrypoint / real_backend	passed	122 Python tests: existing project/binding/queue/steward/context cases plus 28 HTTP cases against isolated real File/SQLite authority and Chat storage. Provider identity/model subprocesses are synthetic.
real_entrypoint	passed	28 HTTP cases from a normal noneditable wheel under -I, without a source overlay. Installed authority modules are used; all 11 changed production modules byte-match the wheel. Model home is isolated.
unit / static	passed	41 focused TS tests, typecheck:control-plane, configured mypy, changed-Python Ruff, semantic advisory/full-tree checks, maintainability, bilingual RFC validation and public-boundary scans.
manual / real_entrypoint	partial	Packaged desktop and 390px browser with the isolated real SQLite backend: ordinary workspace send, reply and reload work, but select a separate project channel rather than the existing private bound Session. Exact bound-Session API input/replay succeeds; closed-source retry refuses. Provider identity and model are synthetic; live model/Lark adoption is not run.

Coverage includes full input, the same thread, actual web/provider origins, busy FIFO, exact replay, group refusal, wrong/revoked/closed sources, observation-versus-publication races and source-policy separation. Legacy provider behavior stays covered. Exact-scope change quality passes. Premerge passes six direct checks plus 11 selected catalog/risk/public-boundary checks, with no failures or warnings. An earlier stale quality-receipt gate was corrected by recording and re-verifying this exact final scope, then rerunning premerge.

Frontend / Visual Evidence

• UI presentation impact: none; no layout or first-screen change. The existing composer's backend send path changes for private bindings.
• No visual change is proposed. The normal wheel bundle was exercised on desktop and at 390px: one composer, no page overflow, and reload preserves the ordinary workspace reply. This exposes a remaining entrypoint gap: the existing workspace selector opens project.<ref>, while the bound private conversation retains its separate original channel and history. API acceptance therefore does not establish shared-session frontend delivery. The existing presentation owner must discover/select the source-verified original Session; do not merge histories, infer a registered Goal/Agent for a no-Goal project, or create a second queue.

Type of Change

• Bug fix
• Documentation update
• Test update

LoopX Area

• Control plane
• Host or runtime integration

Technical Direction

R3/App conversation acceptance and the established typed collaboration owner. No full TS migration, Goal-authority promotion, provider-store refactor or authority-store provider-routing change is claimed; shared-authority promotion fixtures are N/A. File/SQLite are the real backend arms for the affected source-admission path.

Boundary Checklist

• Public-safe code, docs, fixtures and PR text; no private state, credentials, raw logs or machine paths.
• No benchmark work or duplicate benchmark ownership.
• Scoped to the demonstrated source-admission gap; no migration orchestration.
• Both RFC mirrors changed and bilingual validation passed.
• No visual UI change; remaining frontend qualification disclosed.
• Every commit has a DCO sign-off.

[loopx-agent]

Reviewer: model_agent · gpt-6.1-sol · OpenAI · runtime_reported · reasoning_effort=max

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

动机

已在外部应用绑定私有项目或管家会话的本人，需要从本地 Chat 继续同一段对话。

此前原会话明明存在，本地普通发送仍被来源守卫拒绝；现在重新验证当前绑定和身份后进入原队列，继续原线程并保留原请求标识，避免重新建会话或手工搬运上下文。

独立真实 HTTP 验证表明，本地续聊保留原 Session、线程、完整正文和 FIFO；重复标识只复用原 Turn，撤权和错误来源拒绝，群聊不会继承本地身份。

本次只交付来源准入的 Core/API 前置能力，不新增 Goal、权限或队列，不宣称完整前端发现、真实 Lark 协作采用和原结果回传已经完成。

完整前端发现入口、项目接收者选择、真实协作采用与原会话结果返回仍由现有产品和协作归属继续验收。

改动思路

既有 TypeScript 绑定和来源规则继续拥有准入；Python 只观测身份及存储并复用原队列。一次观察后在同一发布锁内重查精确绑定，比另建本地身份或绕过来源守卫更合适。

当前边界是可独立执行和回滚的普通 HTTP 来源准入，不把整体 App/协作完成作为本次证据，也不提前关闭其既有验收。

来源身份先在发布锁外重新观察，再在锁内核对原绑定、当前 workspace 和原 Session，锁一直覆盖原队列提交；提交后才唤起既有 worker。web 来自主机实际入口，原绑定、会话、请求标识与正文仍由既有存储管理，不是用户新增一份需要同步的权限声明。项目不变成 Goal，管家来源策略也不自动变成执行授权。

