Release rollup

[loning]

Summary / 摘要

Release rollup:auto-refact-dev → dev,纳入 7 个已合并 commit(beta.6 周期)。

• closed_label_reconciler 单 item invariant 失败崩死 daemon → 卡死 release-gate fresh_heartbeats → beta.6 blocker #370:closed_label_reconciler 收窄回 phase-only terminal reconciliation(fix(#370): closed_label_reconciler 收窄回 phase-only terminal reconciliation,修 daemon 崩死 #375)
• tracked .claude/skills symlink 形成第二平台入口 #374:删除 tracked .claude/skills symlink,改为 ignored 本地 setup(fix(#374): 删除 tracked .claude/skills symlink 改为 ignored local setup #377)
• wakeup-plan 把 legacy .refactor-loop/host.env 当 bootstrap 必需(应问 HostEnvLocator) #372:wakeup-plan bootstrap host-env 检查下沉 LoopContext,去硬编码(fix(#372): wakeup-plan bootstrap host-env 检查下沉 LoopContext #378)
• 分支拓扑默认 auto-refact-dev/dev 内嵌通用 skill runtime(host-portability) #373:branch-topology required-env(删分支硬编码默认)(#373: branch-topology required-env(删分支硬编码默认) #381)
• post-banner 公共命令绕过 #191 active-controller 闸直接写 issue/PR 评论 #371:删公共 post-banner CLI,迁 ControllerActions.post_status_banner(+[goal] 多设备并发协作 — 多台机器同时安全跑 codex-refactor-loop(下次发版) #191 owner gate)(structural(#371): 删公共 post-banner CLI 迁 ControllerActions.post_status_banner #379)
• cleanup:删除 2 个违反 HOST_REFACTOR_COMMENT_POLICY=none 的 refactor-history 源注释
• daemon sync commit

Scope / 范围

7 commits,auto-refact-dev 领先 dev 7。各 cluster PR 已过 review-gate 共识 + CI 绿后合入 integration 分支;policy=none 违反已在 trunk 清理(上一 rollup #382 的 architect reject 已闭环)。本 rollup 是 integration→review-base 的并行人审闸。

说明

beta.6 发版前把 integration 分支批量推进到 dev。release-gate 仍需全绿(当前唯一红 fresh_heartbeats=#380 reconciler crash-loop,design-consensus 收敛中)+ host opt-in 才发版;不在红信号发版。

🤖 Auto-loop / codex-refactor-loop release-rollup

⟦AI:AUTO-LOOP⟧

[loning]

📊 当前状态 — fresh rollup review-gate r1(❌ 不需要人介入)

维度	值
PR	#383 rollup auto-refact-dev(cc59a6d)→ dev,7 commits
阶段	review-gate r1(architect/tests/quality 并行,policy=none)
内容	#370/#374/#372/#373/#379 + policy=none cleanup(取代被 reject 的 #382)
是否需要人介入	❌ 否

下一步自动会做:3 reviewer → 真值表(reject=0 → MERGE)→ ready+merge 到 dev,作为 beta.6 release-gate 的 dev 侧输入。

🤖 controller status banner

⟦AI:AUTO-LOOP⟧

[loning]

🤖 架构审查通过: 未发现 CLAUDE.md 回归

TL;DR

• 这是什么: PR Release rollup #383 release rollup 的 architect 角度独立审查。
• 结论: approve, 未发现 host SSOT、active-controller、删除优先或 comment-policy 的架构回归。
• 下一步: controller 可继续汇总其它 reviewer verdict, maintainer 无需因 architect 角度介入。

---

详细说明

我按三点 diff 审了实际改动: 把 / 设为 required host facts, 进入 owner-gated controller action, 镜像明确不提供跨设备写许可。

没有看到新增外部 repo 引用、 / / 拆分、公共 CLI、 生产事实源, 或 下的新 Old/New refactor-history source comment。

---

📎 完整 codex 原始输出(存档备查)

---
pr: 383
role: architect
verdict: approve
---

## Verdict
approve - no architecture compliance concerns; the rollup preserves host-owned runtime facts, narrows controller write surfaces, and does not introduce a parallel architecture path.

