[shangzh0]

Goal And Delivered Outcome

The delegated Host supervisor currently renews and reads back a healthy lease at every proof check, capped at 30 seconds, even when its TTL is 45 minutes. This generates avoidable CAS writes and CLI invocations throughout long operations.

Keep the existing min(30 seconds, remaining/2) proof cadence, but renew only in the latter half of the requested TTL. Read current execution authority on every check. Renewal still needs an advanced version; original owner/key/epoch, exact-intent lost-reply retry, final proof, cancellation and the last proved deadline remain enforced. The requested TTL and lease lifecycle owners are unchanged.

Author Declaration

Written by: model_agent — Codex, OpenAI GPT-6 family.

Implemented against

Specification: the bounded cost repair requested in this PR; existing supervision behavior in loopx/control_plane/turn_driver/leased_host_process.ts and docs/reference/local-delegation.md at 04c5799b88f6c4cf12a224b7fa679f272e1e794e.

Criterion	Disposition	Owner	Validation
Avoid healthy long-TTL writes at each proof	implemented	runLeasedHostProcess	Real File/SQLite 45-minute leases over a 33-second child: no renewal, unchanged version
Preserve revocation and exact execution identity	implemented	Existing currentProof and expiry supervision	Real release during the child run cancels at the existing proof cadence
Preserve short-TTL recovery/failure handling	implemented	Existing renewal and host owners	Rejected, hung, lost and late renewal replies; cleanup and initial/final proof tests

Scope And Continuation

Complete for redundant writes in the delegated Host supervisor. This is not a change to all Todo/benchmark lease callers, nor a removal of proof reads. Thirty-second short-lease fixtures keep their existing renewal behavior. No provider algorithm, permission, CAS, epoch, fencing, TTL default or stop authority changes. No score or whole-experiment cost gain is established.

Validation

Tested revision: 754f692. State: finished. Inputs: synthetic.

Check	Result	Evidence / limitation
Regression sensitivity	passed	New long-TTL File case fails on the base because the trace contains a renewal
Real backend / processes	passed	tests/control_plane/test_leased_host_process.py: 20 tests on isolated File/SQLite, including four long-TTL success/revocation cases
Packaging / real entrypoint	passed	Clean wheel; isolated installed Host bridge launch with initial/final execution proof
Static	passed	Typecheck, Ruff, semantic advisory, public boundary and bilingual reference review
Canary	passed: 5 direct, 15 selected checks	Existing standard premerge scope selection

PostgreSQL and Windows were not exercised; no provider store implementation was modified. The healthy 33-second regression removes one renewal invocation/write while retaining initial, periodic and final reads; it is not an 18-hour throughput measurement.

Frontend / Visual Evidence

UI impact: none. These changes use existing internal CLI/runtime projections and introduce no screen, setting or capability. Source data: synthetic. Screenshots: N/A.

Type of Change / LoopX Area

Control plane and host integration; focused bug/performance fix with regression tests. No benchmark adapter, scoring, task prompt, budget or submission-policy changes.

Boundary Checklist

• Public-safe synthetic fixtures only; no credentials, private state, trajectories, verifier output or machine paths.
• Scope checked against current main and related proposals; no unrelated benchmark work.
• Dedicated worktree and codex branch; explicit staging and DCO sign-off.
• No paired RFC changes; bilingual reference changes included where applicable.
• UI impact is none; no merge or experiment launch is requested.

Shared-authority RFC fixture impact: N/A; no storage provider, routing or authority schema is changed.

