Integrate KunlunCode native Goal Pro with LoopX

[yixuanchen189756-source]

Summary

• make LoopX an external controller for KunlunCode's native Goal and Goal Pro lifecycle through the 2026-07-27 app-server protocol
• start or resume one KunlunCode thread, set the native goal with strict verification, start the turn, and reconcile verified completion into LoopX todo, quota, and delivery evidence
• block model-visible MCP and direct same-goal LoopX lifecycle writes while the outer controller owns the run, so the worker cannot mark the task complete before the native verifier passes
• add recoverable runtime journaling, independent kunlun agent identity, uv-managed provisioning, a real protocol smoke, and complete Chinese Markdown and HTML operator guides

Why

KunlunCode /goal and /goal-pro are interactive host commands; a model cannot reliably select those commands for itself. The earlier adapter exposed LoopX lifecycle tools to a bounded worker but did not programmatically activate KunlunCode's native long-running goal mode. This change moves activation to the LoopX controller by calling thread/goal/set and turn/start directly through app-server.

Execution model

1. LoopX evaluates should_run and claims the agent-scoped todo.
2. The controller starts or resumes the recorded KunlunCode thread.
3. It sets a native Goal Pro goal in strict mode and starts the turn.
4. KunlunCode performs native continuation and independent verification.
5. Only a terminal complete goal with verification_passed may be written back to LoopX.
6. Interrupted writeback resumes from a compact, credential-free journal without creating a duplicate goal.

User impact and authority boundary

Users invoke loopx-kunluncode run --mode goal-pro; neither the user nor the model needs to type /goal-pro. Activation grants no additional repository, publishing, destructive, credential, production, or external-service authority. Raw model output, trajectories, credentials, absolute paths, and verifier tails are excluded from the durable runtime journal and public evidence.

The adapter uses a project .venv managed with uv. It can be disabled per invocation, disconnected from a project, or uninstalled using the documented commands without mutating unrelated KunlunCode configuration.

Documentation

• docs/guides/kunluncode-adapter.zh-CN.md
• docs/guides/kunluncode-adapter.zh-CN.html
• loopx/kunluncode_goal_mode/README.md

The public first screen was previewed and approved before publication.

Validation

• full suite: 2037 passed, 2 skipped
• post-merge focused host and KunlunCode suite: 92 passed
• changed-path Ruff and Python compile: passed
• real installed KunlunCode app-server Goal Pro smoke: strict terminal completion, independent verification_passed, and same-thread resume passed
• documentation validator: 13 sections, 14 ids, and 15 internal links passed; docs-governance smoke passed
• loopx canary premerge --from-git-diff --tier standard: 18/18 checks passed, 0 failures, 0 warnings, 0 advisory failures, 0 manual holds
• public/private boundary scan: all 29 PR paths passed

Review notes

Changed surfaces are the KunlunCode app-server client, outer controller, control-plane writeback seam, MCP/direct-CLI write guards, host activation/help projection, focused tests, durable protocol smoke, and public operator documentation. The latest origin/main is merged into the branch. This changes runtime behavior and intentionally remains a draft for maintainer review; no self-merge is proposed.

[yixuanchen189756-source]

Premerge validation receipt

• Changed surfaces: shared goal-mode context/MCP seam; Claude Code compatibility entrypoint; dedicated KunlunCode binding, uv installer, MCP server, and bounded runner; scheduler runtime profile; host activation/help; focused lifecycle tests and public usage documentation.
• Full tests: python -m pytest -q — 1984 passed, 2 skipped. The skips are existing suite-controlled skips; no KunlunCode test was skipped.
• Focused regression: 211 scheduler/host/KunlunCode tests passed; Claude lifecycle plus install opt-in/no-system-mutation smokes passed.
• Static validation: Ruff passed for every changed Python path; git diff --check origin/main...HEAD passed.
• Risk gate: loopx canary premerge --from-git-diff --tier standard selected and executed 18/18 checks across control-plane routing, quota/scheduler, canary runner, CLI modularization, and changed-file public-boundary scanning. Failures: 0. Warnings: 0. Advisory failures: 0. Manual holds: 0.
• Real host validation: kunluncode mcp test loopx-kunluncode connected and exposed all four lifecycle tools. A real bounded worker completed should_run -> claim_task -> focused LoopX check -> complete_task(no_follow_up) -> should_run=false as the registered kunlun agent.
• Public/private boundary: the scan covered all 19 changed paths; local .loopx/, uv environment, MCP registration, run history, raw output, credentials, and proxy settings are excluded from the diff.

This coverage is sufficient because it combines the complete Python suite, host identity/runtime contract tests, existing Claude compatibility smokes, risk-selected control-plane checks, direct public-boundary scanning, and an actual KunlunCode MCP lifecycle. This is a runtime change and remains a draft for maintainer review; no self-merge is proposed.

[yixuanchen189756-source]

Updated pre-merge validation receipt (supersedes the earlier bounded-worker receipt)

• Changed surfaces: KunlunCode app-server protocol client; native Goal/Goal Pro outer controller; recovery journal and LoopX writeback reconciliation; model-visible MCP and same-goal CLI lifecycle guards; host activation/help projection; focused tests; real protocol smoke; Markdown/HTML operator documentation.
• Full suite: PYTHONDONTWRITEBYTECODE=1 .venv/bin/python -m pytest -q — 2037 passed, 2 skipped in 277.38 seconds. The two skips are suite-controlled existing skips; no KunlunCode test was skipped.
• Post-merge focused regression: tests/test_host_loop_activation.py plus tests/test_kunluncode_goal_mode.py — 92 passed. This includes the latest mainline TraeX visible-goal coverage and the KunlunCode native controller coverage after resolving their test-file merge conflict by retaining both sets.
• Static validation: changed-path Ruff passed; Python compilation passed; committed, staged, and unstaged diff checks passed.
• Real host validation: the installed KunlunCode app-server completed one strict native Goal Pro goal, emitted verification_passed, resumed the same goal/thread, and recorded none of raw output, raw trajectory, credentials, or absolute paths.
• Documentation validation: Markdown/HTML parity validator passed with 13 sections, 14 ids, and 15 internal links; docs-governance smoke passed. The public HTML first screen was previewed and owner-approved before commit.
• Risk gate: loopx canary premerge --from-git-diff --goal-id kunluncode-adapter-validation --tier standard selected and executed 18/18 checks across control-plane, documentation, Python, and public-boundary profiles. Failures: 0. Warnings: 0. Advisory failures: 0. Manual holds: 0.
• Public/private boundary: all 29 PR paths passed. No local state, generated uv lock, raw logs, trajectories, verifier tails, credentials, proxy configuration, or local absolute paths are included.

This coverage is sufficient because it combines the complete repository suite, post-mainline-merge host/controller regressions, a real installed native Goal Pro protocol run with recovery and verifier proof, changed-path static checks, risk-selected canaries, documentation structure validation, and direct public/private boundary enforcement. This is a runtime change and remains a draft for maintainer review; no self-merge is proposed.