.refactor-loop 历史生成物与陈旧 worktree 的有界清理机制

[loning]

动机

.refactor-loop/ 的运行生成物与 .worktrees/ 在长跑 dogfood 下无界累积,实测当前单机:

• .refactor-loop/logs/:333 文件 / 252M(每个 codex 一条,solver/judge/reviewer/fix 数千行)
• .refactor-loop/prompts/:2726 文件(每 PR/每轮渲染的一次性 prompt)
• .refactor-loop/runs/:3307 文件(verdict/report/audit artifact)
• .controller-pending-events.log:38026 行 / 6.6M(append-only 事件日志,可回溯到数周前)
• .worktrees/:19 个目录(多数为已 merged PR 的陈旧 worktree)

这些是生成物,不是事实源(权威源在 SKILL.md/脚本/测试,历史由 git 保存,见 CLAUDE.md「生成物不当事实源」「历史由 git 保存」)。无清理机制会拖慢 glob/扫描、占盘、并增加误读陈旧 artifact 的风险(本 dogfood 已发生过误删 in-flight log、扫错 runs/ 致 router 误判)。

范围

为 skill-private 运行态生成物 + 陈旧 worktree 设计一套有界保留 / 清理机制:

• .refactor-loop/logs|prompts|runs 的按保留窗口(age/count)清理。
• .controller-pending-events.log 等 append-only 事件日志的有界截断(保留近期窗口)。
• .worktrees/<name> 中已 merged / 无 in-flight codex 的陈旧 worktree 清理(配合 git worktree prune)。

设计约束(安全不变量,需 design-consensus 收敛具体方案)

1. 绝不删活跃产物:任何仍有 RUNNING codex 的 log / worktree 一律不动;删前必须用 raw ps 确认进程真死(承本 dogfood 误删 in-flight minimal r2 log 教训)。
2. 绝不删活跃 PR/issue 关联 artifact:保留窗口内 + 与 OPEN PR/issue 关联的 prompt/runs/log 不清。
3. 事件日志按 retention 截断而非整删:保留近期窗口,且不破坏正在 tail -n 0 -F 的 Monitor bridge。
4. host-opt-in + daemon-owned:保留窗口经 host.env 注入(缺省 noop/保守);机械、状态确定的清理放后台 daemon(daemon-first)。
5. narrow allowlist,无 lifecycle authority:只在 skill-private .refactor-loop/ + .worktrees/ 文件面 GC;禁止任何 git commit/push/merge、issue/PR/label 生命周期动作、tag/release;不作为 generic lifecycle actor。
6. 可验证:behavior test(stub 文件树 + 假进程)断言「活跃产物不删 / 超窗陈旧产物删 / 事件日志截断保留近期 / 已 merged 无 in-flight worktree 清理」;source-regression 锁住保留窗口事实源与 allowlist 字面。

验收

设计落地后:长跑下 .refactor-loop 生成物与 .worktrees 维持有界规模;无活跃产物被误删;事件日志有界且 Monitor 不断流;全套 source-regression + behavior test 绿。

⟦AI:AUTO-LOOP⟧

[loning]

🤖 minimal solver 建议:复用现有 retention helper 扩边界

TL;DR

• 这是什么:issue 437 的 minimal 设计 solver 结论。
• 结论:违规真实存在,最小修复是扩展现有 log-retention,不是新增 cleanup daemon。
• 下一步:meta-judge 可与另外两个 solver 输出合并,收敛是否采用这个最小边界。

---

详细说明

当前 checkout 已有 skills/codex-refactor-loop/scripts/codex_refactor_loop/retention.py、consensus-rnd-cli log-retention 和 restart-daemons 启动前调用点,但它只删除 24h 旧 .refactor-loop/logs/*.log。issue 437 要求还覆盖 prompts/runs、事件日志截断、陈旧 .worktrees 清理,所以最小边界是把这个现有 helper 扩为保守的 runtime retention helper。

方案不改 CLAUDE.md:现有规则已经要求生成物不是事实源,也允许 narrow allowlist runtime helper。新增合同应落在 SKILL.md、host.env.example 和 behavior/source-regression tests 里,并保持 host opt-in、活跃进程保护、OPEN issue/PR 关联保护、无 GitHub 生命周期权限。

---

📎 完整 codex 原始输出(存档备查)

---

solver: minimal
issue: 437
cluster: issue-437
verdict: propose

Recommended framing

issue 437 的违规真实存在:当前 dogfood 下 .refactor-loop/logs 约 257M/341 文件,prompts 5525 文件,runs 3499 文件,.worktrees 17 个目录,而 CLAUDE.md 明确说生成物不是事实源、历史由 git 保存。最小边界不是新增 daemon,而是把已有 consensus-rnd-cli log-retention / retention.py 从“只删 24h 旧 log”扩展为一个保守的 runtime retention helper,继续由 restart-daemons tick 前调用;它只碰 skill-private .refactor-loop/ 和 .worktrees/,缺省保守/可配置,并用活跃进程与 OPEN issue/PR 关联保护避免误删。

Concrete plan

• Files:
  • skills/codex-refactor-loop/scripts/codex_refactor_loop/retention.py: 扩展现有 helper,保留 retain_logs 兼容入口,新增 RuntimeRetentionConfig + run_runtime_retention(ctx, now, process_inventory, gh_items, command_runner);覆盖 logs/prompts/runs/event log/worktrees,只允许删除 .refactor-loop/{logs,prompts,runs} 下普通文件和 .worktrees/<child> 目录。
  • skills/codex-refactor-loop/scripts/codex_refactor_loop/restart.py: 将 _run_log_retention() 改名或包一层为 _run_runtime_retention(),仍在 daemon 启动前执行,失败只 warning 不阻断 restart。
  • skills/codex-refactor-loop/scripts/codex_refactor_loop/context.py: 如需避免散落路径拼接,给 LoopPaths 增加 worktrees 字段;否则 retention 内局部使用 ctx.repo_root / ".worktrees"。
  • skills/codex-refactor-loop/scripts/codex_refactor_loop/cli.py: 保留 log-retention 命令名作为兼容入口,description/authority 改成 runtime retention;不新增第二个 public command。
  • skills/codex-refactor-loop/host.env.example: 添加保守 retention knobs,例如 RETENTION_ENABLE=false, RETENTION_MAX_AGE_HOURS=168, RETENTION_MIN_KEEP_PER_KIND=200, RETENTION_EVENT_LOG_MAX_LINES=5000, RETENTION_WORKTREE_MAX_AGE_HOURS=168;缺省 false/noop 或只 log dry-run,避免下游突然删除。
  • skills/codex-refactor-loop/SKILL.md: 在 Host env surface matrix 和 daemon allowlist/重启段补上 runtime retention 合同:允许清理 .refactor-loop/logs|prompts|runs、截断 .refactor-loop/.controller-pending-events.log、删除 stale .worktrees/<name> 并可运行 git worktree prune;禁止 git commit/push/merge/reset/rebase、GitHub lifecycle/label/tag/release、任意路径删除、host production SSOT。
  • skills/codex-refactor-loop/scripts/test_log_retention.py 或重命名为 test_runtime_retention.py: 扩展现有 behavior/source-regression 覆盖。
• LOC delta: ~+260 / -35。
• Tests to add/modify:
  • test_log_retention.py: 改旧断言为 runtime retention,覆盖旧 log 删除仍可用、非 .refactor-loop/logs|prompts|runs 普通文件不删、symlink/FIFO/目录不删。
  • 同文件新增: active log/prompt/run 保留,通过 stub process inventory 匹配 log path 或 worktree path; OPEN issue/PR 关联 artifact 保留;超窗且不活跃 artifact 删除;pending-events log 只截断保留末尾 N 行且文件 inode 不替换;stale worktree 只有 remote branch missing/merged 且无活跃进程时删除并调用 git worktree prune。
  • source-regression: retention.py 不含 gh issue edit, gh pr merge, git commit, git push, git merge, git reset, git rebase, git tag;只出现允许的 git worktree prune/read-only worktree list;SKILL/host.env.example 含 retention knobs 与 allowlist 字面。
• Governance/ruleset change (if any): none。现有 CLAUDE.md 已允许 narrow allowlist daemon/runtime 例外,且 issue 437 只是在 skill 自己的 SKILL.md/测试里落一个更窄的 runtime retention 例外;不需要改仓库宪法。
• Migration path: 单步迁移;保留 log-retention public command 名和 24h log 行为兼容,新增 surfaces 缺省 noop/保守,host 明确设置 RETENTION_ENABLE=true 后才清理 prompts/runs/event log/worktrees。

Risks

• 保守默认意味着首次落地后可能仍需要 host opt-in 才真正降磁盘占用;这是为避免下游升级即删生成物。
• OPEN issue/PR 关联识别若只靠文件名模式,会留下部分陈旧 artifact;可接受,因为最小方案优先不误删。
• worktree 清理需要区分 dev-sync 等长期专用 worktree;必须硬编码保留这些 owner-local 名字,不能用通用目录清空。
• event log 截断若直接 rewrite 可能影响 tail -F;计划要求原路径原 inode 截断/写尾部,但实现需要用测试锁住。

Escalation triggers (if any)

• none

Reasoning trace (internal — short, for meta-judge)

• Why this is the minimum: repo 已有 retention.py、log-retention CLI、restart-daemons 调用点和 test_log_retention.py;扩展它比新增 daemon/registry/cleanup subsystem 少改文件,也符合单一主干。
• What I considered but rejected: 新增独立 cleanup-daemon 或 runtime-gc command,会形成第二套 daemon lifecycle;把 .refactor-loop/host.env 当 retention SSOT,违反 host production SSOT boundary;立即默认删除 prompts/runs/worktrees,误删风险过高。
• What I cannot decide alone: retention 默认窗口具体数值是否足够,但可由 host.env knob 保守默认解决,不阻塞设计。

⟦AI:AUTO-LOOP⟧
SOLVER_DONE:minimal:propose:扩展现有 log-retention 为保守 runtime retention helper,覆盖 logs/prompts/runs/event log/stale worktrees

⟦AI:AUTO-LOOP⟧

[loning]

🤖 delete solver 建议收敛旧 log-retention 抽象

TL;DR

• 这是什么: issue 437 的 delete-framing 独立 solver 输出。
• 结论: 不删除清理需求;建议删除/替换现有 log-only retention vocabulary,收敛为单一 runtime-retention owner。
• 下一步: meta-judge 可把此作为 collapse-and-delete 方案,与 minimal/structural 输出合并判断。

---

详细说明

我查到当前已有 retention.py / test_log_retention.py,但它只做固定 24h 的 .refactor-loop/logs/*.log 删除,并且 SKILL.md 还把“不扫描/删除 prompts/runs”写成约束。issue 437 的范围已经覆盖 logs、prompts、runs、append-only event log 和 stale .worktrees,所以继续保留这个 log-only 入口再新增别的 GC 会变成平行清理系统。

推荐动作是 collapse: 删除独立 log-retention/retain_logs 的窄语义和对应测试文件,把可保留的行为测试迁到新的 runtime retention 测试中;restart hook、CLI command/capability、SKILL.md allowlist 统一指向一个 owner-local runtime-retention primitive。该 primitive 仍必须只碰 skill-private .refactor-loop/ 与 .worktrees/,没有 GitHub lifecycle 或 git commit/push/merge/tag/release 权限。

---

📎 完整 codex 原始输出(存档备查)

---

solver: delete
issue: 437
cluster: issue-437
verdict: propose

Classification

d) Genuinely needed but over-built / 当前实现已出现过窄并行抽象,应 collapse-and-delete。

Recommended action

不要删除 issue 437 的清理需求本身:issue body 给出当前 .refactor-loop 约 398M、7071 个文件、.worktrees 18 个目录的实测压力,且 CLAUDE.md 已明确“生成物不当事实源”“历史由 git 保存”。但也不要新增第二套 GC/cleanup 系统。推荐把现有 consensus-rnd-cli log-retention 的 log-only 临时修复删除/替换为单一 owner-local runtime retention primitive:同一个 owner surface 负责 .refactor-loop/logs|prompts|runs、.refactor-loop/.controller-pending-events.log 截断、以及 stale .worktrees cleanup projection/apply。旧的 24h logs/*.log 特例、retain_logs 单函数、delete-log capability token、_run_log_retention 名称和 SKILL.md 中“不得 scan/delete prompts/runs”的窄禁令应被删除或改写为统一 allowlist,避免未来在 log retention 旁边再长出 prompts retention / runs retention / worktree cleanup 三个平行系统。

