test(lark): pin private return fixture to source Chat host

[LIHUA919]

Goal And Delivered Outcome

• Outcome basis: PR docs(pr-review): align verification wording with installer smoke #6062's shard 2 and shard 4 exposed shared private-return failures.
• Goal/source and gap: the separate-coordination-root test fixture called deliver() without the trusted source_store passed by the shipped Chat handoff. Its return route lacked the original Chat host, so drain() left authorized text/file results queued.
• Observable before → after: 14 of 28 affected parameterizations failed on main at c0f77b2d9; all 28 pass after the fixture binds the source store. No product runtime code changes.
• Issue/task and intended base: Related to [Task][RFC]: Complete the research exploration control-plane contract #5214 and PR feat(explore): enforce scoped composition lineage and lifecycle evidence #5280's CI qualification; the signed integration head is based on main at 07eb7a1 (the regression baseline was c0f77b2d9).

Author Declaration

• Written by: model_agent (OpenAI Codex).

Implemented against

• Specification and revision: shipped loopx/chat_coordination.py handoff and loopx/capabilities/manager_context/__init__.py delivery at c0f77b2d9; no separate written fixture specification.

Criterion	Disposition	Symbol / path	Test or command
Pin the original Chat host from a trusted source store for separate coordination roots	implemented	private_return fixture	Full private-return and result-file suites

• Self-check before submission: reviewed the production source_store=controller.store call site, the exact diff, CI JUnit failures, and public/private scan. No live Lark provider was used.

Scope And Continuation

• Completed scope: one test fixture now exercises the production provenance binding, including restart, CLI/MCP file return, wrong-byte and no-resend cases.
• Remaining work: upstream PR fix(ci): accept installed Stage 2C backup provenance #6040, docs(pr-review): align verification wording with installer smoke #6062 and test(control-plane): read canonical todo list result #6068 still need their own CI/review disposition; PR feat(explore): enforce scoped composition lineage and lifecycle evidence #5280 remains separate and is not closed by this test fix.

Validation

• Tested revision: signed head e127a28ba.
• Run state: finished. Input classes: synthetic.

Check kind	Result	Public-safe evidence / limitation
regression_parity	passed	On main at c0f77b2d9, the four affected families were 14 failed / 14 passed; after the fixture change, 28 passed with Python 3.12.
integration	passed	On e127a28ba, both complete Lark private-return/result-file modules: 100 passed on Python 3.11. Includes real CLI/MCP ingress over synthetic transport and negative delivery cases.
integration	passed	On e127a28ba, the full cold-source disposition module passed 18/18 after merging main at 07eb7a1, which contains PR #6040.
static	passed	On e127a28ba, Ruff passed; loopx check had 0 errors and 0 warnings; current-diff premerge passed 4 direct checks with no catalog canaries selected; both commits have DCO trailers.
integration	failed	Historical head c9d951032 Stage2c e2e 2 job: 14 cold-source cases hit the old checkout-versus-installed-wheel assertion. Signed head e127a28ba now includes merged PR #6040; fresh remote CI is pending.
integration	failed	Historical head c9d951032 Windows lifecycle job: 1 effect-runtime locator assertion failed, 184 passed, 18 skipped. Its selected tests exclude the changed Lark fixture; cause unassigned. Fresh remote CI on e127a28ba is pending.

• Coverage and gaps: e127a28ba is a signed normal merge of main at 07eb7a1; the PR diff against that base remains one test fixture. New remote CI is queued/in progress. GitHub still reports APPROVED, but the recorded approval time predates the new merge commit, so fresh exact-head review needs readback before any merge. The Windows failure remains unassigned until the new head runs or a Windows reproduction is available. An earlier local premerge invocation used a stale origin/main, selected 60 unrelated changed files and failed one catalog check; after updating to the pinned canonical base, the one-file premerge run passed. The earlier failure is not counted as passing or attributed to this diff.

Frontend / Visual Evidence

• UI impact: none. No frontend, Lark runtime, or CLI behavior changed.

Type of Change

• Tests and focused validation fixture

Shared-authority RFC fixture impact

N/A: this PR changes no authority rule or persisted contract.

Boundary Checklist

• The diff and this PR body contain no private state, credentials, raw logs, internal links or local paths.
• The change is separate from maintainer-owned upstream repairs.
• Every commit has a DCO Signed-off-by trailer.

[loopx-agent]

Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; reasoning_effort=xhigh

动机

维护私有 App 返回回归测试的贡献者需要验证，协调状态和聊天状态分开存储时，结果仍回到原会话。 旧夹具省略真实聊天存储，返回泵把分离目录误当原聊天宿主，14 个案例没有发送结果；修正后既有文本、文件、重启与重复投递断言恢复。 独立不可变 base 的四组共 28 个案例为 14 failed / 14 passed；候选完整两模块 100 passed，包含这些原失败案例与权限、错误字节、无重复发送负例。 本 PR 只修正现有测试夹具，不修改生产实现、权限、默认、界面或回执格式，也不证明真实飞书服务、模型或长期运行验收。

改动思路

实际 Chat 交接已传入自己的存储，测试遗漏这个来源事实；这不是要给生产返回增加权限或新 fallback。保留不修改会继续产生已复现的假失败，删除发送次数断言又会隐藏真正的回归。直接给现有共享夹具传入原 store 是最小完整修复，两个返回模块继续复用同一夹具。

具体改动

精确 head c9d951032ba505b23ad7db375e9e65564e656573，不可变 base c0f77b2d99d4419ce64cd14bd207e28379ebfb05；完整差异只有 tests/extensions/test_lark_private_manager_returns.py:62–64 的 +3/-1：解释来源的注释、格式展开及 source_store=store。没有修改任何预期结果或断言。