## Evidence
- `skills/codex-refactor-loop/host.env.example:3`: the template states host runtime facts are injected by `host.env`, and lines 51-55 make `INTEGRATION_BRANCH` / `REVIEW_BASE_BRANCH` required host facts. This aligns with CLAUDE.md: "事实源唯一:同一约束禁止在多处平行声明。版本号 -> `.version-bump.json`;host 运行时事实 -> `host.env`;skill 行为 -> 该 skill 的 SKILL.md 与 `scripts/test_*.py`。"
- `skills/codex-refactor-loop/scripts/codex_refactor_loop/controller_actions.py:51`: controller branch config now reads only canonical `INTEGRATION_BRANCH` / `REVIEW_BASE_BRANCH`, and lines 56-64 fail closed when missing. This avoids hardcoded host branch topology and matches CLAUDE.md: "host 项目:消费 skill 的下游项目。skill **无 host 项目改动权**:不修改 host 的 `.git` 配置 / CI 配置 / policy 文档;只在 `host.env` 暴露的 surface 上工作。"
- `skills/codex-refactor-loop/scripts/codex_refactor_loop/controller_actions.py:159`: `post_status_banner()` is a controller action gated by `_require_owner_or_raise("post-banner")` before target normalization or `gh` posting. This stays within CLAUDE.md's active-controller boundary: "跨设备时 GitHub/已 push git 面只允许一个 active-controller lease owner 执行 controller 写路径;本地 `.refactor-loop` 只是 owner 机器缓存/日志,不得授权跨设备工作。"
- `skills/codex-refactor-loop/authorizations/runtime-exceptions.md:230`: the observability writer mirror now says issue/PR target writes still require the #191 `ActiveControllerLease` / `require_active_controller(...)` gate and are not a cross-device write permit. This preserves the narrow-allowlist clause in CLAUDE.md: "任何 controller-runtime 例外必须 narrow allowlist + no lifecycle authority by default;授权来源必须 durable artifact + 仓库级文档双重锚定。"
- `skills/codex-refactor-loop/scripts/codex_refactor_loop/wakeup_plan.py:535`: bootstrap detection now checks `LoopContext.host_env` and reports a missing host-owned runtime injection file, rather than making `.refactor-loop/host.env` the production source. This respects the prompt's host production SSOT boundary and CLAUDE.md's `.refactor-loop` cache/log boundary.
- `.gitignore:18` plus `README.md:45`: the deleted tracked `.claude/skills` symlink is replaced by ignored local setup guidance, so the rollup does not add a new platform entrypoint or retained compatibility shim. This aligns with CLAUDE.md's "删除优先" clause.
- Scope honesty: PR body declares this as a release rollup of #370/#374/#372/#373/#371 plus comment-policy cleanup. The three-dot diff is confined to the declared rollup surfaces: platform-local setup, `codex-refactor-loop` controller/runtime contracts, and matching tests. I found no new external repo references, no new `*WriteActor` / `*ReadActor` / `*Store` split, no new public `post-banner` CLI, no new `.refactor-loop` production SSOT, and no new Old/New refactor-history source comments under `HOST_REFACTOR_COMMENT_POLICY=none`.

⟦AI:AUTO-LOOP⟧
REVIEW_DONE:383:architect:approve

⟦AI:AUTO-LOOP⟧

[loning]

🤖 Quality review: comment

TL;DR

• 这是什么:PR 383 的 readability / simplicity 角度独立 review。
• 结论:comment, 没有阻塞合并的问题, 但新增的 branch env 必填校验现在有 3 处重复。
• 下一步:作者可考虑抽一个 host-env/context 层的小 helper, controller 可按 advisory 处理。

---

详细说明

这轮主要看命名、死代码、过度抽象、重复、复杂度和无关改动。整体改动集中在删除 public post-banner CLI、把 banner posting 收回 ControllerActions.post_status_banner, 以及把 INTEGRATION_BRANCH / REVIEW_BASE_BRANCH 改成必填 host facts。新增 public/internal surface 都有调用或测试覆盖, 没看到死代码或明显 scope creep。

唯一建议是去掉重复的 branch-env 必填解析。controller_actions.py:51、sync/dev.py:41、sync/executor.py:88 都在做同一组字段的 strip、missing-list 和 missing required host branch env 报错。现在还不影响可读性到阻塞程度, 但这是会随 host.env surface 演化一起漂移的重复逻辑。

---

📎 完整 codex 原始输出(存档备查)

---
pr: 383
role: quality
verdict: comment
---

## Verdict
Comment: the PR is generally readable and focused, but the new required branch-env validation is duplicated across controller/sync paths and should have one owner before it drifts.

## Evidence
- `skills/codex-refactor-loop/scripts/codex_refactor_loop/controller_actions.py:51`: `INTEGRATION_BRANCH` / `REVIEW_BASE_BRANCH` are stripped, checked with a local missing-list, and reported as `missing required host branch env`.
- `skills/codex-refactor-loop/scripts/codex_refactor_loop/sync/dev.py:41`: `_required_branch_env()` repeats the same two-field strip + missing-list + error-message shape.
- `skills/codex-refactor-loop/scripts/codex_refactor_loop/sync/executor.py:88`: `_expected_branches()` repeats the same validation again, with extra host-env fallback wrapped around it. Three copies is enough that future branch-surface changes will need synchronized edits in multiple places.