Concrete plan (if propose)

• Files to delete: skills/codex-refactor-loop/scripts/test_log_retention.py 作为独立 log-only 测试文件删除,由新的 test_runtime_retention.py 覆盖同一 owner surface;不删除 retention.py 文件本身,而是在该文件内删除 log-only API 并替换为统一 runtime retention API。
• Caller migrations: restart.py::_run_log_retention -> restart.py::_run_runtime_retention; cli.py command "log-retention"/capability "delete-log" -> owner-local "runtime-retention"/narrow capability such as "delete-runtime-artifact"; SKILL.md 的 restart/log-retention 章节 -> runtime retention 章节; test_restart_daemons.py 的 retain_logs mock -> unified retention result mock; test_cli_command_router.py 的 command/capability anchors -> unified command/capability anchors.
• Tests to delete: skills/codex-refactor-loop/scripts/test_log_retention.py 删除后,把仍有价值的 case 迁入 test_runtime_retention.py:旧 log older-than-window 删除、symlink/FIFO 保留、missing dir noop、host.env fail-closed、restart hook 在 daemon freshness 前执行。
• LOC delta: -40 以上。删除 187 行 log-only implementation/test surface 中的重复窄语义,新增统一 retention 行为测试会吃回部分 LOC;净删除目标不是强行最大化,而是删除第二套/窄套 vocabulary。
• Philosophy/CLAUDE.md/SPEC/Tier changes (if any): CLAUDE.md 不需要改哲学边界。skills/codex-refactor-loop/SKILL.md 需窄改该 skill 的 runtime exception 文本:从“每次 helper tick 先调用 consensus-rnd-cli log-retention,直接删除超过 24h 的 .refactor-loop/logs/*.log;不 archive、不索引、不新增非 allowlist daemon”和“不得 scan/delete .refactor-loop/runs/ or prompts”改为“每次 helper tick 调用 owner-local runtime retention;只允许在 $REPO_ROOT/.refactor-loop/{logs,prompts,runs}、$REPO_ROOT/.refactor-loop/.controller-pending-events.log、$REPO_ROOT/.worktrees/<owned-stale-worktree> 内按 host-owned retention window/count 和 active/open-state guard 做 bounded cleanup;禁止 GitHub lifecycle、git commit/push/merge/tag/release、generic command execution、host production SSOT”。这和 CLAUDE.md 的删除优先、daemon-first、生成物不当事实源一致,deep consensus 应可达。
• If deletion is unsafe because the issue is merely too large, you may propose a bounded IssueDecompositionPlan artifact path instead of deletion; do not propose direct GitHub lifecycle calls, public issue factories, or any wakeup_plan.py decompose action/projection: 不适用;issue 范围大但同属一个 retention owner surface,无需 decomposition。

Reverse-evidence (why this is safe to delete)

• No public API breaks (verified by rg on public surface): log-retention 当前只被 cli.py, restart.py, test_log_retention.py, test_restart_daemons.py, test_cli_command_router.py, and SKILL.md 引用;没有 host docs 或 README 把它作为外部用户主入口。它是 restart helper 的顺手维护动作,不是 host 产品 API。
• No external repo dependency on the code ($EXTERNAL_REPOS untouched): 未检查外部仓库;本仓库证据显示该命令属于 skill-private runtime helper,且 issue 目标本身限定 skill-private .refactor-loop/ + .worktrees/。
• Tests covering the path are themselves not load-bearing: test_log_retention.py 覆盖的是 24h log-only narrow behavior,其中“不得 scan/delete prompts/runs”的 source-regression 与 issue 437 新需求相冲突,必须删除/改写;行为 case 可迁移到 unified retention 测试。
• 现有能力不足以满足 issue: retention.py 只遍历 .refactor-loop/logs 下 regular *.log,固定 RETENTION_TTL_HOURS = 24;它不处理 prompts/runs、不截断 .controller-pending-events.log、不清理 .worktrees、不读取 host retention window/count。保留它再新增新 GC 会违反“单一主干,插件扩展”和“事实源唯一”。
• worktree 现状也支持 collapse: peek.py 只有 read-only stale worktree 报告,输出 cleanup_owner=controller-runbook no_lifecycle_authority=true;SKILL.md 已要求 owner-local cleanup primitive,但代码中没有 apply primitive。把它并入 runtime retention owner 比新增独立 worktree cleanup daemon 更窄。

Risks

• 如果 downstream 已经直接调用 consensus-rnd-cli log-retention,删除 command name 会造成兼容破坏。因 public command rename 属 operational interface,实施时应在同一变更中写明 migration artifact/test,或者保留一个非文档化短期 alias 只在兼容测试证明必要时使用;delete stance 倾向不保留 wrapper,但这里需要由 implement/meta-judge按 operational-name 条款取舍。
• active artifact guard 若只依赖 mtime/filename 会误删 in-flight 产物;必须把 issue body 的 raw ps / open issue-PR state / clean EXIT=0 marker guard 做成 behavior test,否则 deletion harmful。
• .controller-pending-events.log 正被 tail -n 0 -F 监控;截断必须用不破坏 file identity 的方式或测试证明 Monitor bridge 不断流。
• .worktrees cleanup 涉及 git worktree remove/prune;必须限于 owner-local .worktrees/<name> 且排除 main/dev-sync/current in-flight worktrees,不得扩大成 generic git lifecycle actor。

Escalation triggers (if any)

• none

Reasoning trace (internal — for meta-judge)

• Why I claim this can be deleted: 可以删除的是旧的 log-only retention abstraction,不是清理需求。现有 retention.py 是 63 行、test_log_retention.py 是 124 行,固定 24h 且只删 .refactor-loop/logs/*.log;SKILL.md 还锁了“不 scan/delete prompts/runs”。issue 437 的 scope 已覆盖 logs/prompts/runs/event log/worktrees,保留旧抽象会诱导新增平行 cleanup 系统。
• What I checked to verify safety: 读取 issue 437 body/comments;读取 CLAUDE.md 删除优先/生成物不当事实源/daemon-first 约束;检索 cleanup|gc|retention|worktree prune|controller-pending-events|.refactor-loop/logs|prompts|runs|.worktrees;读取 retention.py, test_log_retention.py, restart.py, cli.py, peek.py, SKILL.md stale-worktree/restart/log-retention 段;用 rg 查 log-retention|retain_logs|RETENTION_TTL_HOURS|_run_log_retention call sites;用 git log -S RETENTION_TTL_HOURS 查到当前 helper 来源为 2026-05-29 refactor(#160) phase2。
• What I cannot decide alone: 是否保留 log-retention command 作为短期 migration alias 取决于 meta-judge 对 operational public command 兼容性的判断;delete bias 倾向删除 alias,但可接受 minimal/structural 若要求一个有测试、有终止条件的迁移窗口。

⟦AI:AUTO-LOOP⟧
SOLVER_DONE:delete:propose:collapse log-only retention into single runtime-retention owner and delete narrow log-retention vocabulary

⟦AI:AUTO-LOOP⟧

[loning]

🤖 structural solver 建议: runtime retention 独立成受限维护 owner

TL;DR

• 这是什么: issue 437 的 structural/CLAUDE-aligned solver 方案。
• 结论: 建议把现有 log-retention 升级为 RuntimeRetentionController, 用 planner/executor 分层统一处理 logs/prompts/runs/event log/worktrees。
• 下一步: meta-judge 可把它与另外两个 solver 对齐,重点裁决默认 opt-in/noop 与 .refactor-loop 历史生成物与陈旧 worktree 的有界清理机制 #437 narrow carveout 文案。

---

详细说明

我把问题定位为: 当前 repo 已有 log-retention, 但它只是固定 24h 删除 .refactor-loop/logs/*.log;issue 437 要求的 prompts/runs、pending-events 截断、stale worktree 清理都需要额外 live/open-state/worktree 判断。结构上不应把 git worktree remove/prune 塞进 log-only helper,而应新增一个明确的 local GC 授权边界。

推荐方案是 RuntimeRetentionController: 一个本地运行态维护 owner。planner 只产出 eligible 删除/截断计划,executor 只执行 closed allowlist;两个真实 caller 是 restart-daemons 周期维护和 pre-audit cleanup。它需要一个 #437 narrow carveout,只允许 skill-private .refactor-loop 生成物、同 inode event log compaction、以及已证明 stale 的 $REPO_ROOT/.worktrees/<name> cleanup;禁止 GitHub 生命周期、branch deletion、commit/push/fetch/reset/rebase/merge/tag/release。

---

📎 完整 codex 原始输出(存档备查)

---

solver: structural
issue: 437
cluster: issue-437
verdict: propose

PROJECT_RULES clause violated (quoted verbatim)