独立规范为 loopx/capabilities/manager_context/README.md，spec_revision c0f77b2d99d4419ce64cd14bd207e28379ebfb05，criterion_id A delegation returns automatically：原受众返回、分离 Chat/coordination roots、撤权复核和保存尝试后不重复发送；本项 implemented，由现有文本/文件返回及恢复负例覆盖。固定版本规范。

apply_context_handoff 早已传入 controller.store；trusted_source_chat_root 根据真实 Session/Turn 验证原宿主，_register_unlocked 持久化分离宿主地址，drain 只在对应原宿主处理结果。夹具现在沿相同路径，不从字符串猜来源，也不重写历史回执。

对主干的风险

没有阻塞问题。独立 source worktree 使用同一 CPython 3.14.8：base 四组 28 案例中 14 failed / 14 passed，失败都在 separate root 的零发送/上传断言；候选完整两模块 100 passed。覆盖 native/legacy、shared/separate、真实本地存储重开、CLI/MCP 文件返回、撤权、改变来源/Turn、错误字节和无重复上传/发送。Ruff、完整 diff-check 通过；原生 loopx check 为 0 errors / 0 warnings，公共边界扫描干净。最初文档搜索的无匹配 shell glob 未执行读取，改用仓库实际文件后完成规范检查；未查询或等待 CI。

最强反例是让成功夹具掩盖错误受众：原来源、发送次数、原 transcript、撤权与失败后不重发断言全部保留。真实本地存储和入口是实测，飞书服务和模型是合成 transport；没有冒充 live provider、安装态、Windows 或长程成本验收。状态词汇、默认关闭隔离、权限、义务文字及 UI 没有生产变更，相应 lenses 无新增合同影响。

我的整体评价

APPROVE，goal_achieved 仅针对这个夹具修复。long_horizon 与 user_experience 均 preserved：没有增加用户步骤或生产成本，恢复了有效的回归反馈；长期净收益和延迟没有测量。已检查相邻源码及现有覆盖、同作者当前 #6062/#5280/#5248，未见重复 smoke 或批量造测试。未来重构检查认为保留共享夹具和原 source-host owner 最清晰，额外 helper 没有价值。召回的恢复 RFC 分阶段建议与本次已交付内部夹具边界不匹配，不据此追加产品验收或继承历史结论。合并权限与真实采用分别判断。

English review

Motivation

Contributors need a trustworthy regression test for private results returned to the original conversation when Chat and coordination storage are separated. The fixture omitted the host-owned source store already supplied by production Chat handoff. Four existing regression families reproduced 14 failures and 14 passes at the immutable base: separated-host cases observed no reply or upload. Passing the original store restores the existing checks without changing their expectations.

Approach and changes

The whole PR changes one existing fixture call and its provenance comment, +3/-1. Production apply_context_handoff already passes controller.store; trusted_source_chat_root validates the actual persisted Session/Turn, registration freezes that host and drain fences returns to it. The pre-change automatic-return specification and immutable revision above require original-audience return, authority rechecks and saved-attempt recovery without resending. The fixture now matches that shipped boundary. Weakening assertions or adding a production fallback would be the wrong repair.

Risks and validation

Independent source worktrees used CPython 3.14.8 with interpreter/package provenance recorded. The complete two-module head suite passed all 100 cases, including the original 28 comparison cases, native/legacy ingress, shared/separate roots, persisted recovery, real CLI/MCP file reporting, revocation, incorrect bytes and no-resend checks. Ruff, full diff-check and native health/public-boundary validation passed. No CI was consulted. Local stores and entrypoints are real; external Lark/model transport is synthetic. Installed wheels, Windows, live provider and long-run cost are not qualified by this test-only repair.

Overall judgment

No blocking finding. This is a complete bounded maintenance fix with unchanged production behavior and user steps. Adjacent provenance coverage and the current same-author batch were inspected; no new smoke or duplicate fixture is introduced. Keeping the existing shared fixture and authority owner is simpler than adding an abstraction. The unrelated recalled RFC-staging advice supplies neither a new obligation nor evidence of memory utility. Long-horizon and user-experience behavior are preserved; restored regression feedback has positive engineering value, without a measured runtime-efficiency claim.

English verdict: APPROVE — exact head c9d9510; the independently reproduced fixture defect is repaired with the original source, authority and recovery assertions intact.

[BigDataDZ]

Static review: the change reads correctly - pinning the lark private-return fixture to the source Chat host (--source-chat-host) matches the adapter's own routing identity instead of an inherited/default host, which is the right pin for a fixture that must survive host defaults changing.

I could not execute the changed test on my verification host, and the blocker is pre-existing and PR-independent: on native Windows (zh-CN, cp936, Python 3.12), this test module errors at the base commit 07eb7a128 with the identical signature - 8 errors on test_production_pump_returns_to_original_private_source_after_restart, all KeyError: 'binding_id' raised from loopx/capabilities/native_chat/external_conversations.py:87 while pending() iterates conversation items (an item without the key reaches the routing comparison). With the head test file the same setup errors 56 times across the wider parametrization - same exception, just more cases.

Flagging that in case it is a real Windows-side data-shape issue rather than a local-environment artifact: pending() items are expected to carry binding_id by the time this comparison runs, and on this host at least one does not. If maintainers can reproduce on a Windows checkout of main, it may deserve its own issue; happy to help chase it with the failing fixture.

No approval from me since I could not run the changed path - deferring to the existing APPROVE.