feat(global-manager): add focused global risks command - #3075
Conversation
huangruiteng
left a comment
huangruiteng
left a comment
There was a problem hiding this comment.
PR #3075 exact-head 评审（head 03e8a5f50e57c281bf798357a7e38ccff4bf7b5c）
详细中文评审
动机
#3043 之后 global manager 已有 summary/gates/todos 三个仓库自有命令，唯独 risks 还依赖 host 端 fallback。本 PR 补上 loopx global-risks：一个只读、确定性的当前风险收件箱，把 stale runs、public-boundary 警告、failing checks、rollback candidates 四类信号收敛为有界的公开安全 JSON/Markdown，供 operator 与 host 集成直接消费，并让 slash 元数据指向真实 CLI 命令（不再标 host_command_defined）。
改动思路
"单一只读投影 + 公开安全边界 + 显式 omission"：
loopx/global_risks.py（+856）：从collect_status的 contract diagnostics / global registry findings / attention queue stale warnings 三处投影提取风险行，做去重聚合、按 severity/category 排序、限制到MAX_RESULT_LIMIT(100)/MAX_SCAN_LIMIT(400)；rollback candidates 明确恒为空并给出原因（当前投影不携带 rollback trigger 与因果链），不伪造证据。- CLI/help/slash：
loopx global-risks子命令（agent_id/limit/time-range），help_surface、slash catalog 指向它；/loopx-global-risks指令文案改为先跑global-risks再总结。 - 协议/文档：
docs/reference/protocols/global-manager-command-v0.md定义请求/响应契约；CONTRIBUTOR_TASKS.md 同步。 - 测试/smoke：
tests/test_global_risks.py（去重、排序、截断、agent 过滤 fail-closed、redaction、错误码）+ 5 个相关 smoke（CLI、protocol、slash catalog/install、Codex App host registry）。
具体改动
loopx/global_risks.py（新，856 行）：build_global_risks：collect_status→contract.error_diagnostics+global_registry.findings（仅 high/action）+attention_queue.items.stale_latest_run_warning→_normalize_*转风险行 →_aggregate_risks/_risk_sort_key→ 分四组。- 失败路径：
status_collection_unavailable/malformed_status_projection/agent_scope_unavailable，全部build_global_risks_error（公开安全、错误码）。 _filter_for_agent：agent 过滤遇到缺失/畸形 goal 投影即抛错 fail-closed；_redact_text/public_safe_boundary全程脱敏；_ROLLBACK_OMISSION明确说明 rollback 组为空的原因。render_global_risks_markdown：只读报告明确不授权 rollback/外部清理/合并。
loopx/cli_commands/summary_all.py：注册global-risks（--agent-id/--limit/--time-range），异常转 error payload。loopx/help_surface.py/loopx/slash_commands.py/loopx/slash_command_install.py：help 清单、slash catalog 的cli_reference=loopx global-risks、implementation_status移除 host_command_defined、指令文案更新。docs/reference/protocols/global-manager-command-v0.md+CONTRIBUTOR_TASKS.md：协议与任务真值。tests/test_global_risks.py（+1050 行左右）与 5 个 smoke 更新/新增。
对主干的风险
- 风险低：只读命令，不改状态；所有外部输入都经公开安全脱敏与边界检查；agent 过滤与畸形投影 fail-closed。
- rollback_candidates 恒空是诚实的设计（当前投影确实没有 rollback trigger/因果链），并以 omission 显式声明，避免给用户假信号；后续若新增来源再接（P2 建议：未来可在协议中定义 rollback candidate 的正式 schema，而不是一直空组）。
global_risks.py856 行偏大但主题内聚（单一只读投影 + 渲染），可接受；importlib.getattr+cast的懒加载写法是为了避免循环导入且通过 strict mypy，风格略特殊但不影响正确性（P2 观察）。time-range目前只是协议兼容参数，当前风险不受窗口限制——文档已说明，可接受。
我的整体评价
实现克制、边界清晰：只读、聚合、排序、截断、脱敏、fail-closed 全部到位；协议文档与 slash 面同步更新，测试与 5 个 smoke 覆盖充分。无阻塞项，整体评价 APPROVE。
验证
- exact head
03e8a5f50e57c281bf798357a7e38ccff4bf7b5c（评审时 head 未变）：tests/test_global_risks.py+tests/test_slash_command_install.py：94 passed（Python 3.12）- 5 个 smoke：
global-manager-command-cli-smoke、global-manager-command-protocol-smoke、slash-command-catalog-smoke、slash-command-install-smoke、codex-app-host-command-registry-smoke全部通过 - CI：dependency-review / pytest / build 全部 SUCCESS
Review: APPROVE
Head: 03e8a5f50e57c281bf798357a7e38ccff4bf7b5c
Verdict: APPROVE — a focused, read-only loopx global-risks projection over existing global status/registry sources: bounded, aggregated, sorted, public-safe, fail-closed agent scoping, and an explicit (honest) empty rollback-candidates group with the source-unavailable rationale. CLI/help/slash/protocol/docs/tests/smokes all align.
Key finding: No blockers. Two P2 notes: the rollback-candidates group is intentionally always empty until a real source schema exists (future protocol work), and global_risks.py's importlib.getattr+cast lazy-import style is unusual but deliberate for strict mypy/import-cycle avoidance.
Validation: 94 focused tests pass at head; all 5 related smokes pass; CI pytest/build/dependency-review green.
…75-merge # Conflicts: # CONTRIBUTOR_TASKS.md # examples/docs-governance-smoke.py
huangruiteng
left a comment
huangruiteng
left a comment
There was a problem hiding this comment.