• 强类型边界,窄扩展点:任何 controller-runtime 例外必须 narrow allowlist + no lifecycle authority by default;授权来源必须 durable artifact + 仓库级文档双重锚定。[refactor-design] codex 直接操作 git/gh 减少 controller 中转(维护者实证) #53 是唯一 integration-branch git carveout:integration sync daemon 在专用 integration worktree 内的 integration-branch git allowlist(git fetch / git ls-remote --exit-code --heads origin $INTEGRATION_BRANCH / rev-list / rev-parse / merge-base / reset --hard / rebase --rebase-merges / merge --ff-only|--no-ff / push HEAD:$INTEGRATION_BRANCH / force-with-lease adoption),不得 commit worker diff、create/merge/close PR、开关 issue/PR/label、tag/release,不得作为 generic lifecycle actor。[goal] 多设备并发协作 — 多台机器同时安全跑 codex-refactor-loop(下次发版) #191 是唯一跨设备 active-controller lease carveout:GitHub/已 push git 面只承载一个全局 ActiveControllerLease,允许 read/acquire/renew 专用 lease artifact 并暴露 owner/expiry;禁止 worker diff commit、issue/PR create/merge/close/edit、label mutation、tag/release、per-work claim、host-defined lease scope、跨设备 floor 聚合、daemon ownership matrix、active-active scheduler、generic lifecycle actor。design: 多设备工作认领 lease + daemon 单写者协调(经 GitHub,防双派/双 merge/双 sync) #193 中 issue/PR author.login 与 updatedAt 仅可作为 planning/routing/stale metadata,不得作为 side-effect authorization、per-work owner authority、claim/lease scope 或 takeover permit;issue/PR target 写副作用的跨设备 permit 只来自 [goal] 多设备并发协作 — 多台机器同时安全跑 codex-refactor-loop(下次发版) #191 ActiveControllerLease。Closed issue/PR phase-label reconciliation is detected by peek but never auto-applied — stale crnd:phase:* labels accumulate #238 是唯一 closed managed item phase-label reconciliation carveout:active-controller owner 的 checked-in closed-label-reconciler 只可对 CLOSED crnd:lifecycle:managed issue/PR 做 phase-label reconciliation,移除 phase/cleanup/stuck label 并加 exactly one terminal phase crnd:phase:merged 或 crnd:phase:closed;禁止 open item mutation、issue/PR create/close/reopen/body/title edit、PR merge、human/triage/milestone/lifecycle label mutation、tag/release、generic lifecycle actor。[refactor-design] ReleasePublisher 发版写权限缺同级 runtime-exception 授权镜像(R06/R08/R09 high) #322 是唯一 controller-owned release publication carveout:active-controller owner 的 ReleasePublisher 只可在 ReleasePublishPreflight 验证 RELEASE_AUTO_ENABLE=true、fresh release-candidate/release-decision、decision_digest、target_ref、mapped manifest from_version、required checks 全绿后,走同一 publish 主链路:首次发布运行 python3 .github/scripts/bump_version.py --version <to_version>、git add .version-bump.json <mapped manifests>、git commit -m "Release v<to_version>";already-bumped reentry 仅当 only preflight mismatch 是 mapped manifests 已==to_version 且 git show -s --format=%s HEAD 证明 HEAD subject 精确为 Release v<to_version> 时跳过这三步。两条路径随后都必须运行 git rev-parse HEAD、git fetch origin HEAD、git rev-list --count HEAD..origin/HEAD、git push origin HEAD、通过 ReleaseRequiredChecksProjection 读取 gh api repos/<slug>/commits/<fresh release commit sha>/check-runs --paginate --slurp 或 reentry 的 gh api repos/<slug>/commits/<exact release/reentry commit sha>/check-runs --paginate --slurp 并确认该 exact fresh SHA required checks 全绿后才运行(或 reentry 时确认该 exact fresh/reentry SHA required checks 全绿后才运行) gh release create v<to_version> --target <fresh release commit sha> --generate-notes [--prerelease] 或 reentry 的 gh release create v<to_version> --target <exact release/reentry commit sha> --generate-notes [--prerelease],并写 .refactor-loop/state/release-publish-result.json;禁止 public release-publish CLI、workflow tag/release creation、tag target without exact-SHA green checks、git tag、force-push、release edit/delete/upload、approval-ticket/emoji gate、issue/PR/label lifecycle、merge/close、generic lifecycle actor。daemon 完全自主运行:orchestrator 从交互 Claude Code 搬到 daemon+codex-worker(脱离 session 驱动全 loop) #396 是唯一 unattended wakeup-runner carveout:active-controller owner 的 checked-in wakeup-runner 只可消费 wakeup-plan 产出的 evidence-bound closed action projection,并对每个 action 重新验证 clean EXIT=0 source marker、review truth table、OPEN/live GitHub state、[goal] 多设备并发协作 — 多台机器同时安全跑 codex-refactor-loop(下次发版) #191 owner、release [refactor-design] ReleasePublisher 发版写权限缺同级 runtime-exception 授权镜像(R06/R08/R09 high) #322 preflight 或 helper-specific precondition 后,机械调用既有 controller helper 或 daemon 完全自主运行:orchestrator 从交互 Claude Code 搬到 daemon+codex-worker(脱离 session 驱动全 loop) #396 narrow helper。wakeup-plan 是唯一 action projection fact source但不是 standalone authorization source;daemon 不得读 prompt body 决策,不得新增 ControllerTurnDecision/controller-turn worker/schema,不得接受 argv/shell/cmd/command_line/commands/env/git/gh/executor/lifecycle_authority/lifecycle_owner/generic command fields,不得把 .refactor-loop/host.env 当 host production SSOT。允许动作仅限 spawn codex、named helper dispatch_consensus_implementation、named helper publish_implementation_output、named helper open_release_rollup_pr_from_action、publish worker output、dispatch reviewers/fix/remote-ci worker、apply triage decision、merge PR under review truth table、close managed item from drop marker、publish release through [refactor-design] ReleasePublisher 发版写权限缺同级 runtime-exception 授权镜像(R06/R08/R09 high) #322;禁止任意 git/gh 命令、workflow tag/release、label/merge/close outside existing helper or named daemon 完全自主运行:orchestrator 从交互 Claude Code 搬到 daemon+codex-worker(脱离 session 驱动全 loop) #396 helper、active-active scheduler、generic lifecycle actor。codex-refactor-loop:增加大 issue 自动分解为可独立处理子 issue 的能力(共识门控) #403 是唯一大 issue 分解 carveout:active-controller owner 的 checked-in apply helper 只可消费已验证的 IssueDecompositionPlan,创建 crnd:lifecycle:managed child design issues并评论父 issue;父 epic 保持 open/tracking,禁止 close/reopen/body-title edit,禁止 daemon/worker 建 issue、public issue factory、wakeup-plan decompose 投影或 generic lifecycle actor。通用授权、escape hatch、宽口径修宪一律视为设计未完成。
• 变更必须可验证:行为约束必须落到机械验证手段(behavior test / source-regression test / 段落 lint);仅靠"agent 应该记得"承载的约束视为未落地。
• daemon-first:可机械、状态确定、长期运行的 controller 工作放进 scripts/ 后台 daemon(LLM 长时间运行会退化,脚本不会)。
• 生成物不当事实源:临时日志、一次性报告、agent 草稿、运行输出不得成为长期规范来源;权威源永远在 SKILL.md / 脚本 / 测试里。
• 历史由 git 保存:需要追溯旧行为时查 git,不在工作树保留影子副本或归档目录。

Recommended framing

把现有 log-retention 从「restart helper 顺手删 24h+ logs」升级为 checked-in RuntimeRetentionController: 一个 planner/executor 分层的本地运行态维护 owner,由 restart-daemons 周期调用,并由 pre-audit 路径显式调用同一 planner。它只消费 LoopContext、host-owned retention knobs、active-controller lease、open issue/PR read projection、daemon-owned process inventory、git worktree porcelain projection,输出 .refactor-loop/state/runtime-retention-last-run.json 统计。删除动作只落在 .refactor-loop/{logs,prompts,runs}、同 inode 截断 .refactor-loop/.controller-pending-events.log、以及 $REPO_ROOT/.worktrees/<name> 的 stale git worktree metadata;通过新增 #437 narrow carveout 授权 local GC,而不是把 worktree remove/prune 偷塞进现有 log-only exception。

Concrete plan

• New abstractions (if any): RuntimeRetentionPolicy + RuntimeRetentionPlanner + RuntimeRetentionExecutor。接口: RuntimeRetentionPolicy.from_context(ctx), RuntimeRetentionPlanner.collect(repo_root, process_inventory, github_open_projection, git_worktree_projection) -> RuntimeRetentionPlan, RuntimeRetentionExecutor.apply(plan) -> RuntimeRetentionReport。Layer: skill runtime scripts; Project: skills/codex-refactor-loop; Filename: scripts/codex_refactor_loop/retention.py 或拆到 scripts/codex_refactor_loop/runtime_retention.py 并保留 retention.py compatibility wrapper。
• Files: skills/codex-refactor-loop/SKILL.md 更新 Host env surface matrix、daemon 启动段、pre-audit cleanup 段、runtime exception 段; skills/codex-refactor-loop/authorizations/runtime-exceptions.md 新增 #runtime-retention-controller-437 mirror; skills/codex-refactor-loop/host.env.example 新增 opt-in retention knobs; skills/codex-refactor-loop/scripts/codex_refactor_loop/retention.py 重写为 planner/executor; scripts/codex_refactor_loop/restart.py 把 _run_log_retention() 改为 _run_runtime_retention(); scripts/codex_refactor_loop/cli.py 保留 log-retention compatibility command并新增/改名 runtime-retention; scripts/codex_refactor_loop/controller_actions.py 把 merge 后 inline git worktree remove --force 收敛到同一 worktree cleanup primitive或至少调用 planner 的 single-worktree cleanup action; scripts/test_log_retention.py 改为 compatibility tests; 新增 scripts/test_runtime_retention.py; 更新 scripts/test_host_env_surface_matrix.py, scripts/test_restart_daemons.py, scripts/test_cli_command_router.py, scripts/test_runtime_exception_authorization_sources.py, scripts/test_skill_reference_anchors.py。
• LOC delta: ~+520 / -120。核心 planner/executor ~260 LOC; tests ~260 LOC; SKILL/authorization/host.env/CLI/restart edits ~120 LOC; 删除固定 24h log-only special casing ~120 LOC。
• Tests to add: test_runtime_retention.py 8 个 behavior tests: default opt-in false does no destructive delete; old orphan logs/prompts/runs are deleted only inside allowlisted dirs; live spawn-codex --log 或 --cd targets are kept; OPEN issue/PR associated artifacts are kept; event log compaction keeps unprocessed suffix, adjusts .controller-last-processed-event-offset, and preserves inode; stale merged worktree with no live process is removed and git worktree prune is called; open PR/in-flight/dirty/local-ahead worktree is skipped; path escape/symlink/non-regular targets fail closed. Source-regression tests: SKILL narrow allowlist text, .refactor-loop 历史生成物与陈旧 worktree 的有界清理机制 #437 authorization path, host.env knobs, forbidden gh issue edit, gh pr merge, git push, git branch -D, archive/index tokens, no generic command fields.
• Schema/protocol changes (if any): Host env surface additions only, no public marker/schema change: RUNTIME_RETENTION_ENABLE=false, RUNTIME_RETENTION_MAX_AGE_HOURS=168, RUNTIME_RETENTION_MAX_FILES_PER_DIR=1000, RUNTIME_RETENTION_EVENT_LOG_MAX_LINES=5000, RUNTIME_RETENTION_WORKTREE_MIN_AGE_HOURS=24, optional RUNTIME_RETENTION_DRY_RUN=true for first-run reporting. Compatibility: unset keeps destructive cleanup noop except legacy log-retention may report what it would delete until host opts in; log-retention command remains as alias/report surface for one release.
• Governance/ruleset changes (if any): CLAUDE.md / AGENTS.md clause 强类型边界,窄扩展点 从「仅 [refactor-design] codex 直接操作 git/gh 减少 controller 中转(维护者实证) #53/[goal] 多设备并发协作 — 多台机器同时安全跑 codex-refactor-loop(下次发版) #191/Closed issue/PR phase-label reconciliation is detected by peek but never auto-applied — stale crnd:phase:* labels accumulate #238/[refactor-design] ReleasePublisher 发版写权限缺同级 runtime-exception 授权镜像(R06/R08/R09 high) #322/daemon 完全自主运行:orchestrator 从交互 Claude Code 搬到 daemon+codex-worker(脱离 session 驱动全 loop) #396/codex-refactor-loop:增加大 issue 自动分解为可独立处理子 issue 的能力(共识门控) #403」增加一个具体 .refactor-loop 历史生成物与陈旧 worktree 的有界清理机制 #437 carveout: active-controller owner 的 checked-in RuntimeRetentionController 只可在 host opt-in 后删除 skill-private .refactor-loop/{logs,prompts,runs} eligible generated artifacts、同 inode compact .refactor-loop/.controller-pending-events.log processed prefix、以及 remove/prune $REPO_ROOT/.worktrees/<name> 中已 merged/no open PR/no in-flight/no dirty/no local-ahead stale worktree;允许 git 仅 git worktree list --porcelain, git -C <worktree> status --porcelain, git -C <worktree> rev-parse, git -C <worktree> rev-list --count, git merge-base --is-ancestor, git worktree remove <path>, git worktree prune;允许 GitHub 仅 read open issue/PR/head state;禁止 branch deletion、commit/push/fetch/reset/rebase/merge、issue/PR create/edit/close/merge、label mutation、tag/release、archive/index durable fact source、generic lifecycle actor。值得付 trusted-base 成本: issue 范围包含 local worktree mutation,当前规则没有可复用授权;把它写成唯一 local GC carveout 比让 controller 手工删或扩大 daemon 完全自主运行:orchestrator 从交互 Claude Code 搬到 daemon+codex-worker(脱离 session 驱动全 loop) #396 更窄。deep consensus 可达: 它强化「生成物不是事实源」「历史由 git 保存」,并把可滥用 git mutation限定为本地 worktree metadata GC。
• Runtime cost: 每 restart-daemons tick 增加一次 bounded scan: 当前量级 logs 341/prompts 2737/runs 3343/worktrees 17,纯文件 stat 约 0.2-0.8s; GitHub open projection 1-2 read calls,设置 10s timeout,失败则 worktree/open-associated artifact cleanup fail closed但本地 age-only log cleanup仍可计划为 dry-run; process inventory 1 raw process snapshot约 20-80ms; event compaction O(retained lines) 5000 行约 <50ms。删除动作分批上限默认每 tick 200 files + 5 worktrees,避免单 tick 长阻塞。
• If the structural answer is issue decomposition: not applicable.