[songoow]

Reviewer: model_agent · GPT-6 family · OpenAI · self_reported

动机 / Motivation

受影响的是运行带任务租约的委派 Host 的调用者：长任务执行期间，监督器需要持续确认原执行仍有权限。 租约是一份有截止时间的执行资格；确认它仍有效，并不意味着每次都需要延长它。以 45 分钟租约下运行 33 秒的子进程为例，基线会在约 30 秒时额外续租一次；本次 head 保留初始、周期和最终三次证明读取，但不续租，租约版本保持不变。

同一真实 File 后端对照已经复现基线续租 1 次、版本 2→3，head 续租 0 次、版本 2→2，且原执行的 epoch/key 不变。 这消除了已真实观察到的一次额外 CLI 启动和续租写入，修复目标足够具体。本评审不把这一局部调用削减推算为整项工作耗时或模型 token 改善，也不将其扩展为所有 Todo 或 benchmark 租约调用的优化。

改动思路 / Approach

生产入口仍是 Delegations._execute 经 _cli 把原 delegated_lease 交给 host_process_bridge；只有带租约的请求进入本次修改的 runLeasedHostProcess。续租时机属于既有 TypeScript Host 生命周期 owner；权限判断和 CAS 继续由 canonical lease/claim owners 承担，复用现有闭环比新增 Python 调度器或放宽证明间隔更小。 本 PR 只减少委派 Host 对健康长租约的冗余续租，不改变 TTL 默认值、读取频率、执行授权或 provider 协议。

我重点检查了一个反例：如果减少续租同时减少权限检查，被释放的长租约可能继续运行。head 的 read_argv 和 currentProof 位于 if (renew) 之外，仍按 min(30s, remaining/2) 检查。生产 read_argv 实际重放原 todo claim，其 current proof 重新检查 owner、key、epoch、Todo eligibility、dependency、acceptance 和冻结的 repository/worktree；不是只信任旧 receipt 或一个尚未到期的时间戳。放宽检查间隔或新增缓存 owner 都会扩大变更，这个 PR 没有这样做。

相同真实 File 场景	base 04c5799b	head 754f6921
2700 秒租约、33 秒 child 的续租次数	1	0
初始、周期、最终 proof read 总数	3	3
版本变化	2→3	2→2
原 execution 的 epoch/key	保留	保留

该表是独立执行同一测试函数的观察；未用耗时或临时路径差异掩盖行为差异。base 触发 no-renew oracle 失败，head 通过。

具体改动 / Changes

本评审依据修改前的 docs/reference/local-delegation.md，规范固定 revision 为 04c5799b88f6c4cf12a224b7fa679f272e1e794e。该文档没有原生条款编号，下面标签仅用于本次定位：LD-current-proof（当前执行读回）、LD-renewal-cleanup（原续租/嵌套进程清理边界）、LD-no-new-authority（不新增授予或预检权限）均在此 head 实现并保留。前两项由真实 lease/Host 测试与 canonical proof 调用链支撑；第三项由 base/head bridge、delegation caller 和三文件 diff 核对支撑。新增文档解释阈值，不作为反向证明实现的独立规范。

关键代码讲解

1. runLeasedHostProcess / schedule：把原无条件续租改为 remaining <= ttl_seconds * 500。ttl_seconds 已标准化为 1..86400 秒，乘 500 对应半租期毫秒；30 秒短租约仍会在 remaining/2 处进入原续租分支。真正续租后才要求 version 前进，健康只读周期允许 version 保持不变。
2. currentProof 及 initial/final proof：同一 execution 的较新 version 可被当前读回采纳，但 owner/key/epoch 变化和 version 回退仍被拒绝。最后已证明的 expiry timer 在等待 pending renewal 和 final proof 时保持生效；丢失回复仍只重试原 argv，不根据冲突随意换 expected-version 或 execution key。
3. test_long_ttl_checks_authority_without_rewriting_lease：48 行新增测试复用真实 File/SQLite fixture，覆盖正常与 release 四种组合，检查没有 renew、proof read 次数、版本和 epoch/key，以及撤销后取消。其余 rejected/hung/lost_reply/late_reply、管道中断、初始证明和 Host 返回时的最终证明测试保留。文档新增 8 行英中说明；生产净增 7 行，无新协议、CLI 参数或持久字段。