触发	当前准入结果
当前本人私有绑定，本地普通发送	原 Session/线程/FIFO，实际 origin=web
同一请求标识、相同正文	读回原 Turn，不重复提交
群聊、变更身份、失效 workspace 或撤权	拒绝；已排队原工作按既有撤权流程取消

具体改动

完整 diff 为 17 路径、+618/-81：11 个生产路径复用既有 Chat、绑定和来源归属，四个测试路径，以及中英 RFC checkpoint。独立依据是基线的App conversation RFC，不是本 PR 新增的完成声明。private-project-continuity、source-revalidation、same-queue-recovery、source-policy-separation 已由真实入口/负例验证；packaged-collaboration-return 明确延后到既有产品/协作验收，本次没有冒充完成。

关键代码讲解

• _session_turn 把已绑定的本地普通输入送到既有 enqueue；请求体只接受原消息字段，不能自报 provider、owner 或 origin。普通未绑定路径仍用原上下文。
• local_input 在 provider IO 之后重新锁定并核对精确绑定，保留观察期间撤权、换身份和 workspace 变化的拒绝语义；不是全局 revision 一变就误拒绝无关来源。
• _enqueue_local_bound 复用已验证上下文，管家 ingress 落原 coordination root，随后提交原队列。worker 在锁外运行，原取消、失败和恢复 owner 继续负责；没有第二个 Session 或队列。
• validateSourceIngress 集中核对原 Session/client/channel/正文摘要；本地管家还要显式 web origin 与原 operator。历史 provider ingress 可保持原先省略 origin 的形状，context recipients 与执行 grants 仍分开验证。

对主干的风险

主要风险是撤权竞争、把本地消息伪装成 provider 人类消息，以及重放改写原来源。独立运行 283 项相关 Python、35 项 TypeScript、类型检查、mypy 17 文件及 changed-file Ruff 均通过。真实 HTTP 覆盖 File/SQLite、分离 Chat/coordination roots、完整正文、忙时 FIFO、group/错误来源、观察中撤权和提交锁竞争。额外双 provider 探针证明同 key 换正文不会改写原 ingress/Turn；断开绑定则取消原排队项。修复前不可变基线的四个对应 HTTP 正例均因来源守卫失败。

普通非 editable wheel 经当前前端正常构建后完成独立安装验证；11 个改动生产模块逐字节相同，28 个真实 HTTP 用例通过，仅身份远端与模型 subprocess 是合成的。最初 wheel 正确拒绝了复用工作区中的旧 bundle，随后正常重建，没有绕过 guard。标准 premerge 六项直接检查、两项 catalog、八项 risk 和一项 public-boundary 检查通过，零 hold。现有 frontend accept/stream/recovery 调用已读，但完整发现入口、真实 Lark/peer adoption/return 和安装后 App 交互未被本次 API 证据证明。

语义与 CI 对齐

这是既有来源/绑定语义的一项明确扩展，复用原 web/lark/external 值、typed owner、原队列及原权限；没有消息文本分类、隐式群聊身份、Goal 或执行权限升级。正常私有绑定发送从拒绝变成验证后入队的默认变化，已在正文、双语 checkpoint 和测试中披露。没有新增 default-off 功能；未绑定/provider/group 原路径的对照验证继续保留。按当前评审配置未查询、轮询或等待远端 CI，合并 readiness 和维护者权限另行判断。

我的整体评价

APPROVE，结论绑定 ed8b41a21cbf1b20686efc130145f71fd06eccb6。交付判断是有实际消费者、可独立回滚的 justified increment：长期同会话续作与重放得到改善，本地续聊无需额外身份重输或确认；完整产品入口和协作结果仍明确未完成。复用验证后的 runtime context、提取 IO 和合并来源校验是合适的同域整理，增加的机制与实际权限风险相称。批准不关闭原整体验收，也不授予合并或安装权限。

English verdict: APPROVE — ed8b41a. The bounded Core/API prerequisite preserves original private Session/thread/FIFO and actual web provenance, with fresh source checks through queue commit. Independent 283 Python, 35 TS, 28 installed HTTP, immutable-base and replay/race negatives support the change. Full frontend discovery, live collaboration/adoption/return remain open; no CI or merge authority is inferred.