Risks

• 比最小改法多一个 .refactor-loop 历史生成物与陈旧 worktree 的有界清理机制 #437 runtime exception 和 host.env knobs;代价是规则面更重,但 worktree remove/prune 本来就是 git mutation,结构上必须有 repo-level 授权。
• planner/executor 可能过度工程化;边界用两个真实 caller 限住: restart-daemons 周期维护和 pre-audit cleanup。不要新增 standalone daemon、generic GC registry、archive/index数据库、wakeup-plan action,也不要把 retention policy 扩展到 host artifacts。

Escalation triggers (if any)

• none

Reasoning trace (internal — for meta-judge)

• Why this structure beats a documented exception: 仅文档写「可以清理」会再次落到 controller 手工 rm 或零散 helper;planner 先证明 eligible,executor 只执行 closed action list,测试可直接断言活跃产物不删。
• Why I picked this abstraction over alternatives: 单纯扩展 log-retention 名字会掩盖 prompts/runs/events/worktrees 四类不同保护条件;独立 RuntimeRetentionController 名字表达 owner,但保留 compatibility wrapper避免第二套系统。
• What I cannot decide alone: 默认是否保留 legacy 24h log deletion还是全部 destructive cleanup 都需要 host opt-in;建议第一版默认 dry-run/noop,由本仓库 host.env opt-in 开启。

⟦AI:AUTO-LOOP⟧
SOLVER_DONE:structural:propose:RuntimeRetentionController with #437 narrow local GC carveout

⟦AI:AUTO-LOOP⟧

[loning]

🤖 meta-judge 判定:第 2 轮收敛 runtime retention 承载边界

TL;DR

• 这是什么:issue 437 第 1 轮 design-consensus 的 meta-judge 裁决。
• 结论:3 个 solver 都 propose,但 implementation-bearing framing 不一致,所以不派 implement。
• 下一步:controller 应按下面 narrowed question 派第 2 轮 solver,只收敛命名/迁移/CLAUDE carveout/测试合同。

---

详细说明

三方已经达成的部分:清理需求真实存在;需要一个有界 runtime retention owner 覆盖 .refactor-loop/{logs,prompts,runs}、.controller-pending-events.log 和 stale .worktrees;必须有 active process guard、OPEN issue/PR artifact guard、host opt-in、无 GitHub lifecycle authority。

未达成 consensus 的部分仍是实现承载: minimal 保留 log-retention 兼容入口且不改 CLAUDE.md; structural 倾向 RuntimeRetentionController/planner-executor 并要求 #437 repo-level carveout; delete 主张删除或替换旧 log-retention vocabulary。第 2 轮问题应只让 solver 明确同一个 owner/name/file boundary、public command 迁移策略、是否修改 CLAUDE.md、host env 默认行为和必须锁住的 behavior/source-regression tests。

---

📎 完整 codex 原始输出(存档备查)

---

issue: 437
cluster: issue-437
convergence_round: 1
solver_verdicts:
minimal: propose
structural: propose
delete: propose
decision: converge

Decision

不判 consensus,进入第 2 轮 convergence。三份 solver 都确认 issue 437 真实且需要一个有界 runtime retention owner,覆盖 .refactor-loop/{logs,prompts,runs}、.controller-pending-events.log 和 stale .worktrees,并要求 active process / OPEN issue-PR guard、host opt-in、无 GitHub lifecycle authority。但三份 implementation-bearing framing 没有同一:minimal 保留 log-retention 作为兼容入口且不改 CLAUDE.md;structural 引入 RuntimeRetentionController/planner-executor、可新增 runtime-retention 并要求 #437 repo-level carveout;delete 主张删除或替换旧 log-retention vocabulary。分歧落在命名、迁移、治理授权与文件边界,属于 Step 3 的 3/3 propose but framings disagree,不能自动派 implement。

If converge

• Convergence question (specific): 第 2 轮请只裁决一个具体 implementation-bearing framing:runtime retention 应如何命名/落文件、log-retention public command 是否保留兼容 alias、是否必须修改 CLAUDE.md 增加 .refactor-loop 历史生成物与陈旧 worktree 的有界清理机制 #437 narrow carveout,以及 SKILL.md/host.env/tests 的确切边界是什么?
• What each solver should address explicitly:
  • 明确选择 owner/name/file boundary:扩展 retention.py、新增 runtime_retention.py,或二者兼容 wrapper;若使用 RuntimeRetentionController/Policy/Planner/Executor,说明最小必需接口。
  • 明确 consensus-rnd-cli log-retention 的迁移策略:永久兼容入口、限期 alias、还是删除/改名;若删除 public command,给出 operational-name migration artifact/test。
  • 明确治理文本:是否改 CLAUDE.md/AGENTS.md 的 narrow carveout;若不改,说明现有 repo-level 授权为何足够覆盖 git worktree remove/prune;若改,给出精确 clause 和 allowlist。
  • 明确保守默认:host env knob 名称、默认 noop/dry-run/destructive 行为、legacy 24h log cleanup 是否继续运行。
  • 明确 source-regression/behavior tests:active process guard、OPEN issue/PR artifact guard、event log same-inode compaction、stale worktree fail-closed、forbidden git/gh lifecycle tokens。
  • 不要重新争论需求是否存在;三方已同意清理需求本身成立,下一轮只收敛实现承载。
• Round number this fires: 2; marker payload uses source round 1

Round audit trail (links to local artifacts)

• solver-minimal: .refactor-loop/logs/phase9-issue437-r1-minimal.log
• solver-structural: .refactor-loop/logs/phase9-issue437-r1-structural.log
• solver-delete: .refactor-loop/logs/phase9-issue437-r1-delete.log
• work-unit-producer: manual-issue (prompt-only provenance)
• work-unit-source-ref: gh-issue-437

⟦AI:AUTO-LOOP⟧
META_JUDGE_DONE:converge:round-1:请收敛 runtime retention 的命名/文件边界、log-retention 兼容策略、CLAUDE carveout 与测试合同

⟦AI:AUTO-LOOP⟧

[loning]

🤖 delete solver 第 2 轮:删除 log-only retention 旧抽象

TL;DR

• 这是什么:issue 437 第 2 轮 delete-framing solver 输出。
• 结论:清理需求必须保留,但旧 log-retention command/API/test/vocabulary 应删除并折叠到单一 runtime-retention owner。
• 下一步:meta-judge 可用此裁决迁移策略与 .refactor-loop 历史生成物与陈旧 worktree 的有界清理机制 #437 narrow carveout 是否进入最终 implement plan。

---

详细说明

我不建议删除 issue 437 本身:issue body 的数据已经证明 .refactor-loop/ 和 .worktrees/ 无界累积是真问题。应删除的是旧 log-retention 的 log-only 抽象:它只固定删除 24h 旧 .refactor-loop/logs/*.log,但 issue 437 的范围还包括 prompts/runs、事件日志截断和 stale worktree cleanup。继续保留它会把 cleanup 拆成多套 owner。

推荐一次性迁移到 runtime-retention:删除 retain_logs、RETENTION_TTL_HOURS、delete-log capability、_run_log_retention 名称和独立 test_log_retention.py;把仍有价值的安全 case 迁入 test_runtime_retention.py。由于 stale worktree cleanup 需要本地 git worktree remove/prune,计划要求在 CLAUDE.md / AGENTS.md 的 narrow carveout 中新增 #437,而不是只写 SKILL 局部例外。

---

📎 完整 codex 原始输出(存档备查)

---

solver: delete
issue: 437
cluster: issue-437
verdict: propose

Classification

d) Genuinely needed but over-built / 需求真实,但现有 log-retention 是过窄抽象,应 collapse-and-delete。

Recommended action

不删除 issue 437 的清理需求本身:issue body 给出 .refactor-loop/logs 333 文件 / 252M、prompts 2726 文件、runs 3307 文件、.controller-pending-events.log 38026 行 / 6.6M、.worktrees 19 个目录的实测压力,且 CLAUDE.md 明确“生成物不当事实源”“历史由 git 保存”。应删除旧 log-retention 的 log-only command/API/test/vocabulary,用单一 runtime-retention owner 承接 logs/prompts/runs/event-log/worktree cleanup。不要保留永久兼容 wrapper:本仓库 public docs 未把 log-retention 暴露为 host 用户入口,当前 call sites 只在 CLI registry、restart hook、tests、SKILL.md 内,按删除优先应一次性迁移到新 owner。

Concrete plan (if propose)

• Files to delete: skills/codex-refactor-loop/scripts/test_log_retention.py;删除 skills/codex-refactor-loop/scripts/codex_refactor_loop/retention.py 内的 RETENTION_TTL_HOURS, retain_logs, log_retention summary 字符串和 log-only docstring;删除 consensus-rnd-cli log-retention command entry 与 delete-log capability token。
• Caller migrations: restart.py::_run_log_retention() -> _run_runtime_retention(); cli.py command "log-retention" -> "runtime-retention" with capability "delete-runtime-artifact"; test_restart_daemons.py mock retain_logs -> mock unified runtime retention report; test_cli_command_router.py command/capability anchors -> runtime-retention; SKILL.md command index/restart/runtime exception text -> runtime-retention owner; no permanent alias unless implementation finds a checked-in external compatibility contract, and current evidence does not show one.
• Tests to delete: test_log_retention.py as an independent log-only test file. Migrate useful cases into test_runtime_retention.py: old regular log deletion, missing directory noop, symlink/FIFO/non-regular path kept, host env fail-closed, restart hook before daemon freshness checks.
• LOC delta: target net -30 or better after adding unified tests. The goal is deleting the narrow owner surface, not maximizing raw deletion; implementation may add planner/guard tests, but must remove the log-only API/test/command vocabulary.
• Philosophy/CLAUDE.md/SPEC/Tier changes (if any): CLAUDE.md / AGENTS.md clause 强类型边界,窄扩展点 should add one exact .refactor-loop 历史生成物与陈旧 worktree 的有界清理机制 #437 carveout because worktree cleanup needs local git metadata mutation. Current invariant: only [refactor-design] codex 直接操作 git/gh 减少 controller 中转(维护者实证) #53/[goal] 多设备并发协作 — 多台机器同时安全跑 codex-refactor-loop(下次发版) #191/Closed issue/PR phase-label reconciliation is detected by peek but never auto-applied — stale crnd:phase:* labels accumulate #238/[refactor-design] ReleasePublisher 发版写权限缺同级 runtime-exception 授权镜像(R06/R08/R09 high) #322/daemon 完全自主运行:orchestrator 从交互 Claude Code 搬到 daemon+codex-worker(脱离 session 驱动全 loop) #396/codex-refactor-loop:增加大 issue 自动分解为可独立处理子 issue 的能力(共识门控) #403 controller-runtime carveouts are named, and broad git mutation is otherwise not authorized. Proposed invariant text: #437 是唯一本地 runtime-retention carveout:active-controller owner 的 checked-in RuntimeRetentionController 只可在 host opt-in 后对 $REPO_ROOT/.refactor-loop/{logs,prompts,runs} eligible generated artifacts 做 bounded delete、同 inode compact $REPO_ROOT/.refactor-loop/.controller-pending-events.log processed prefix、以及 remove/prune $REPO_ROOT/.worktrees/<name> 中已 merged/no open PR/no in-flight/no dirty/no local-ahead stale worktree;允许 git 仅 git worktree list --porcelain、git -C <worktree> status --porcelain、git -C <worktree> rev-parse、git -C <worktree> rev-list --count、git merge-base --is-ancestor、git worktree remove <path>、git worktree prune;允许 GitHub 仅 read open issue/PR/head state;禁止 branch deletion、commit/push/fetch/reset/rebase/merge、issue/PR create/edit/close/merge、label mutation、tag/release、archive/index durable fact source、generic lifecycle actor。 Worth it: issue scope includes .worktrees cleanup, and hiding git worktree remove/prune under SKILL-only text would violate repo-level narrow carveout discipline. Deep consensus should hold because the carveout narrows, not widens, generated-artifact cleanup and reinforces existing “生成物不当事实源 / 历史由 git 保存” principles.
• If deletion is unsafe because the issue is merely too large, you may propose a bounded IssueDecompositionPlan artifact path instead of deletion; do not propose direct GitHub lifecycle calls, public issue factories, or any wakeup_plan.py decompose action/projection: not applicable; this is one retention owner surface, and decomposition would create avoidable lifecycle overhead.

Reverse-evidence (why this is safe to delete)

• No public API breaks (verified by rg on public surface): log-retention, retain_logs, _run_log_retention, and delete-log appear in cli.py, restart.py, retention.py, test_log_retention.py, test_restart_daemons.py, test_cli_command_router.py, test_ensure_project_rules_fixed_points.py, and SKILL.md. README public identity docs do not advertise log-retention as a user workflow.
• No external repo dependency on the code ($EXTERNAL_REPOS untouched): external repos were not mutated or queried; local evidence shows this is a skill-private runtime helper and issue 437 scope is explicitly skill-private .refactor-loop/ plus .worktrees/.
• Tests covering the path are themselves not load-bearing: test_log_retention.py locks fixed 24h .refactor-loop/logs/*.log behavior and source-regression tokens that now conflict with issue 437, especially “must not scan/delete .refactor-loop/runs/ or prompts”. Its reusable safety cases should move to unified runtime-retention tests.
• Git blame shows the old helper came from 2026-05-29 refactor(#160) phase2: shell runtime 逻辑迁入 Python package(parity,shell 暂留), not a durable product requirement. It was a Python migration of a narrow helper, not a design consensus for full retention.
• Existing implementation cannot satisfy the issue: retention.py only checks .refactor-loop/logs, only deletes regular .log, fixes RETENTION_TTL_HOURS = 24, and has no active-process guard, OPEN issue/PR guard, event-log compaction, worktree eligibility, host retention knobs, or result artifact.