## What would change your verdict (only if comment or reject)
Extract the shared "read required branch pair from merged env and return `(integration, review_base)` or a missing-list/error string" into one small helper owned by the host-env/context layer, then let `ControllerActions`, `sync.dev`, and `sync.executor` adapt that result to their local exception type.

⟦AI:AUTO-LOOP⟧
REVIEW_DONE:383:quality:comment

⟦AI:AUTO-LOOP⟧

[loning]

🤖 架构审查通过: 可读摘要修正版

TL;DR

• 这是什么: 修正上一条评论中被 shell 展开的可读摘要, verdict 不变。
• 结论: architect 角度 approve, 未发现 CLAUDE.md / AGENTS.md 架构回归。
• 下一步: controller 可继续汇总其它 reviewer verdict, 无需 maintainer 因 architect 角度介入。

---

详细说明

我按三点 diff 审了实际改动: host.env.example 把 INTEGRATION_BRANCH / REVIEW_BASE_BRANCH 设为 required host facts; ControllerActions.post_status_banner 进入 active-controller owner-gated controller action; observability-comment-writers 镜像明确不提供跨设备写许可。

未发现新增外部 repo 引用、*WriteActor / *ReadActor / *Store 拆分、公共 post-banner CLI、.refactor-loop 生产事实源, 或 HOST_REFACTOR_COMMENT_POLICY=none 下的新 Old/New refactor-history source comment。完整证据仍以折叠 raw artifact 为准。

---

📎 完整 codex 原始输出(存档备查)

---
pr: 383
role: architect
verdict: approve
---

## Verdict
approve - no architecture compliance concerns; the rollup preserves host-owned runtime facts, narrows controller write surfaces, and does not introduce a parallel architecture path.

## Evidence
- `skills/codex-refactor-loop/host.env.example:3`: the template states host runtime facts are injected by `host.env`, and lines 51-55 make `INTEGRATION_BRANCH` / `REVIEW_BASE_BRANCH` required host facts. This aligns with CLAUDE.md: "事实源唯一:同一约束禁止在多处平行声明。版本号 -> `.version-bump.json`;host 运行时事实 -> `host.env`;skill 行为 -> 该 skill 的 SKILL.md 与 `scripts/test_*.py`。"
- `skills/codex-refactor-loop/scripts/codex_refactor_loop/controller_actions.py:51`: controller branch config now reads only canonical `INTEGRATION_BRANCH` / `REVIEW_BASE_BRANCH`, and lines 56-64 fail closed when missing. This avoids hardcoded host branch topology and matches CLAUDE.md: "host 项目:消费 skill 的下游项目。skill **无 host 项目改动权**:不修改 host 的 `.git` 配置 / CI 配置 / policy 文档;只在 `host.env` 暴露的 surface 上工作。"
- `skills/codex-refactor-loop/scripts/codex_refactor_loop/controller_actions.py:159`: `post_status_banner()` is a controller action gated by `_require_owner_or_raise("post-banner")` before target normalization or `gh` posting. This stays within CLAUDE.md's active-controller boundary: "跨设备时 GitHub/已 push git 面只允许一个 active-controller lease owner 执行 controller 写路径;本地 `.refactor-loop` 只是 owner 机器缓存/日志,不得授权跨设备工作。"
- `skills/codex-refactor-loop/authorizations/runtime-exceptions.md:230`: the observability writer mirror now says issue/PR target writes still require the #191 `ActiveControllerLease` / `require_active_controller(...)` gate and are not a cross-device write permit. This preserves the narrow-allowlist clause in CLAUDE.md: "任何 controller-runtime 例外必须 narrow allowlist + no lifecycle authority by default;授权来源必须 durable artifact + 仓库级文档双重锚定。"
- `skills/codex-refactor-loop/scripts/codex_refactor_loop/wakeup_plan.py:535`: bootstrap detection now checks `LoopContext.host_env` and reports a missing host-owned runtime injection file, rather than making `.refactor-loop/host.env` the production source. This respects the prompt's host production SSOT boundary and CLAUDE.md's `.refactor-loop` cache/log boundary.
- `.gitignore:18` plus `README.md:45`: the deleted tracked `.claude/skills` symlink is replaced by ignored local setup guidance, so the rollup does not add a new platform entrypoint or retained compatibility shim. This aligns with CLAUDE.md's "删除优先" clause.
- Scope honesty: PR body declares this as a release rollup of #370/#374/#372/#373/#371 plus comment-policy cleanup. The three-dot diff is confined to the declared rollup surfaces: platform-local setup, `codex-refactor-loop` controller/runtime contracts, and matching tests. I found no new external repo references, no new `*WriteActor` / `*ReadActor` / `*Store` split, no new public `post-banner` CLI, no new `.refactor-loop` production SSOT, and no new Old/New refactor-history source comments under `HOST_REFACTOR_COMMENT_POLICY=none`.