对主干的风险 / Risks

未发现需要阻断的代码缺陷。 最重要的风险是长租约只读周期漏掉撤销，以及续租回复丢失后错误延长执行资格。新增 revoke 测试直接覆盖前者，既有短 TTL fault/cleanup/final-proof 测试覆盖后者；测试没有通过降低断言或延长期限来获得结果。生产调用明确存在于 _execute → _cli → bridge，不是一个只在测试中使用的 helper。修改量和可重复的一次冗余写入相称，当前没有必须拆分、迁移或另造抽象的理由。

验证状态：PASS — tests/control_plane/test_leased_host_process.py：20 项测试，0 failure/error，0 skipped，JUnit 计时 507.95 秒。 PASS — 相同 File fixture 的 base/head 对照、Node TypeScript syntax check、直接两端 git diff --check，以及三文件 public-boundary 检查。此前两轮本地环境阻断已保留：第一轮本机 socket 被 sandbox 拒绝；第二轮临时 cwd 找不到尚未安装的 LoopX。恢复本机测试权限并为本次进程固定源码路径后，子进程导入同一 head；没有改动产品代码、fixture 或测试断言。

语义与 CI 对齐

语义判断为 reuse_existing / aligned：没有新增 Enum、Literal、as const 或协议词汇，局部 renew 是已证明 lease 与请求 TTL 的数值派生；不满足 CONTRIBUTING 中新增词汇 advisory 的触发条件，未宣称全树语义扫描或完整类型检查通过。普通无 lease 的 Host 分支未变；本 PR 没有 default-off 声明，正常 delegated lease 路径的默认续租时机变化已在双语文档披露。现有 failure 名称没有扩大权限含义，也没有把强制 proof 描述为可忽略的模型建议。发布前已重新读取 GitHub：head 仍为 754f6921260c9be3edc2e553008b13e37e5cc0dd，当前已完成的检查未发现失败，仍有部分 pending；pending 不等于通过，合并就绪仍需单独判断。

本次独立执行覆盖真实 File/SQLite 与 POSIX 进程；未独立运行 PostgreSQL、Windows、完整仓库类型检查或完整远端 CI。长 TTL 新测试只覆盖第一轮健康证明，短 TTL 故障测试覆盖续租分支；未单独执行一个跨越 22.5 分钟阈值的长租约测试。这些是明确边界，当前未据此确认产品缺陷。

我的整体评价 / Verdict

对这项有边界的重复续租修复，判断为 goal_achieved、proportionate。长期执行的有效权限、恢复和取消语义判断为 preserved，正常调用者体验也为 preserved：无需新的配置、确认或资料重输；减少的写入已实测，整项任务效果尚未由本 PR 证明。已检查 leased_host_process.ts、测试和 local-delegation.md；没有新增或修改渲染界面、表单、提示词或用户操作流程。 无受影响的渲染页面；不宣称进行了浏览器视觉验证。

observable semantics 是已说明并验证的局部 intentional change，原格式和兼容分支不变。没有新增兼容债务或第二 authority owner；保留此局部条件比额外 helper/framework 更合适。续租时机属于既有 TypeScript Host 生命周期 owner；权限判断和 CAS 继续由 canonical lease/claim owners 承担，复用现有闭环比新增 Python 调度器或放宽证明间隔更小。 本 PR 只减少委派 Host 对健康长租约的冗余续租，不改变 TTL 默认值、读取频率、执行授权或 provider 协议。 对 exact head 754f6921260c9be3edc2e553008b13e37e5cc0dd 的建议为 APPROVE，不代表合并授权或所有远端 CI 已完成；若 head、caller 或 TTL/权限契约改变，需重新评审。

English verdict: APPROVE — head 754f6921260c9be3edc2e553008b13e37e5cc0dd; no blocking code finding; identical real-backend base/head regression verified, all 20 File/SQLite lifecycle tests passed; PostgreSQL, Windows and whole-task gains are outside the independently verified evidence.