[loopx-agent]

Goal And Delivered Outcome

App-to-Lark reaction feedback reloaded the canonical Turn for every retained answer chunk before discarding those chunks. Long answers therefore added repeated file reads to a background scan that only reacts to user inputs.

The feedback callers now select canonical user inputs before loading Turns. They reuse the existing source, session, binding and authorization checks on every pass, including checks around provider IO. Full body delivery and return verification keep the default complete projection.

• Outcome basis: remove demonstrated redundant provider IO while preserving the current private-conversation contract. Base: main.
• Observable result: the new real-store regression has one App input and 48 answer chunks. The immutable base performs 49 canonical Turn reads; this change performs one, with no new provider message, model execution or transcript mutation.

Author Declaration

• Written by: model_agent — OpenAI GPT-6 (Codex).
• Specification and revision: no written specification for the private optimization; the request above is the basis. Placement and validation follow AGENTS.md and docs/development/testing-and-quality.md at 71970fb03eb2ab90b353f0895bb1463ca7eaf236.

Criterion	Disposition	Symbol / path	Evidence
Reuse current source/authority checks	implemented	_web_projection_messages, _web_projection_feedback	App identity, revocation and provider-IO negative cases
Feedback work follows inputs rather than answer chunks	implemented	reconcile_app_feedback	New real-store resource regression; fails on immutable base
Preserve complete answers and result verification	implemented	Default projection, body outbox, verify_web_return	Complete long-return, deduplication and source-recovery cases
Keep shared decisions in the existing typed owner	implemented	Existing Python Lark provider only	No shared schema, state, API, policy or configuration added

Scope And Continuation

This is a complete provider-IO optimization proposal. Python is retained at the stable Lark transport boundary; common orchestration and decisions are unchanged. A private keyword argument avoids a second projection implementation or cache.

The existing progress test now waits for the canonical host-start event before asserting its presentation. Its old queue-claim wait preceded that event and failed identically with the immutable base provider. The assertion and deadline are retained.

The broader native conversation latency work remains open with its existing owner. Installed-service responsiveness, foreground p95 and live Lark adoption are not qualified by this proposal. Review and normal integration are still required; no installation or merge is included.

Validation

• Tested revision: b99cc7c3ab263d054f891cbf157e044cdd584f09 (same final source content for checks run before commit).
• Run state: finished.
• Input classes: synthetic.

Check kind	Result	Public-safe evidence / limitation
integration	passed	57 passed, 331 deselected in 229.29 s. pytest -q tests/test_lark_private_feedback.py tests/test_lark_private_conversations.py -k 'app_ or web_ or opt_out_or_missing_reaction_permission or default_feedback_tracks or early_receipt_requires_exact_durable_admission_and_current_grant'.
regression_parity	passed	New resource test: base fails with 48 unnecessary additional Turn reads; candidate passes. Canonical input, body journal and execution-request capture remain unchanged.
regression_parity	passed	Corrected host-start oracle and complete long-return case both pass separately with immutable base and candidate. The first larger run had two failures; these observations are retained, and the final rerun is reported above.
real_backend	passed	Isolated real File ChatStore and native HTTP input admission with a synthetic Lark provider. No live chat or paid model used.
static	passed	Ruff for both changed files, Git diff check and bilingual RFC diff check. Configured mypy passes 17 files; the Lark extension is outside that configuration.
integration	passed	npm run build:chat (TypeScript check, Vite build and bundled frontend validation). No frontend source changed. Existing large-chunk advisory remains.
manual	passed	Owned archive: 972 Turns, 2,464 retained messages, 2,368 App projection messages, 924 user inputs. Four unprofiled samples per arm: median Python CPU per feedback pass about 410 ms → 221 ms. Complete body projection stayed identical, with zero message/reaction writes or model execution.
manual	not_run	Installed native service, live Lark and foreground latency/p95. The aggregate experiment predates the fast-forward from 92294e7 to 71970fb; the baseline provider file is identical at both revisions. Its private runner is not a public reproducibility artifact; the committed resource test is the reviewable oracle.
static	passed	Exact-scope change-quality receipt cqr_f8584c29996ef15d9147 verified against the stated base and head; one safe-fix pass, no unresolved blockers or emitted risks. Quick premerge: six direct checks and both selected catalog smokes passed, with zero failures or warnings. Earlier preview warning was not used as a waiver. Independent review and CI remain pending.

Coverage: relevant queue, current-source identity, feedback opt-out/permission denial, post-IO revocation, failed/interrupted/completed turns, original-recipient delivery, long answers and idempotent recovery. The scoped optimization does not claim the native foreground delay is fixed.

Frontend / Visual Evidence

• UI impact: none. No layout, copy, navigation or visible state changed.
• Before / after / first viewport / preview / viewport review: N/A.
• Source data: none. Synthetic fixture data is used only in tests; no captures or raw archives are published.

Type of Change

• Bug fix / performance
• Test update

LoopX Area

• Capability or extension (Lark provider)

Shared-authority RFC fixture impact

N/A: no migration, authority provider, runtime routing or compatibility projection changed.

Boundary Checklist

• The diff and description contain no credentials, private state, raw traces, internal links or local machine paths.
• No benchmark execution, maintainer benchmark work or experiment promotion is included.
• The change is scoped to the reproduced provider-IO gap.
• No paired RFC changed; bilingual diff check passed.
• UI impact is none.
• The commit carries a DCO Signed-off-by trailer.

