[hhyykk]

Goal And Delivered Outcome

Move the peer-directory decision owner into one TypeScript projection while retaining the public agent-directory command and Python compatibility signature.

• One agent.directory.project request owns membership, work fields, route publication caps, counts, cursor, limitations and page-local rollup, and seals the projection envelope in the same TypeScript process.
• Python retains fact collection, public-output safety and transport compatibility, without a semantic fallback.
• Membership uses the full registered set rather than the displayed page. Historical unregistered claimants remain diagnostic rows.
• The envelope preserves upstream source provenance and unknown/incomplete evidence rather than treating directory assembly time as source freshness.

Intended base: main at faab5f5c291c5359216a0f944fe63fcfbaacdedc, rechecked before publication.

Author Declaration

Written by: model_agent, OpenAI Codex.

Implemented against

Specification: docs/architecture/rfcs/typescript-control-plane-migration-v0.md and docs/reference/protocols/peer-agent-directory-and-observation-v0.md at the base revision, with the bounded migration and source-evidence contract documented in this change's bilingual ledger.

Criterion	Disposition	Implementation / evidence
One typed directory decision owner	implemented	loopx/control_plane/agents/directory.ts; Python fact adapter
Complete registry membership and legacy public-field parity	implemented	independent differential cases, mutations and real CLI parity
Inherited projection-envelope source evidence	implemented	direct envelope sealing and source-evidence regressions
Whole-CLI cost qualification	implemented	120 paired real CLI runs; measured added RPC and output cost, no speedup claim

Scope And Continuation

This is a bounded, reversible projection migration. It does not change claims, leases, persistence or provider defaults, create a presence provider, or grant execution authority. Management state and route interpretation retain their existing owners.

The Python adapter can be retired when production callers and fact providers can call the native owner directly. Broader TypeScript migration and release qualification remain open. The measured transport/output cost and remaining CI/DCO gates are disclosed below. This draft is not merge-ready.

Validation

Tested candidate: 9d91c5bc178a0acddbbab3276b404b9d0ceada3f.
Initial published code commit: a81fc32ee62537a5861693248671f069366f810e, with identical complete Git tree 330c5cd638c0adc2d615cea794cee90e41ce7436 to the tested candidate.
Current head: 983caa3230d097ff54623b511e525835769688cf, which adds only the two bilingual qualification-ledger updates. Its complete Git tree 4b32cc1cfa8dbceb80a2615b61af3a3845a46472 matches local documentation candidate ee778490c42866e74a1694add7886a0b77131e3b. Product code is unchanged.

Run state: finished for the local checks below; remote CI remains pending.
Input classes: synthetic.

Check kind	Result	Public-safe evidence / limitation
unit	passed	33 Python tests
regression_parity	passed	160 independent differential cases and two mutation checks
real_entrypoint / regression_parity	passed	Eight real CLI parity cases
integration / real_entrypoint	passed	Wheel and sdist: 16 installed-command cases
static	passed	Strict TypeScript typecheck
unit	passed	Full TypeScript suite: 6,129 passed, 77 skipped; skips are not passes
integration	passed	Premerge exited 0, retaining the inherited maintainability advisory
real_entrypoint	passed	120 paired CLI performance runs completed; measurements and prior failed attempt below
manual	blocked	No DCO sign-off was added; repository Sign-off requirement remains unsatisfied

Matched whole-CLI performance

120 paired CLI runs passed in a fresh isolated full rerun. Values below are baseline → candidate, in milliseconds.

Backend / runtime	p50	p95
File warm	348.85 → 348.14	397.95 → 380.69
File cold	949.17 → 950.08	986.70 → 1026.45
SQLite warm	342.77 → 338.94	396.21 → 373.52
SQLite cold	947.77 → 953.57	1020.42 → 1078.73

Runtime requests increased from 5 to 6 and stdout from 9,330 to 11,384 bytes. Cold p95 increased on both backends; these observations do not establish a speedup. The earlier attempt had a stale-runtime transport failure; that failed attempt is preserved, and the fresh isolated full rerun completed without failures.

Remote CI has not yet qualified this published revision. The above targeted and suite results do not establish whole-Goal outcomes, performance improvement or release readiness.

Remote CI findings on current head

CI is still running. The real-server PostgreSQL authority job, kernel static checks, kernel contracts, both stage2c e2e jobs and both build jobs have passed. Remaining queued/running jobs are not counted as passes.

• Sign-off fails because both contribution commits lack DCO certification; no certification has been added.
• Windows job: three test_doctor_fix_preserves_installation_owner variants fail with KeyError: 'installer'. The same failures occur on main ancestor 817dd246 in baseline job; the doctor/test files are unchanged from that ancestor through the implementation base and candidate.
• ZCode browser job: zcode-persistent-browser-smoke.mjs:59 times out on a disabled Start button after authority_or_quota_unavailable. The same failure occurs in PR #8110 job. Its merge is an ancestor of the implementation base, and the ZCode runtime, smoke and fixture files are unchanged through that base and candidate.

These bounded source/history comparisons support pre-existing failure attribution; they do not waive required CI or establish a full baseline replay.

Frontend / Visual Evidence

UI impact: none. No graphical layout changes; screenshots and viewports are not applicable. The CLI gains the documented envelope and necessary source-warning presentation.

Type of Change

• Refactoring
• Documentation update
• Test update

LoopX Area

• Control plane
• Host or runtime integration

Technical Direction

Bounded T3 projection ownership within the TypeScript control-plane migration. This does not close T4.

Shared-authority RFC fixture impact

No authority-store schema, dual-write, persisted migration or provider-default change. Fixture coverage includes full-registry versus page membership and envelope source evidence. No PostgreSQL or three-arm promotion qualification is claimed.

Boundary Checklist

• Public-safe source and aggregate validation summaries only; no private state, credentials or raw traces.
• Scope limited to the peer-directory migration.
• Existing English/Chinese RFC and ledger pairs updated.
• UI impact marked none.
• DCO sign-off: intentionally not added; remains a merge blocker.