Risks

• If a downstream scheduler manually calls consensus-rnd-cli log-retention, immediate command deletion breaks that local script. Current repo evidence does not show such a documented contract; if implementation discovers one in checked-in host docs, it must either migrate that caller in the same patch or prove a bounded migration artifact is required.
• Worktree cleanup eligibility is easy to over-broaden. Behavior tests must fail closed for open PR, in-flight process, dirty worktree, local-ahead branch, path escape, and reserved worktrees such as dev-sync.
• Event-log compaction can break the Monitor bridge if it replaces the file. Tests must assert same inode / open-handle-safe compaction and offset handling.
• Host opt-in defaults can make first landing look ineffective. That is acceptable only if this repo's own host env opts in through host-owned config, not .refactor-loop/host.env as production SSOT.

Escalation triggers (if any)

• none

Reasoning trace (internal — for meta-judge)

• Why I claim this can be deleted: the deletable object is not retention; it is the old log-only abstraction. It is too narrow for issue 437 and would force parallel prompt/run/worktree cleanup owners if retained.
• What I checked to verify safety: issue 437 body/comments; r1 solver and judge comments; CLAUDE deletion-first/generated-artifact/runtime-exception clauses; retention.py; test_log_retention.py; cli.py; restart.py; test_cli_command_router.py; test_restart_daemons.py; SKILL.md restart/log-retention sections; rg call sites; git log -S RETENTION_TTL_HOURS.
• What I cannot decide alone: exact retention windows and batch limits; they should be host-owned knobs with conservative defaults and behavior tests, not a reason to keep log-retention.

⟦AI:AUTO-LOOP⟧
SOLVER_DONE:delete:propose:delete log-only retention command/API/test vocabulary and collapse into single runtime-retention owner with #437 narrow carveout

⟦AI:AUTO-LOOP⟧

[loning]

🤖 minimal r2 建议:保留 log-retention 入口,补 #437 local-GC carveout

TL;DR

• 这是什么:issue 437 第 2 轮 minimal solver 输出。
• 结论:最小方案是扩展现有 retention.py / log-retention,不新增 daemon 或第二套 cleanup 系统。
• 下一步:meta-judge 可用此与另外两个 r2 solver 对齐,重点裁决是否采纳 .refactor-loop 历史生成物与陈旧 worktree 的有界清理机制 #437 narrow local-GC carveout。

---

详细说明

我核验了当前源码: retention.py 仍只删除 24h 旧 .refactor-loop/logs/*.log, restart-daemons 只调用 _run_log_retention(), cli.py 只有 log-retention 命令,而 SKILL.md 还把“不扫/不删 prompts/runs”写成约束。issue 437 要求覆盖 logs、prompts、runs、.controller-pending-events.log 和 stale .worktrees,所以不是 false positive。

最小可正确边界是保留 log-retention 这个 public command 作为兼容入口,把 retention.py 扩成单一 runtime retention helper。因为 .worktrees/<name> cleanup 和 git worktree prune 属于 git mutation,我不建议只改 SKILL.md;需要在 CLAUDE.md/AGENTS.md 增加一个很窄的 #437 local-GC carveout,只允许 host opt-in 后清理 skill-private runtime/cache/log state,禁止 branch deletion、commit/push/reset/rebase/merge、GitHub lifecycle、tag/release 和 generic lifecycle actor。

---

📎 完整 codex 原始输出(存档备查)

---
solver: minimal
issue: 437
cluster: issue-437
verdict: propose
---

## Recommended framing
违规真实存在且 r2 的最小边界应收敛为:保留现有 `skills/codex-refactor-loop/scripts/codex_refactor_loop/retention.py` 与 `consensus-rnd-cli log-retention` 入口,但把语义从 log-only 扩成单一 runtime retention helper。它不新增 daemon、不新增 generic GC registry、不拆第二套 cleanup 系统;由 `restart-daemons` 继续 tick 前调用,必要时 pre-audit 也调用同一 helper。因为 `.worktrees/<name>` 清理和 `git worktree prune` 是 git mutation,最小可正确方案必须在 `CLAUDE.md`/`AGENTS.md` 增加一个 #437 narrow local-GC carveout,否则只改 SKILL.md 会绕过仓库级“强类型边界,窄扩展点”授权。

## Concrete plan
- Files:
  - `skills/codex-refactor-loop/scripts/codex_refactor_loop/retention.py`: 在原文件内扩展,不新建 `runtime_retention.py`。保留 `retain_logs(repo_root, now=None)` 兼容函数,但新增 `RuntimeRetentionConfig`、`RuntimeRetentionReport` 和 `run_runtime_retention(ctx, *, now=None, process_inventory=None, open_items=None, command_runner=None)`。删除目标只允许普通文件落在 `$REPO_ROOT/.refactor-loop/{logs,prompts,runs}`;事件日志只允许 same-path/same-inode truncate 保留尾部窗口;worktree 只允许 `$REPO_ROOT/.worktrees/<name>` 且通过 active-process、OPEN issue/PR、dirty/local-ahead/branch-state guard 后删除并运行 `git worktree prune`。
  - `skills/codex-refactor-loop/scripts/codex_refactor_loop/restart.py`: `_run_log_retention()` 改成调用 `run_runtime_retention(self.ctx)`;可保留方法名一版兼容,日志改成 `runtime_retention:` summary;失败仍只 warning,不阻断 daemon restart。
  - `skills/codex-refactor-loop/scripts/codex_refactor_loop/cli.py`: 保留 public command `log-retention` 作为兼容入口,description 改为 "run bounded runtime retention";authority 从 `delete-log` 改成 `delete-runtime-artifact` 或 `runtime-retention-local-gc`。不新增 `runtime-retention` command,避免 operational-name 迁移成本。
  - `skills/codex-refactor-loop/host.env.example`: 新增 host-owned knobs: `RUNTIME_RETENTION_ENABLE="false"`, `RUNTIME_RETENTION_MAX_AGE_HOURS="168"`, `RUNTIME_RETENTION_MIN_KEEP_PER_KIND="200"`, `RUNTIME_RETENTION_EVENT_LOG_MAX_LINES="5000"`, `RUNTIME_RETENTION_WORKTREE_MIN_AGE_HOURS="168"`, `RUNTIME_RETENTION_MAX_DELETES_PER_TICK="200"`。默认 false/noop;本仓库 dogfood 可 opt in。
  - `skills/codex-refactor-loop/SKILL.md`: Host env surface matrix、restart helper 段、daemon command bodies、source-regression anchor 改成 runtime retention 合同;删掉“must not scan or delete `.refactor-loop/runs/` or prompts”的 log-only 禁令,替换为 bounded allowlist。
  - `CLAUDE.md` and `AGENTS.md`: 在“强类型边界,窄扩展点”同一长条款中追加 #437 carveout 文本,保持 AGENTS symlink/镜像一致。
  - `skills/codex-refactor-loop/scripts/test_log_retention.py`: 可重命名为 `test_runtime_retention.py`;若不重命名,至少测试类/断言改为 runtime retention。覆盖旧 log 24h 删除兼容、prompts/runs 清理、event log 截断、stale worktree cleanup 和 forbidden token source-regression。
  - `skills/codex-refactor-loop/scripts/test_restart_daemons.py`, `skills/codex-refactor-loop/scripts/test_cli_command_router.py`, `skills/codex-refactor-loop/scripts/test_host_env_surface_matrix.py`, `skills/codex-refactor-loop/scripts/test_skill_reference_anchors.py`: 小范围更新 command authority、host env matrix 和 SKILL anchors。
- LOC delta: ~+360 / -80。核心 retention 扩展约 +170/-35; tests 约 +210/-35; SKILL/host.env/CLI/restart/CLAUDE anchors 约 +60/-10。
- Tests to add/modify:
  - `test_runtime_retention.py` behavior: default disabled is noop; legacy `retain_logs` still deletes only old regular `.log`; enabled runtime retention deletes old orphan logs/prompts/runs inside allowlist only; symlink/FIFO/dir/path escape preserved; process inventory referencing `--log` or `--cd` keeps artifacts/worktrees; OPEN issue/PR associated filenames or projection keeps artifacts; event log truncation preserves path/inode and keeps latest N lines; stale worktree deletion requires no live process, no OPEN PR/issue, clean status, no local-ahead, merged/missing-safe branch proof, then calls only `git worktree remove <path>` and `git worktree prune`.
  - Source-regression: `retention.py`/SKILL/CLAUDE contain #437 allowlist and host knobs; forbid `gh issue edit`, `gh pr merge`, `gh issue close`, `git commit`, `git push`, `git reset`, `git rebase`, `git tag`, `git branch -D`, generic `rm -rf`, archive/index durable fact source, and any argv/shell command field.
  - Existing restart/CLI/host-env tests update expected strings: `restart-daemons` still runs retention before daemon loop; `log-retention` remains routed; authority token is runtime-retention local GC; `host.env.example` matches SKILL matrix.
- Governance/ruleset change (if any): `CLAUDE.md`/`AGENTS.md` clause **强类型边界,窄扩展点** from current enumerated carveouts `#53/#191/#238/#322/#396/#403 only` to append: `#437 是唯一 runtime retention local-GC carveout:active-controller owner 的 checked-in runtime retention helper 只可在 host opt-in 后对 skill-private $REPO_ROOT/.refactor-loop/{logs,prompts,runs} eligible generated artifacts 做 bounded delete、对 $REPO_ROOT/.refactor-loop/.controller-pending-events.log 做 same-inode tail-window compaction、以及对 $REPO_ROOT/.worktrees/<name> 中 no in-flight/no OPEN issue-or-PR/no dirty/no local-ahead/merged-or-missing-safe 的 stale worktree 运行 git worktree remove <path> 与 git worktree prune;允许 GitHub only read OPEN issue/PR state,允许 git only worktree/status/rev-parse/rev-list/merge-base/read checks plus worktree remove/prune;禁止 branch deletion、commit、push、fetch、reset、rebase、merge、issue/PR create/edit/close/merge、label mutation、tag/release、archive/index durable fact source、generic lifecycle actor。` 这笔 trusted-base 成本值得付,因为 issue scope 明确包含本地 worktree 删除,不写 repo-level carveout 就无法机械地区分合法 local GC 与通用 git lifecycle actor。deep consensus 应可达,因为它强化“生成物不当事实源”和“历史由 git 保存”,并把权力锁在 skill-private runtime/cache/log state。
- Migration path: 单步。`log-retention` 命令名永久保留为兼容入口但文档语义改为 runtime retention;unset/default `RUNTIME_RETENTION_ENABLE=false` 不做 prompts/runs/event/worktree destructive cleanup,只报告 noop。需要清盘的 host 在 host-owned config 中 opt in。
- If the minimum viable answer is to split a too-large issue: not applicable;这些面都属于同一个 retention owner,拆 issue 会制造平行 cleanup 事实源。

## Risks
- 默认 noop 会让磁盘压力在未 opt in 的 host 上继续存在;这是为避免升级即删除生成物。
- 保留 `log-retention` 名称会带一点语义债,但比改 public command 名和迁移 operational interface 更小。
- OPEN issue/PR 关联若靠文件名/投影不完整,会保留过多旧 artifact;最小方案宁可少删,不能误删 active artifact。
- worktree cleanup 的 branch-state guard 容易膨胀;首版应只处理明确 stale 的 owner-local `.worktrees/<name>`,不支持 sibling worktree、branch deletion 或 host artifact cleanup。