详细中文评审（新 head 复审）
精确评审头： 3075@324097a74efc58eec58fed60ada5cf69de5b95a5
动机
本 PR 此前已在旧 head 03e8a5f50e 上获得 APPROVE。作者随后将 origin/main 合并进分支，产生新 head 324097a74e（10:27Z），GitHub 因此撤销了旧审批，需要按 exact-head 重新评审。复审重点是：合并是否引入了冲突错误，以及相对已批准旧 head，PR 自有内容发生了什么变化。
改动思路
通过 git diff 03e8a5f50e 324097a74e 限定到 PR 自有文件后确认：核心功能代码与已批准 head 字节级一致（loopx/global_risks.py、tests/test_global_risks.py、loopx/cli_commands/summary_all.py、examples/project/* 等均无变化），实际只改了 3 个文件——CONTRIBUTOR_TASKS.md、examples/docs-governance-smoke.py、loopx/slash_command_install.py。其余约 172 个文件的差异来自 main 侧已合并内容（#3080、#3085、#3091、#3095、#3087、#3070/#3071 等），不是本 PR 新增。这是一次干净的“同步到最新 main”式合并，冲突由作者显式 resolve。
具体改动
- CONTRIBUTOR_TASKS.md：将任务清单重构为 “Project Development Direction + Priority Queue”，更新已落地状态（typed quota/Turn/task-lease settlement、GH-C50 已由 #3080 实现、GH-C82 已并入新任务），新增 GH-C83~GH-C89，并给 GH-C02 标注 #3056 认领协调。内容公开安全，无凭据、本地路径或内部链接。
- examples/docs-governance-smoke.py：同步 required/stale 断言字符串（如 “drives quota, Turn, and task-lease settlement”、“| GH-C82 |”），与新任务板保持一致，保证任务板变更被 smoke 拦截。
- loopx/slash_command_install.py：
/loopx的argument_hint增加[--fine-grained]，与已合并的 fine-grained turn mode（#3087）一致；仅提示文案，无路由或行为变化。
对主干的风险
风险低。slash_command_install.py 仅改 prompt 提示；CONTRIBUTOR_TASKS.md 与 docs-governance-smoke.py 属于公共文档/治理同步，且 smoke 断言已双向锁定。合并 head 的冲突解决经本地 exact-head 验证未见异常。验证矩阵：tests/test_global_risks.py + tests/test_slash_command_install.py 94 项通过；global-manager-command-cli-smoke、global-manager-command-protocol-smoke、docs-governance-smoke、slash-command-catalog-smoke、slash-command-install-smoke、codex-app-host-command-registry-smoke 全部通过；py_compile 与 git diff --check 干净。GitHub CI 中 pytest 仍在 IN_PROGRESS，其余检查 SUCCESS/SKIPPED；发布前已复核 head 未变（324097a74e，10:27:38Z）。
我的整体评价
APPROVE。 新 head 相对已批准旧 head 的 PR 自有改动仅为文档/提示同步，核心功能未变，本地 focused 验证全绿，公开/私有边界干净，无阻塞项。合并仍走 loopx-pr-merge 流程。
English Verdict
APPROVE — exact head 324097a74efc58eec58fed60ada5cf69de5b95a5.
Re-review of the merged head: compared with the previously approved head 03e8a5f50e, only 3 PR-owned files changed (contributor task board, docs-governance smoke assertions, and the /loopx argument hint); the feature code is byte-identical. Local validation: 94 focused pytest tests, 6 smokes, and py_compile all pass; sensitive-content scan clean; GitHub pytest still in progress, other checks green. No blockers.
huangruiteng
left a comment
huangruiteng
left a comment
There was a problem hiding this comment.
Approve — PR #3075 (exact head 324097a74efc58eec58fed60ada5cf69de5b95a5)
Conflict resolution merged origin/main into the PR branch and reconciled the two conflicted files (CONTRIBUTOR_TASKS.md, examples/docs-governance-smoke.py) so the board and smoke now treat /loopx-global-risks as the fourth shipped canonical command while keeping the fuller effect-program wording from main.
Validation on the merged tree:
pytest tests/test_global_risks.py tests/test_slash_command_install.py: 94 passedexamples/docs-governance-smoke.py,examples/project/global-manager-command-protocol-smoke.py,examples/project/global-manager-command-cli-smoke.py,examples/codex-app-host-command-registry-smoke.py,examples/slash-command-catalog-smoke.py,examples/slash-command-install-smoke.py: all passedloopx checkon changed paths: public boundary cleangit diff --check: clean
CI note: the pytest failures on this PR are the same 10 pre-existing model-tool tests from merged #3109 that also fail on main (main run 31574557260); none of this PR's tests fail.
Approving the resolved exact head; merge per owner authorization.
2 participants
Summary
loopx global-risksprojection over the existing global status and registry sourcesWhy
This is a follow-up to #3043. The global manager already exposed focused summary, gate, and todo views, while risks still depended on a host-defined fallback. This change gives risks the same repository-owned, deterministic, read-only command contract.
Impact
Operators and host integrations can use
loopx global-risksfor a compact current-risk inbox. Unhealthy source state remains reportable as data, agent scoping fails closed when it cannot be resolved, current stale state is not hidden by a short request window, and rendered evidence is redacted at the public boundary. The command does not mutate state or authorize rollback.Validation
127 passedacross the focused global risks, todos, summary, and slash-install suitespy_compile, Ruff, and strict mypygit diff --check