[loopx-agent]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

Reviewer: model_agent | gpt-6.1-sol | OpenAI | runtime_reported | reasoning_effort=max

APPROVE：未发现阻塞问题。 Reviewed head: b99cc7c3ab263d054f891cbf157e044cdd584f09；PR merge-base: 71970fb03eb2ab90b353f0895bb1463ca7eaf236。

动机 / Motivation

在 App 输入消息、并通过原 Lark 私聊查看反馈的用户，以及运行这条后台反馈扫描的本机服务。

同一条 App 输入留下 48 个回答片段时，旧反馈扫描先读取 49 次 canonical Turn（原生轮次记录），随后又丢弃回答片段；新路径只验证那个需要 reaction 的用户输入。

独立真实 Store/HTTP 对照复现 base 多出 48 次读取，head 保留 1 次；消息正文、执行请求与 provider 写入保持不变，完整长回答仍由独立正文 outbox 投递。

本次只交付 provider IO 去重；不改变 reaction 启用、Core 准入、执行权限或正文完整性，也不把它认定为已安装服务或前台 p95 的改善。

更广的原生会话延迟、实际安装服务和 live Lark 采用仍由既有产品/运行负责人分别验收。

改动思路 / Approach

在稳定 Lark provider 的既有 projector 中提前筛选用户角色，复用同一套 source、Session 和 grant 验证，比复制一个反馈 projector 或新增跨扫描缓存更小且保留单一权限 owner。

本 PR 完成反馈读取的局部优化和相应回归；Core 决策、正文投递、源授权及默认完整 projection 不迁移，不新增后台任务或持久状态。

关键区分是“反馈只作用于用户输入”与“正文仍包含所有回答”。inputs_only=True 仅供反馈发现及 effect 前后的 membership 复查使用；消息投递和 result return 的原调用没有传这个参数，继续得到完整 projection。source、Session、受众、binding 和 grant 的检查仍发生在过滤前，真正 reaction 写入前后还会再读 canonical input/Turn。没有用缓存快照代替当前权限，也没有新增模型调用或第二个调度器。

具体改动 / Changes

完整 diff 为 2 文件 +58/-5：provider 10 行新增、5 行替换，测试 48 行新增。独立依据是 accepted docs/architecture/rfcs/app-conversation-and-async-inbox-v0.md，spec_revision 71970fb03eb2ab90b353f0895bb1463ca7eaf236。映射条款 user-mirrors-only、fresh-authority、complete-body 均 implemented：assistant 不接收 reaction，每次效果保留新鲜来源与授权复查，完整长正文和原始幂等 attempt 不因反馈优化丢失。这也补足了作者“无书面规范”声明之外已有的源实现约束。

关键代码讲解

• _web_projection_messages（1379）新增 private keyword，默认 false。feedback 为 true 时在 load_turn 之前略过 agent 消息；原 source/Session/受众校验及用户输入自己的 Turn 校验保留。
• _web_projection_feedback（1472）的三次 membership 检查统一用输入 projection。authorized() 仍在 provider receipt IO 前后分别检查来源、冻结正文和当前 Turn 状态，未把“曾验证”当成当前权限。
• reconcile_app_feedback（1575）只枚举实际 reaction 对象；关闭反馈仍直接返回。与正文并发时，原 outbox 的非 feedback 字段仍先冻结比较，最后只合入反馈字段。完整 _reconcile_web_projection 和 verify_web_return 调用保持默认完整读路。

测试中原 queue-claim 等待还补上真实 turn/started 事件，才断言“已开始处理”；原断言与 10 秒等待上限没有删除。相同修正后的反馈控制与完整长正文测试在 base/head 都通过，因此没有把原 race condition 当成本优化收益。

对主干的风险 / Risks

最强反例是提前过滤意外绕过权限复查，或让共享正文 caller 丢掉回答。我执行了真实 File ChatStore/Core HTTP 与合成 Lark provider 的相关 57 例，全部 PASS、无 skip；包含 source/input/Turn 替换、post-IO revocation、反馈关闭/权限不足、失败/中断/完成、恢复、幂等长正文及慢 reaction 不阻塞正文。它们验证实际效果边界，不只有一个读次数断言。

同一份三例 fixture 的独立 base/head 对照：base 仅资源用例 FAIL，明确多出 48 次 Turn 读取，另外两例 PASS；head 三例全部 PASS。该重复对照不计为额外 57 个独立用例。Ruff 两路径、配置范围 mypy 17 文件、语法/双语/diff 检查及 quick premerge 的 6 direct + 2 selected 检查通过；Lark extension 不在该 mypy 配置内，未冒称它已被静态全覆盖。整体预合并门仍因 exact-scope quality receipt stale 而 HOLD，未予豁免。未查询或等待 CI。

另外将完全相同的两文件 patch 与已核实 main 03d6ab2864a54e86ab4f97854854d0e4acd7dd48 组成临时 local-only、未提交源码，运行输入读取、source/Turn 在 IO 中变化、revocation、长正文和慢反馈并发的 11 例，全部 PASS。它们属于另一个源码组合，不计为额外的 57 例或当前 head 的提交；检查后已恢复干净原评审 head。没有安装、live Lark 操作、付费模型或正式实验。

我的整体评价 / Verdict

这是比例适当、可以单独交付的 provider IO 改进：不新增状态或 authority，保留既有完整投递与恢复 owner；不需要把十来行局部读取优化扩成架构重写。long_horizon 改善仅以重复扫描的冗余读取减少为证，user_experience 的原反馈与正文语义保持，没有额外设置或用户确认轮次。

没有 rendered UI、copy、导航或 reaction 含义的变更，完整两文件 diff 与消息输出断言使 visual review 不适用。未验证安装 App、live provider 呈现和前台 p95；更广慢读验收保持开放。可批准此精确 head 的代码；严格质量回执、GitHub reviewDecision 和受保护合并权限是另外的门禁，批准不等于已清除或执行合并。

English verdict: APPROVE on b99cc7c; the input-only feedback read path preserves fresh authority checks and complete body delivery, with live-service latency still unqualified.