## Escalation triggers (if any)
- none

## Reasoning trace (internal — short, for meta-judge)
- Why this is the minimum: 当前已有 `retention.py`, `log-retention` CLI, `restart-daemons` 调用点和 `test_log_retention.py`;扩展这些现有 surfaces 比新增 `RuntimeRetentionController` 文件/command/authorization mirror 少。r2 分歧里唯一不能省的是 CLAUDE/AGENTS #437 carveout,因为 worktree remove/prune 是 git mutation。
- What I considered but rejected: 删除 `log-retention` command 会触碰 operational public command 迁移;新增 `runtime_retention.py`/planner/executor 三对象偏 structural;新增 daemon 或 wakeup-plan action 明显过界;只改 SKILL.md 不改 CLAUDE.md 对 worktree git mutation 授权不足。
- What I cannot decide alone: retention 默认窗口数值和本仓库是否马上 opt in,但这属于 host config 选择,不影响设计落地。

⟦AI:AUTO-LOOP⟧
SOLVER_DONE:minimal:propose:保留 log-retention 入口并扩展 retention.py 为 runtime retention,同时新增 #437 narrow local-GC carveout

⟦AI:AUTO-LOOP⟧

[loning]

🤖 structural solver 建议:新增 RuntimeRetentionController 窄边界

TL;DR

• 这是什么: issue 437 的 r2 structural 独立 solver 输出。
• 结论: 建议把 log-retention 升级为 RuntimeRetentionController, 用 planner/executor 统一约束 logs/prompts/runs/event log/worktrees 清理。
• 下一步: meta-judge 可裁决是否采纳 .refactor-loop 历史生成物与陈旧 worktree 的有界清理机制 #437 narrow local GC carveout,以及 log-retention alias 的迁移窗口。

---

详细说明

我把 violation 定位在两个点: 当前 retention.py 只删除 24h 旧 .refactor-loop/logs/*.log,而 issue 437 的范围包含 prompts/runs、.controller-pending-events.log 截断和 stale .worktrees 清理;后者涉及 git worktree remove/prune,不能藏在旧 log helper 里。

推荐结构是 RuntimeRetentionController(运行态保留/清理的单一 owner): planner 只证明哪些文件或 worktree eligible,executor 只执行 closed allowlist。它不是新 daemon,由 restart-daemons tick 前和 audit fallback 前调用;需要在 CLAUDE.md/AGENTS.md 加 #437 唯一 local GC carveout,禁止 GitHub 生命周期、branch deletion、commit/push/fetch/reset/rebase/merge、tag/release 和 archive/index durable fact source。

---

📎 完整 codex 原始输出(存档备查)

---

solver: structural
issue: 437
cluster: issue-437
verdict: propose

PROJECT_RULES clause violated (quoted verbatim)

• 强类型边界,窄扩展点:任何 controller-runtime 例外必须 narrow allowlist + no lifecycle authority by default;授权来源必须 durable artifact + 仓库级文档双重锚定。[refactor-design] codex 直接操作 git/gh 减少 controller 中转(维护者实证) #53 是唯一 integration-branch git carveout:integration sync daemon 在专用 integration worktree 内的 integration-branch git allowlist(git fetch / git ls-remote --exit-code --heads origin $INTEGRATION_BRANCH / rev-list / rev-parse / merge-base / reset --hard / rebase --rebase-merges / merge --ff-only|--no-ff / push HEAD:$INTEGRATION_BRANCH / force-with-lease adoption),不得 commit worker diff、create/merge/close PR、开关 issue/PR/label、tag/release,不得作为 generic lifecycle actor。[goal] 多设备并发协作 — 多台机器同时安全跑 codex-refactor-loop(下次发版) #191 是唯一跨设备 active-controller lease carveout:GitHub/已 push git 面只承载一个全局 ActiveControllerLease,允许 read/acquire/renew 专用 lease artifact 并暴露 owner/expiry;禁止 worker diff commit、issue/PR create/merge/close/edit、label mutation、tag/release、per-work claim、host-defined lease scope、跨设备 floor 聚合、daemon ownership matrix、active-active scheduler、generic lifecycle actor。design: 多设备工作认领 lease + daemon 单写者协调(经 GitHub,防双派/双 merge/双 sync) #193 中 issue/PR author.login 与 updatedAt 仅可作为 planning/routing/stale metadata,不得作为 side-effect authorization、per-work owner authority、claim/lease scope 或 takeover permit;issue/PR target 写副作用的跨设备 permit 只来自 [goal] 多设备并发协作 — 多台机器同时安全跑 codex-refactor-loop(下次发版) #191 ActiveControllerLease。Closed issue/PR phase-label reconciliation is detected by peek but never auto-applied — stale crnd:phase:* labels accumulate #238 是唯一 closed managed item phase-label reconciliation carveout:active-controller owner 的 checked-in closed-label-reconciler 只可对 CLOSED crnd:lifecycle:managed issue/PR 做 phase-label reconciliation,移除 phase/cleanup/stuck label 并加 exactly one terminal phase crnd:phase:merged 或 crnd:phase:closed;禁止 open item mutation、issue/PR create/close/reopen/body/title edit、PR merge、human/triage/milestone/lifecycle label mutation、tag/release、generic lifecycle actor。[refactor-design] ReleasePublisher 发版写权限缺同级 runtime-exception 授权镜像(R06/R08/R09 high) #322 是唯一 controller-owned release publication carveout:active-controller owner 的 ReleasePublisher 只可在 ReleasePublishPreflight 验证 RELEASE_AUTO_ENABLE=true、fresh release-candidate/release-decision、decision_digest、target_ref、mapped manifest from_version、required checks 全绿后,走同一 publish 主链路:首次发布运行 python3 .github/scripts/bump_version.py --version <to_version>、git add .version-bump.json <mapped manifests>、git commit -m "Release v<to_version>";already-bumped reentry 仅当 only preflight mismatch 是 mapped manifests 已==to_version 且 git show -s --format=%s HEAD 证明 HEAD subject 精确为 Release v<to_version> 时跳过这三步。两条路径随后都必须运行 git rev-parse HEAD、git fetch origin HEAD、git rev-list --count HEAD..origin/HEAD、git push origin HEAD、通过 ReleaseRequiredChecksProjection 读取 gh api repos/<slug>/commits/<fresh release commit sha>/check-runs --paginate --slurp 或 reentry 的 gh api repos/<slug>/commits/<exact release/reentry commit sha>/check-runs --paginate --slurp 并确认该 exact fresh SHA required checks 全绿后才运行(或 reentry 时确认该 exact fresh/reentry SHA required checks 全绿后才运行) gh release create v<to_version> --target <fresh release commit sha> --generate-notes [--prerelease] 或 reentry 的 gh release create v<to_version> --target <exact release/reentry commit sha> --generate-notes [--prerelease],并写 .refactor-loop/state/release-publish-result.json;禁止 public release-publish CLI、workflow tag/release creation、tag target without exact-SHA green checks、git tag、force-push、release edit/delete/upload、approval-ticket/emoji gate、issue/PR/label lifecycle、merge/close、generic lifecycle actor。daemon 完全自主运行:orchestrator 从交互 Claude Code 搬到 daemon+codex-worker(脱离 session 驱动全 loop) #396 是唯一 unattended wakeup-runner carveout:active-controller owner 的 checked-in wakeup-runner 只可消费 wakeup-plan 产出的 evidence-bound closed action projection,并对每个 action 重新验证 clean EXIT=0 source marker、review truth table、OPEN/live GitHub state、[goal] 多设备并发协作 — 多台机器同时安全跑 codex-refactor-loop(下次发版) #191 owner、release [refactor-design] ReleasePublisher 发版写权限缺同级 runtime-exception 授权镜像(R06/R08/R09 high) #322 preflight 或 helper-specific precondition 后,机械调用既有 controller helper 或 daemon 完全自主运行:orchestrator 从交互 Claude Code 搬到 daemon+codex-worker(脱离 session 驱动全 loop) #396 narrow helper。wakeup-plan 是唯一 action projection fact source但不是 standalone authorization source;daemon 不得读 prompt body 决策,不得新增 ControllerTurnDecision/controller-turn worker/schema,不得接受 argv/shell/cmd/command_line/commands/env/git/gh/executor/lifecycle_authority/lifecycle_owner/generic command fields,不得把 .refactor-loop/host.env 当 host production SSOT。允许动作仅限 spawn codex、named helper dispatch_consensus_implementation、named helper publish_implementation_output、named helper open_release_rollup_pr_from_action、publish worker output、dispatch reviewers/fix/remote-ci worker、apply triage decision、merge PR under review truth table、close managed item from drop marker、publish release through [refactor-design] ReleasePublisher 发版写权限缺同级 runtime-exception 授权镜像(R06/R08/R09 high) #322;禁止任意 git/gh 命令、workflow tag/release、label/merge/close outside existing helper or named daemon 完全自主运行:orchestrator 从交互 Claude Code 搬到 daemon+codex-worker(脱离 session 驱动全 loop) #396 helper、active-active scheduler、generic lifecycle actor。codex-refactor-loop:增加大 issue 自动分解为可独立处理子 issue 的能力(共识门控) #403 是唯一大 issue 分解 carveout:active-controller owner 的 checked-in apply helper 只可消费已验证的 IssueDecompositionPlan,创建 crnd:lifecycle:managed child design issues 并评论父 issue;父 epic 保持 open/tracking,禁止 close/reopen/body-title edit,禁止 daemon/worker 建 issue、public issue factory、wakeup-plan decompose 投影或 generic lifecycle actor。通用授权、escape hatch、宽口径修宪一律视为设计未完成。
• 变更必须可验证:行为约束必须落到机械验证手段(behavior test / source-regression test / 段落 lint);仅靠"agent 应该记得"承载的约束视为未落地。
• daemon-first:可机械、状态确定、长期运行的 controller 工作放进 scripts/ 后台 daemon(LLM 长时间运行会退化,脚本不会)。
• 生成物不当事实源:临时日志、一次性报告、agent 草稿、运行输出不得成为长期规范来源;权威源永远在 SKILL.md / 脚本 / 测试里。
• 历史由 git 保存:需要追溯旧行为时查 git,不在工作树保留影子副本或归档目录。

Recommended framing

把 issue 437 收敛为一个 checked-in RuntimeRetentionController: 不是新增长期 daemon,而是 restart-daemons tick 前和 audit fallback 前可调用的 daemonless runtime-maintenance owner。它把现有 log-retention 的 log-only 特例升级为 planner/executor 边界: planner 只从 host-owned retention knobs、helper-private process inventory、OPEN issue/PR 只读投影、git worktree 只读投影证明 candidate eligible; executor 只执行 closed allowlist 的文件删除、事件日志同 inode 截断、stale .worktrees/<name> remove/prune。这样清理权限不靠 controller 手工 rm 或宽 #396 action,而是由 #437 窄本地 GC carveout、SKILL 合同和 behavior/source-regression 测试共同约束。