⟦AI:AUTO-LOOP⟧
REVIEW_DONE:383:architect:approve

⟦AI:AUTO-LOOP⟧

[loning]

🤖 tests reviewer 批准 PR #383

TL;DR

• 这是什么: tests 视角独立 review，覆盖 PR Release rollup #383 的新增测试质量与缺口。
• 结论: approve，没有发现必须合并前修的测试覆盖问题。
• 下一步: controller 可把这个 verdict 纳入 review gate 汇总。

---

详细说明

我按三点 diff 检查了实际测试文件，不只看 rollup 摘要。新增逻辑对应的测试覆盖到 host branch fail-closed、banner controller action owner gate、release-commits host review base、dev-sync/executor branch env fail-closed、Claude publication boundary、wakeup host-env locator，以及相关 source-regression guard。

PR head 上运行 touched test modules 通过: Ran 292 tests in 20.663s OK。同时没有看到新增 sleep/delay pacing、skip/manual bypass、弱化断言或只凑行数的测试。

---

📎 完整 codex 原始输出(存档备查)

---
pr: 383
role: tests
verdict: approve
---

## Verdict
Test coverage and test quality are adequate for the diff.

## Evidence
- `skills/codex-refactor-loop/scripts/test_controller_actions.py:69` covers the new fail-closed host branch requirement, and `test_pr_open_helpers_do_not_use_legacy_branch_alias_values` asserts real `gh`/`git` arguments use canonical host branch values instead of legacy aliases.
- `skills/codex-refactor-loop/scripts/test_controller_actions.py:139` covers the new controller-owned banner posting path with active-controller gating, target normalization, body sentinel preservation, temp-file cleanup, non-owner no-side-effect behavior, and invalid-target blocking.
- `skills/codex-refactor-loop/scripts/test_release_commits.py:243` and `:254` cover both sides of the release-commits branch change: missing `REVIEW_BASE_BRANCH` fails closed without overwriting stale artifacts, and omitted `--target-ref` resolves through the host review base.
- `skills/codex-refactor-loop/scripts/test_sync_dev.py:567` and `test_sync_operations_executor.py:337` cover missing or blank branch env for daemon config and operation execution, including the important "before git fetch" no-side-effect assertion.
- `skills/codex-refactor-loop/scripts/test_runtime_exception_authorization_sources.py:702`, `test_source_publication_boundary.py:36`, and `test_wakeup_plan.py:605` add source-regression or behavior checks for the new no-regression rules: public `post-banner` CLI removal, `.claude/skills` publication boundary, and host-env locator bootstrap behavior.
- I found no added sleep/delay pacing, `[Skip]`/manual-test bypass, weakened assertions, or bump-only tests in the touched test diff.
- Verification run at PR head `origin/rollup/cc59a6dc11eae631850cae08c3748572acaa83c8`: `python3 -m unittest` over the 12 touched test modules passed, `Ran 292 tests in 20.663s OK`.

⟦AI:AUTO-LOOP⟧
REVIEW_DONE:383:tests:approve

⟦AI:AUTO-LOOP⟧

[loning]

📊 review-gate 共识 — MERGE_WITH_COMMENTS,合并到 dev(❌ 不需要人介入)

维度	值
PR	#383 rollup auto-refact-dev(cc59a6d)→ dev,7 commits(#370/#374/#372/#373/#379 + policy=none cleanup)
r1 真值表	architect=approve · tests=approve · quality=comment(advisory)→ reject=0 → MERGE_WITH_COMMENTS
CI	全绿(contract-tests / manifest-version-sync / skill-degradation / CodeQL / Analyze / lint-advisory)
状态	MERGEABLE / CLEAN / head=cc59a6d

Surfaced comment(quality,advisory 不阻塞):#373 引入的 required branch-env 校验在 3 处重复(controller_actions.py:51 / sync/dev.py:41 / sync/executor.py:88),建议抽到 host-env/context 层一个 helper(返回 (integration, review_base) 或 missing-list),各 caller 适配各自异常类型,避免未来 branch-surface 改动多处同步。→ 记为后续 DRY 清理候选(audit 可拾取),不阻塞本 rollup。

动作:即刻 ready + squash-merge 到 dev。

🤖 controller status banner

⟦AI:AUTO-LOOP⟧