docs(rfc): define hierarchical agent stride control

[huangruiteng]

Summary

• define effect, delivery, and authority stride as three nested feedback/control intervals
• align one governed Turn with one coherence slice and one bounded delivery slice, while preserving fine-grained causal checkpoint chains
• separate semantic stop conditions from numeric safety ceilings and scheduler cadence
• define model/work-class qualification, cross-layer mismatch metrics, and a staged experiment program
• keep the smallest implementation slice observation-only and shadow-only
• add English and Chinese semantic-mirror RFCs and register the draft

Tracks #3203.

Architectural boundary

• host agent loop and EffectProgram own inner tool/effect composition
• Turn, Todo, evidence, validation, writeback, and settlement own bounded delivery
• goal, vision, user gates, and protected-operation policy own authority changes
• replan changes delivery direction; it is not a fourth stride
• scheduler and supervisor projections remain advisory and do not acquire authority

This PR changes public architecture documentation only. It does not add a schema, capability, executor, scheduler, adaptive policy, notification change, or runtime behavior.

Validation

• python3 examples/docs-governance-smoke.py
• loopx check --scan-path docs/architecture/rfcs/README.md --scan-path docs/architecture/rfcs/hierarchical-agent-stride-control-v0.md --scan-path docs/architecture/rfcs/hierarchical-agent-stride-control-v0.zh-CN.md
  • public-boundary scan: 0 errors on the three changed files
  • two unrelated pre-existing goal projection warnings were reported by the broader registry check
• loopx canary premerge --from-git-diff --tier standard
  • gate passed
  • 14/14 selected catalog, risk-profile, and public-boundary checks passed
  • no failures, skips, warnings, or manual holds in the premerge gate
• git diff --check
• verified all relative RFC/protocol links exist
• verified both DeepSeek Harness primary-source links resolve

Public/private boundary

The RFC uses public architecture language, synthetic schema examples, and public upstream documentation only. It contains no raw trajectories, private task text, internal links, credentials, local paths, or operational state.

Review focus

1. Is the one Turn / one coherence slice / one bounded delivery slice alignment the right product-level invariant?
2. Are effect, delivery, and authority ownership boundaries sufficiently strict?
3. Is observation-only M1 small enough, and are the promotion gates strong enough to prevent premature adaptive-runtime growth?

[huangruiteng]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

详细中文评审：分层 Agent 步幅控制 RFC（PR #3204）

评审目标 head：5aabe6d13953b629004280b00ce2a41ed67deac4（base: main，1 commit，3 文件，+1393/-0；docs-only RFC，追踪 #3203）

动机与定位

这篇 RFC 把长程 agent 常见的“一个 turn 长度”泛化问题拆成三个嵌套控制区间：effect stride（下一次决策相关 observation 返回前的工作）、delivery stride（下一次有界结算前的工作）、authority stride（下一次可能改变 scope/acceptance/permission/direction 的重干预前的工作）。核心判断是长程效率来自语义边界放对位置，而不是最大化连续工作或最小化协议事件。这个定位与 LoopX 已有的 Turn/settlement/Todo/replan/effect-interpreter 词汇一致，且明确“replan 是边界迁移，不是第四种 stride”“scheduler cadence 不是 semantic cadence”，方向正确。

内容亮点

• 三层 ownership 边界严格：内层 host/effect interpreter，中层 Turn/Todo/settlement，外层 goal/vision/user gate；supervisor 只可 propose，不因观察获得 authority。
• 跨层控制律完整：语义边界优先于数字上限；内层 continuation 不能借用外层权限；外层连续性不能豁免中层 settlement。
• 测量模型务实：从现有 receipt 派生只读 observation，保留 unknown 为 unknown；mismatch signal（observation debt、settlement lag、fragmentation tax、local-completion bias、authority churn/drift、cadence coupling）都是可操作的诊断词汇。
• 实验计划分阶段（A 刻画 → B/C/D 单层变量 → factorial），避免一开始就铺三维网格；N>=5、pinned 环境、public-safe projection 的公平性要求到位。
• 最小实现切片收敛：M1 只做只读 observation + offline evaluator + shadow recommendation，M5 才 opt-in 实验；非目标明确不建第二 execution engine、不给 scheduler/supervisor/model confidence 授权、不引入 concurrency/CAS、不训练泛化 RL controller。
• EN/ZH 语义镜像完整，RFC 索引同步注册。

与主干一致性 / 验证

• 仅改 docs/architecture/rfcs/ 下 3 个文件，未触碰 README/site hero → 不触发 First-Screen Review Gate。
• 无运行时、schema、capability、权限或通知行为变化。
• 作者验证：docs-governance-smoke、canary 14/14、public-boundary 0 errors、git diff --check 通过；我抽查两个 DeepSeek Harness 外链均返回 200。
• 与已合入的 #3195（durable completion projection）、#3199（settlement driver）语义无冲突；RFC 明确保留 settlement order、effect identity 与 replay 边界。

非阻塞问题（P2）

1. “one governed Turn = one bounded delivery slice = one coherence slice”是一个强产品不变量，与 fine-grained 链式 checkpoint 存在表面张力（§3.3/§5.2 已解释）。建议 M0/M1 用真实剖面数据检验该对齐，而不是默认成立后再推广。
2. EN/ZH mirror 目前依赖人工声明；建议在 M0 增加机械化的 parity smoke（章节标题、术语、计数一致性），防止后续维护漂移。
3. 727（EN）+664（ZH）行偏长；§8.1 的合成 schema 示例已正确 defer，落地时请按 §11 压缩为最小只读观察，不要一次性实现全部指标。
4. authority_snapshot_id 等概念尚无现存状态载体；M1 应对 known/unknown 字段边界 fail-closed，避免从 prose 或 command name 推断缺失的 host 指标。

我的整体评价

概念成熟、边界严格、与仓库既有控制面语义一致，且把实现收敛到只读 shadow 切片，符合 scope-fit 与 measurement-first 要求。无需变更即可作为 draft RFC 合入。结论：APPROVE。

---

English Verdict (PR #3204)

• Exact head reviewed: 5aabe6d13953b629004280b00ce2a41ed67deac4
• Verdict: APPROVE (author-owned PR; GitHub blocks formal self-approval, recorded as COMMENTED)
• Key findings: A docs-only RFC (3 files, +1393/-0) that replaces the vague "turn length" knob with three nested control intervals — effect, delivery, and authority stride — with strict ownership boundaries, cross-layer control laws, a measurement-first read-only M1 slice, and staged opt-in experiments. It changes no runtime, schema, capability, permission, or notification behavior, does not trigger the first-screen review gate, and the EN/ZH mirrors plus the RFC index are consistent; both cited DeepSeek Harness links resolve.
• Non-blocking P2 notes: validate the one-Turn/one-delivery-slice/one-coherence-slice alignment empirically at M0/M1, add a mechanical EN/ZH parity smoke, keep the M1 implementation minimal, and define fail-closed known/unknown boundaries for fields such as authority_snapshot_id.