Concrete plan

• New abstractions (if any): RuntimeRetentionPolicy, RuntimeRetentionPlanner, RuntimeRetentionPlan, RuntimeRetentionExecutor, RuntimeRetentionReport。接口: RuntimeRetentionPolicy.from_context(ctx), RuntimeRetentionPlanner.collect(ctx, process_inventory, github_open_projection, git_worktree_projection) -> RuntimeRetentionPlan, RuntimeRetentionExecutor.apply(plan) -> RuntimeRetentionReport。Layer: skill runtime scripts; Project: skills/codex-refactor-loop; Filename: 优先放在 scripts/codex_refactor_loop/retention.py,保留 log-retention compatibility wrapper;如实现膨胀超过约 320 LOC,再拆 scripts/codex_refactor_loop/runtime_retention.py 并让 retention.py 只转发。
• Files: CLAUDE.md / AGENTS.md 添加 .refactor-loop 历史生成物与陈旧 worktree 的有界清理机制 #437 唯一 local runtime-retention carveout; skills/codex-refactor-loop/SKILL.md 更新 Host env surface matrix、Anti-stop restart helper、Daemon 启动、Durable State Contract、Phase Guardrails 中的 log-retention/stale-worktree 文案; skills/codex-refactor-loop/authorizations/runtime-exceptions.md 添加 mirror anchor runtime-retention-controller-437; skills/codex-refactor-loop/host.env.example 添加 host-owned retention knobs; skills/codex-refactor-loop/scripts/codex_refactor_loop/retention.py 重写 planner/executor; skills/codex-refactor-loop/scripts/codex_refactor_loop/restart.py 将 _run_log_retention() 收敛为 _run_runtime_retention(); skills/codex-refactor-loop/scripts/codex_refactor_loop/cli.py 新增 runtime-retention command 并保留 log-retention 兼容 alias 1 个 release; skills/codex-refactor-loop/scripts/test_log_retention.py 缩为 alias compatibility/source-regression; 新增 skills/codex-refactor-loop/scripts/test_runtime_retention.py; 更新 test_restart_daemons.py, test_cli_command_router.py, test_host_env_surface_matrix.py, test_runtime_exception_authorization_sources.py, test_skill_reference_anchors.py。
• LOC delta: ~+620 / -140。核心 planner/executor +280; worktree/open-state/process projections +110; tests +310; docs/host.env/CLI/restart +60; 删除固定 24h log-only special casing和“不得 scan/delete prompts/runs”旧断言 -140。
• Tests to add: test_runtime_retention.py 10 个 behavior tests: unset/false opt-in 不做 destructive delete且写 report; .refactor-loop/logs|prompts|runs 内超窗且超 count 的 regular files 删除; allowlist 外、symlink、FIFO、目录、path escape 均保留/fail closed; RUNNING codex 的 --log, --prompt, --cd 目标保留; 与 OPEN issue/PR 编号关联且在保留窗口内的 artifacts 保留; clean EXIT=0 且 CLOSED/merged 关联 artifacts 超窗后可删; .controller-pending-events.log 只截断 processed prefix/保留最近 N 行并保持 inode; Monitor bridge tail 文件不存在/offset 不可信时 event compaction fail closed; stale worktree 只有 merged/no open PR/no in-flight/no dirty/no local-ahead 时 remove 并随后 git worktree prune; dirty/local-ahead/dev-sync/current dispatch worktree 保留。Source-regression: SKILL.md 和 mirror anchor 含 .refactor-loop 历史生成物与陈旧 worktree 的有界清理机制 #437 allowlist/forbidden list; CLAUDE.md 含 .refactor-loop 历史生成物与陈旧 worktree 的有界清理机制 #437 carveout; CLI authority 不含 generic command fields; source 不含 gh issue edit, gh pr merge, git push, git branch -D, git reset, git rebase, archive/index durable fact source。
• Schema/protocol changes (if any): Host env surface additions only, no marker/schema change: RUNTIME_RETENTION_ENABLE=false, RUNTIME_RETENTION_DRY_RUN=true, RUNTIME_RETENTION_MAX_AGE_HOURS=168, RUNTIME_RETENTION_MAX_FILES_PER_KIND=1000, RUNTIME_RETENTION_EVENT_LOG_MAX_LINES=5000, RUNTIME_RETENTION_WORKTREE_MIN_AGE_HOURS=24, RUNTIME_RETENTION_MAX_DELETES_PER_TICK=200, RUNTIME_RETENTION_MAX_WORKTREE_REMOVES_PER_TICK=5。Compatibility impact: unset keeps destructive cleanup noop/dry-run; current log-retention command remains as alias/report surface for one release, but canonical docs and tests move to runtime-retention。
• Governance/ruleset changes (if any): CLAUDE.md / AGENTS.md clause 强类型边界,窄扩展点 from current invariant “only [refactor-design] codex 直接操作 git/gh 减少 controller 中转(维护者实证) #53/[goal] 多设备并发协作 — 多台机器同时安全跑 codex-refactor-loop(下次发版) #191/design: 多设备工作认领 lease + daemon 单写者协调(经 GitHub,防双派/双 merge/双 sync) #193/Closed issue/PR phase-label reconciliation is detected by peek but never auto-applied — stale crnd:phase:* labels accumulate #238/[refactor-design] ReleasePublisher 发版写权限缺同级 runtime-exception 授权镜像(R06/R08/R09 high) #322/daemon 完全自主运行:orchestrator 从交互 Claude Code 搬到 daemon+codex-worker(脱离 session 驱动全 loop) #396/codex-refactor-loop:增加大 issue 自动分解为可独立处理子 issue 的能力(共识门控) #403 carveouts; no generic lifecycle actor” to proposed invariant adding: “.refactor-loop 历史生成物与陈旧 worktree 的有界清理机制 #437 是唯一 skill-private runtime-retention carveout: active-controller owner 的 checked-in RuntimeRetentionController 只可在 host opt-in 后删除 $REPO_ROOT/.refactor-loop/{logs,prompts,runs} 中 planner 证明 eligible 的 generated regular files、同 inode compact $REPO_ROOT/.refactor-loop/.controller-pending-events.log 已处理前缀并保留近期窗口、以及 remove/prune $REPO_ROOT/.worktrees/<name> 中已 merged/no open PR/no in-flight/no dirty/no local-ahead 的 stale worktree;允许 git 仅 git worktree list --porcelain, git -C <worktree> status --porcelain, git -C <worktree> rev-parse, git -C <worktree> rev-list --count, git merge-base --is-ancestor, git worktree remove <path>, git worktree prune;允许 GitHub 仅 read open issue/PR/head state;禁止 branch deletion、commit/push/fetch/reset/rebase/merge、issue/PR create/edit/close/merge、label mutation、tag/release、archive/index durable fact source、generic lifecycle actor。” Worth it: issue scope includes local git worktree remove/prune; current rules have no local GC authority, and hiding it inside restart helper would be an exception without repo-level anchor. Deep consensus should hold because the change strengthens existing “生成物不当事实源 / 历史由 git 保存 / daemon-first” invariants while making the dangerous part narrowly testable.
• Runtime cost: each restart-daemons tick adds one bounded local scan: current issue numbers 333 logs + 2726 prompts + 3307 runs + 19 worktrees, about 6.4k stat calls = ~0.2-1.2s on local SSD; process inventory one ps snapshot ~20-80ms; event compaction of 5000 retained lines <50ms; git worktree projection 19 worktrees with status/rev-list checks worst-case ~1-4s, so cap worktree evaluation/removal to 5 per tick and fail closed on command timeout. GitHub open projection should be 1-2 read calls with 10s timeout; failure disables open-associated artifact/worktree cleanup for that tick but can still report local age candidates in dry-run.
• If the structural answer is issue decomposition, use the controller-private IssueDecompositionPlan boundary and child body artifacts; forbid solver/judge/worker GitHub lifecycle, public issue factories, and any wakeup_plan.py decompose action/projection: not applicable; .refactor-loop 历史生成物与陈旧 worktree 的有界清理机制 #437 is one owner surface, not multiple child design issues.

Risks

• 比 minimal 扩现有 log-retention 多一条 .refactor-loop 历史生成物与陈旧 worktree 的有界清理机制 #437 repo-level carveout和一个 planner/executor边界;成本来自 worktree removal 是 git mutation,不能只靠 skill-local文字轻描淡写。
• 兼容 alias 若保留太久会形成双名 operational interface;用 source-regression 锁定 canonical runtime-retention,并在一个 release 后删除 log-retention alias 或明确迁移 artifact。
• OPEN issue/PR 关联若只靠文件名启发会偏保守留下旧 artifact;这是可接受方向,误删比漏删更差。第一版不建 archive/index数据库,避免把生成物变成新事实源。
• event log 同 inode truncation 与 Monitor bridge 交互需要实测;实现必须先写 tail/offset behavior test,测试不过则 event compaction 第一版只 dry-run。

Escalation triggers (if any)

• none

Reasoning trace (internal — for meta-judge)

• Why this structure beats a documented exception: 文档说“可清理”仍会让 controller 或 restart helper 直接删;planner/executor 让 eligible 判定和 mutation 分离,每个危险条件都能被 stub 文件树、假进程、假 GitHub、假 git 投影测试。
• Why I picked this abstraction over alternatives: 单纯叫 log-retention 掩盖 prompts/runs/event/worktree 的不同保护条件;新增长期 cleanup daemon 又违反单一主干。RuntimeRetentionController 是一个 named maintenance owner,但没有新 daemon,两个真实 caller 是 restart-daemons tick 和 audit fallback 前清理。
• What I cannot decide alone: destructive cleanup 的默认是否完全 noop 还是保留旧 24h log deletion。结构建议第一版默认 RUNTIME_RETENTION_DRY_RUN=true 且本 dogfood host 显式 opt-in,避免下游升级即删。

⟦AI:AUTO-LOOP⟧
SOLVER_DONE:structural:propose:RuntimeRetentionController with #437 narrow local GC carveout

⟦AI:AUTO-LOOP⟧

[loning]

🤖 meta-judge r2:继续收敛 runtime retention 命名与迁移

TL;DR

• 这是什么:issue 437 第 2 轮 design-consensus 的 meta-judge 裁决。
• 结论:3 个 solver 都 propose,但 CLI/API/test surface 与 log-retention 迁移策略不一致,所以不派 implement。
• 下一步:controller 应按收窄问题派第 3 轮 solver,只裁决 runtime retention 的 canonical owner/API/CLI/test surface。

---

详细说明

三份方案已经在大方向上收敛:清理需求真实存在,目标是 skill-private runtime retention,覆盖 .refactor-loop/{logs,prompts,runs}、.controller-pending-events.log 和 stale .worktrees/<name>;都要求 #437 narrow local-GC carveout、host opt-in、活跃进程与 OPEN issue/PR guard,以及 behavior test + source-regression。

不能判 consensus 的原因是 implementation-bearing framing 仍冲突。minimal 要永久保留 log-retention 入口并扩展 retention.py;structural 要 RuntimeRetentionController / planner-executor,新增 runtime-retention 并给 log-retention 一个 release alias;delete 要删除旧 log-only command/API/test/vocabulary 并完全迁到 runtime-retention。这是命名、迁移、文件/API 和成本剖面的实质分歧,meta-judge 不能发明第 4 个 hybrid。

方案	核心取舍
保留 log-retention	最小迁移成本,但名称与 runtime retention 范围不匹配。
runtime-retention + 短期 alias	结构清楚,但要测试 alias 终止条件避免双事实源。
删除 log-retention	删除优先最彻底,但可能破坏未记录的 local scheduler 调用。

---

📎 完整 codex 原始输出(存档备查)

---

issue: 437
cluster: issue-437
convergence_round: 2
solver_verdicts:
minimal: propose
structural: propose
delete: propose
decision: converge

Decision

第 2 轮未达到可派 implement 的深共识。三份 solver 都同意 issue 437 的需求真实存在,都把目标收敛到 skill-private runtime retention,覆盖 .refactor-loop/{logs,prompts,runs}、.controller-pending-events.log 和 stale .worktrees/<name>,并都要求 #437 narrow local-GC carveout、host opt-in、活跃进程/OPEN issue-PR guard、behavior test + source-regression。但 implementation-bearing framing 仍冲突:minimal 要永久保留 log-retention 入口并扩展 retention.py;structural 要 canonical RuntimeRetentionController / planner-executor,新增 runtime-retention 并保留 log-retention 一个 release alias;delete 要删除 log-only command/API/test/vocabulary 并迁到 runtime-retention。这些是命名、迁移、文件/API 和成本剖面上的实质分歧,不能由 meta-judge 发明第 4 个 hybrid。

If converge

• Convergence question (specific): issue 437 的最终实现边界应如何精确定义 runtime retention 的 owner/API/CLI/test surface:继续以 retention.py + log-retention 为 canonical,新建 RuntimeRetentionController + runtime-retention 并给 log-retention 一次性 alias,还是删除 log-retention 并完全迁移到 runtime-retention;请给出唯一可实现方案、迁移策略和 .refactor-loop 历史生成物与陈旧 worktree 的有界清理机制 #437 carveout 文案。
• What each solver should address explicitly:
  • 精确 canonical command 名称与 public command 迁移策略:保留永久 alias、一个 release alias、还是无 alias 删除;若选择 alias,说明终止条件和测试如何防止双事实源。
  • 精确 Python API/文件边界:只扩展 retention.py,还是在同文件内引入 RuntimeRetention* 类型,还是新增 runtime_retention.py;列出必须存在和必须删除的函数/类/常量。
  • 精确测试重构:保留并重写 test_log_retention.py,缩为 alias/source-regression,还是删除并迁入 test_runtime_retention.py;说明旧 log-only safety case 如何保留。
  • 精确 CLAUDE.md / AGENTS.md .refactor-loop 历史生成物与陈旧 worktree 的有界清理机制 #437 carveout 文案,尤其 git allowlist 是否允许 fetch,是否只允许 worktree remove/prune,以及 forbidden lifecycle list。
  • 默认行为:unset host knobs 是完全 noop、dry-run report,还是保留旧 24h log deletion;不能把 .refactor-loop/host.env 变成 host production SSOT。
  • 是否需要 skills/codex-refactor-loop/authorizations/runtime-exceptions.md 之类 mirror artifact;若需要,解释为何不违反根目录/事实源唯一和单文件 SKILL canonical 约束;若不需要,说明 source-regression 如何锁住双重锚定。
• Round number this fires: 3; marker payload uses source round 2

Round audit trail (links to local artifacts)

• solver-minimal: .refactor-loop/logs/phase9-issue437-r2-minimal.log
• solver-structural: .refactor-loop/logs/phase9-issue437-r2-structural.log
• solver-delete: .refactor-loop/logs/phase9-issue437-r2-delete.log
• work-unit-producer: manual-issue (prompt-only provenance)
• work-unit-source-ref: gh-issue-437

⟦AI:AUTO-LOOP⟧
META_JUDGE_DONE:converge:round-2:确定 runtime retention 的 canonical owner/API/CLI/test surface,以及 log-retention 的保留/alias/删除迁移策略

⟦AI:AUTO-LOOP⟧

[loning]

🤖 minimal r3 建议: canonical runtime-retention + 一 release alias

TL;DR

• 这是什么: issue 437 第 3 轮 minimal solver 输出。
• 结论: canonical owner/API/CLI/test surface 应改为 runtime-retention,实现仍复用现有 retention.py。
• 下一步: meta-judge 可用这个方案与 structural/delete r3 对齐,裁决 alias 是否作为唯一迁移路径。

---

详细说明

我建议不要永久保留 log-retention,因为名称已经覆盖不了 prompts/runs/event log/worktrees;也不要无 alias 直接删除,因为 public command rename 是 operational interface 迁移。最小可落地方案是:新增 canonical consensus-rnd-cli runtime-retention,把 log-retention 保留一个 release 的 compatibility alias,同 handler / 同 authority / checked-in caller 不再使用旧名。

实现边界保持小:不新增长期 daemon,优先在现有 retention.py 里引入 runtime retention policy/plan/report;restart-daemons tick 前调用 canonical helper;CLAUDE.md 和现有 authorizations/runtime-exceptions.md 增加 #437 narrow carveout/mirror,明确只允许 skill-private generated artifact GC 和 stale worktree remove/prune,禁止 git fetch、commit/push/reset/rebase/merge、GitHub lifecycle、label/tag/release。

---

📎 完整 codex 原始输出(存档备查)

---

solver: minimal
issue: 437
cluster: issue-437
verdict: propose

Recommended framing

第 3 轮 minimal 结论:canonical surface 应改为 runtime-retention,但不要立刻硬删 log-retention public command。最小可落地边界是在现有 retention.py 内把 log-only helper 收敛成一个 owner-local RuntimeRetention helper,新增 canonical consensus-rnd-cli runtime-retention,让 log-retention 作为一次性兼容 alias 同 handler / 同 authority / 不再被任何 checked-in caller 使用。这样避免永久保留错误命名,也避免无迁移删除 operational command。

Concrete plan

• Files:
  • CLAUDE.md / AGENTS.md: 在「强类型边界,窄扩展点」追加 .refactor-loop 历史生成物与陈旧 worktree 的有界清理机制 #437 narrow carveout。AGENTS.md 是 symlink 时只改 CLAUDE.md。拟文案: #437 是唯一 skill-private runtime-retention carveout: active-controller owner 的 checked-in RuntimeRetention helper 只可在 host opt-in 后删除 $REPO_ROOT/.refactor-loop/{logs,prompts,runs} 内 planner 证明 eligible 的 generated regular files、同 inode compact $REPO_ROOT/.refactor-loop/.controller-pending-events.log 并保留近期窗口、以及 remove/prune $REPO_ROOT/.worktrees/<name> 中已 merged/no open PR/no in-flight/no dirty/no local-ahead 的 stale worktree;允许 git 仅 git worktree list --porcelain、git -C <worktree> status --porcelain、git -C <worktree> rev-parse、git -C <worktree> rev-list --count、git -C <repo> merge-base --is-ancestor、git worktree remove <path>、git worktree prune;允许 GitHub 仅 read open issue/PR/head state;禁止 git fetch、branch deletion、commit/push/reset/rebase/merge、issue/PR create/edit/close/merge、label mutation、tag/release、archive/index durable fact source、generic lifecycle actor。
  • skills/codex-refactor-loop/SKILL.md: Host env surface matrix 增加 RUNTIME_RETENTION_ENABLE=false, RUNTIME_RETENTION_DRY_RUN=true, RUNTIME_RETENTION_MAX_AGE_HOURS=168, RUNTIME_RETENTION_MIN_KEEP_PER_KIND=200, RUNTIME_RETENTION_EVENT_LOG_MAX_LINES=5000, RUNTIME_RETENTION_WORKTREE_MIN_AGE_HOURS=168, RUNTIME_RETENTION_MAX_DELETES_PER_TICK=200, RUNTIME_RETENTION_MAX_WORKTREE_REMOVES_PER_TICK=5;把 restart helper 段的 log-retention 文案改为 canonical runtime-retention;写明 log-retention 只是一 release alias,不是事实源。
  • skills/codex-refactor-loop/authorizations/runtime-exceptions.md: 追加 runtime-retention-437 mirror entry,同时追加或同 entry 内包含 log-retention-to-runtime-retention-migration-437 命名迁移段。它只镜像 durable authorization / migration evidence,不作为 runtime loader/schema/API;可满足 operational command rename 的 named migration artifact 要求,不新增根目录文档。
  • skills/codex-refactor-loop/scripts/codex_refactor_loop/retention.py: 保留文件作为唯一 owner,删除 log-only canonical API RETENTION_TTL_HOURS / retain_logs。新增轻量 API: RuntimeRetentionPolicy.from_context(ctx), RuntimeRetentionReport, RuntimeRetentionCandidate, plan_runtime_retention(ctx, policy, *, now, process_inventory, github_open_projection, git_runner), run_runtime_retention(ctx, *, now=None, process_inventory=None, github_open_projection=None, git_runner=None, apply=False) -> RuntimeRetentionReport。不新增 runtime_retention.py,除非实现超过约 350 LOC 且 retention.py 只做转发。
  • skills/codex-refactor-loop/scripts/codex_refactor_loop/restart.py: from .retention import run_runtime_retention; _run_log_retention() 改 _run_runtime_retention(),在 daemon loop 前调用 canonical helper;失败只 warning 不阻断 restart;日志 prefix 改 runtime_retention.
  • skills/codex-refactor-loop/scripts/codex_refactor_loop/cli.py: 新增 canonical command runtime-retention with authority ("read-process","read-gh","read-git","delete-runtime-artifact","compact-runtime-log","git-worktree-cleanup");保留 log-retention 兼容 alias 同 handler / 同 authority,description 必含 compatibility alias for runtime-retention 和 remove after one release.
  • skills/codex-refactor-loop/host.env.example: 加上述 knobs;默认 destructive cleanup 关闭且 dry-run。
  • skills/codex-refactor-loop/scripts/test_log_retention.py: 删除或重命名为 test_runtime_retention.py;旧 log safety case 迁入新文件,不保留 log-only test owner。
  • skills/codex-refactor-loop/scripts/test_runtime_retention.py: 新增 runtime retention behavior tests。
  • skills/codex-refactor-loop/scripts/test_cli_command_router.py, test_restart_daemons.py, test_host_env_surface_matrix.py, test_runtime_exception_authorization_sources.py, test_skill_reference_anchors.py: 更新 command roster、authority token、restart hook、host env matrix、mirror anchor 和 source-regression。
• LOC delta: ~+430 / -120。比 structural 少一个新 module 和完整 controller class hierarchy;比永久 log-retention 多约 60 LOC alias/migration tests,换取 operational rename 安全。
• Tests to add/modify:
  • Behavior: unset/false opt-in 不删除且输出 report; dry-run 只报告; .refactor-loop/logs|prompts|runs 内超窗且超过 min-keep 的 regular files 删除; allowlist 外、symlink、FIFO、目录、escaping path 保留或 fail closed; RUNNING codex command line 引用的 --log / prompt / --cd worktree 保留; OPEN issue/PR 关联 artifact 在窗口内保留; CLOSED/merged 且 clean EXIT=0 的超窗 artifact 可删; .controller-pending-events.log 截断保留尾部 N 行且 inode 不变; worktree 只有 no open PR/no in-flight/no dirty/no local-ahead/merged evidence 全满足才 git worktree remove 后 git worktree prune; git/gh/proc projection failure 对对应类别 fail closed。
  • Alias: COMMANDS["log-retention"].handler is COMMANDS["runtime-retention"].handler,authority 完全相等,所有 checked-in callers 只调用 runtime-retention,log-retention 只可出现在 alias/migration/source-regression 文本。
  • Source-regression: retention.py 不含 gh issue edit, gh pr merge, git fetch, git commit, git push, git merge, git reset, git rebase, git tag, git branch -D;只允许 git worktree remove / git worktree prune 和列出的 read-only git probes;CLAUDE.md、SKILL.md、mirror anchor 三处含 .refactor-loop 历史生成物与陈旧 worktree 的有界清理机制 #437 allowlist/forbidden list;无 archive/index durable fact source。
• Governance/ruleset change (if any): 需要改 CLAUDE.md/AGENTS.md。值得付 trusted-base 成本,因为 .worktrees cleanup 包含本地 git mutation;若只藏在 skill-local helper 中,会违反当前「任何 controller-runtime 例外必须 narrow allowlist + durable artifact + 仓库级文档双重锚定」。deep consensus 可达,因为文案只授权 skill-private generated artifacts 和 stale worktree GC,并显式禁止 git fetch/commit/push/reset/rebase/merge、GitHub lifecycle、label/tag/release 和 generic lifecycle actor。
• Migration path: 一步迁移。发布 .refactor-loop 历史生成物与陈旧 worktree 的有界清理机制 #437 时 canonical caller/docs/tests 全部使用 runtime-retention;log-retention 作为一个 release 的 compatibility alias 保留,有 named migration artifact log-retention-to-runtime-retention-migration-437 和 source-regression 防止新增 checked-in caller。下一次 release 后删除 alias、删除 migration-only test,不保留永久 wrapper。
• If the minimum viable answer is to split a too-large issue: 不适用。.refactor-loop 历史生成物与陈旧 worktree 的有界清理机制 #437 是一个 retention owner surface,不需要 IssueDecompositionPlan。

Risks

• 一个 release alias 仍会短期存在双命名;用测试限制 log-retention 只能是同 handler alias,并禁止 checked-in caller 使用它。
• 默认 noop/dry-run 会让落地后必须 host opt-in 才真正降磁盘;这是避免下游升级即删除 runtime artifacts 的必要保守。
• OPEN issue/PR 关联识别可能偏保守留下旧文件;第一版宁可漏删,不能误删。
• worktree cleanup 的 git projection 若依赖本地 refs 过旧会 fail closed;明确禁止 git fetch,避免把 retention 扩成同步 actor。

Escalation triggers (if any)

• none

Reasoning trace (internal — short, for meta-judge)

• Why this is the minimum: 现有 retention.py/restart hook 可复用,无需新 daemon或新 module;但 log-retention 名称已经与 prompts/runs/event/worktree 范围冲突,所以 canonical command 必须改为 runtime-retention。
• What I considered but rejected: 永久保留 log-retention 会固化错误 operational name;直接删除 command 无 alias 会违反 public command rename 的迁移纪律;新增 RuntimeRetentionController 独立 module 对第一版偏重。
• What I cannot decide alone: alias 删除应绑定哪个具体 semver 坐标;实现时可在 migration artifact 中填当前 from/to release。

⟦AI:AUTO-LOOP⟧
SOLVER_DONE:minimal:propose:canonical runtime-retention in existing retention.py, log-retention one-release alias, #437 narrow local-GC carveout

⟦AI:AUTO-LOOP⟧