feat(control-plane): hard cut agent hierarchy to peer runtime

[huangruiteng]

Summary

• make peer_v1 the only live registered-agent runtime model; authority comes from claims/leases, task boundaries, capabilities, typed continuation, and repository policy
• replace persistent main/side/controller routing with deterministic task-scoped coordination, symmetric workspace guards, and explicit review_handoff
• keep host-launched child workers separate from durable registered peers; dormant agents and closed/blocked/deferred todos cannot become task coordinators
• migrate legacy registries through one stable migration id: host updates are idempotent, registry completion is atomic, repeated ack is a no-op, and stale legacy rewrites never wake the user with the same migration again
• upgrade advisory profiles to agent_profile_v1, remove identity-level reviewer/workspace authority, and hard cut canonical status/quota/prompt surfaces
• align README, skills, protocols, fixtures, examples, generated showcases, and agent onboarding with the shipped peer runtime

Commit grouping

• d8f57a5c / 7ecd0839: peer runtime and complete runtime/API hard cut
• a17f24cf / 9de87b8b: protocol and public documentation cutover
• 699df43b / 7e890c7f: migration, continuation, workspace, and boundary regression coverage
• 8e482bb7: latest-main integration plus exactly-once migration, participant-only coordinator selection, README, and residual hierarchy cleanup
• ddc040f8: final clean merge from current origin/main

Validation

• focused peer runtime, migration, workspace, continuation, task orchestration, quota/replan, README, and hard-cut boundary smokes passed
• full-public runner: 533 checks executed; 532 passed, 0 timeouts, 0 tracked side effects
• the sole failure, examples/codex-cli-long-run-benchmark-smoke.py, was reproduced unchanged on detached latest origin/main: both treatment and baseline score 0.875 because overhead cancels writeback quality; it is not introduced by this PR
• python3 -m compileall -q loopx
• python3 examples/control_plane/repo-python-line-budget-smoke.py: 995 tracked Python files, 0 over-budget violations
• python3 -m loopx.cli canary premerge --from-git-diff: 17/17 automated checks passed; public boundary passed; 0 automated failures
• loopx check on README/docs/examples: 0 errors, 0 warnings
• git diff --check and private/credential/path scan passed

The canary correctly reports one benchmark_sensitive manual hold. This is not an automated failure; it prevents self-merge and requires maintainer review.

Merge hold

This PR remains Draft and must not merge until the complete peer-runtime stage package receives maintainer review. The owner-approved README first-screen wording is included and now matches the real peer onboarding/migration behavior.

No local state, registry backups, raw logs, credentials, private paths, or private evidence are included.

[huangruiteng]

Peer runtime hard-cut validation update:

Changed surfaces:

• agent identity, quota/status routing, workspace guard, todo completion, task orchestration, heartbeat prompt, configure/upgrade migration
• canonical protocols, product docs, skills, public fixtures, and generated showcases
• legacy hierarchy smokes replaced by peer runtime, migration, workspace, continuation, orchestration, and boundary coverage

Checks run:

• peer runtime aggregate suite passed
• full-public 530/530 passed; 0 failures, 0 timeouts, 0 tracked side effects
• compileall and Python line budget passed
• canary selected 17 automated checks; all passed
• public/private boundary scan passed
• diff checks passed

Manual hold:

• canary classified benchmark developer workflow docs/fixtures as benchmark-sensitive, so maintainer review is still required and self-merge is disabled
• root README first-screen wording remains outside the branch until owner preview approval

Coverage is sufficient for a Draft review because it exercises fresh peer setup, legacy automation migration, stable-id repeated projection, atomic ack, repeated-ack no-op, typed continuation, workspace repair, status/review projection, and full public compatibility. The PR remains Draft and unmerged.

[huangruiteng]

Summary

• make peer_v1 the only live registered-agent runtime model; authority comes from claims/leases, task boundaries, capabilities, typed continuation, and repository policy
• replace persistent main/side/controller routing with deterministic task-scoped coordination, symmetric workspace guards, and explicit review_handoff
• keep host-launched child workers separate from durable registered peers; dormant agents and closed/blocked/deferred todos cannot become task coordinators
• migrate legacy registries through one stable migration id: host updates are idempotent, registry completion is atomic, repeated ack is a no-op, and stale legacy rewrites never wake the user with the same migration again
• upgrade advisory profiles to agent_profile_v1, remove identity-level reviewer/workspace authority, and hard cut canonical status/quota/prompt surfaces
• align README, frontstage/dashboard views, skills, protocols, fixtures, examples, generated showcases, and agent onboarding with the shipped peer runtime

Commit grouping

• d8f57a5c / 7ecd0839: peer runtime and complete runtime/API hard cut
• a17f24cf / 9de87b8b: protocol and public documentation cutover
• 699df43b / 7e890c7f: migration, continuation, workspace, and boundary regression coverage
• 8e482bb7 / ddc040f8: earlier main integration and hard-cut gap closure
• 0e4e82ad: peer lane frontstage/dashboard projection and browser-smoke alignment
• 68024b6a: remove stale canonical primary_review/hierarchy help and fixtures, delete an unexecuted primary-owner replan assertion, and extend the hard-cut boundary to dashboard docs/smokes
• eaaf5e80: cleanly merge current origin/main, including Fail fast when SkillsBench remote Codex is unavailable #1801 SkillsBench remote-Codex preflight

Validation

• focused peer runtime, migration, workspace, continuation, task orchestration, quota/replan, README, frontstage, and hard-cut boundary smokes passed
• work-lane-contract-smoke.py, quota-replan-decision-plane-smoke.py, Frontstage route/share-bundle smokes, global-manager fixture smoke, and task-graph fixture smoke passed
• after current-main sync, Fail fast when SkillsBench remote Codex is unavailable #1801 egress smoke passed and tests/test_skillsbench_remote_codex_preflight.py passed 3/3 through an isolated uv/pytest environment
• latest GitHub Frontstage build is green
• full-public runner before the final main sync: 533 checks executed; 532 passed, 0 timeouts, 0 tracked side effects
• the sole full-public failure, examples/codex-cli-long-run-benchmark-smoke.py, was reproduced unchanged on detached latest origin/main: both treatment and baseline score 0.875 because overhead cancels writeback quality; it is not introduced by this PR
• final post-sync python3 -m loopx.cli canary premerge --from-git-diff --timeout-seconds 180: 17/17 automated checks passed; public boundary passed; 0 automated failures
• the default 120-second canary run timed out once on install-local-smoke.py; focused rerun passed in 124.83 seconds, and repeated 180-second risk-based runs passed. This is recorded as timing variance rather than hidden.
• python3 -m compileall -q loopx
• python3 examples/control_plane/repo-python-line-budget-smoke.py: 995 tracked Python files, 0 over-budget violations
• loopx check on changed public surfaces: 0 errors, 0 warnings
• git diff --check and private/credential/path scan passed

The canary correctly reports one benchmark_sensitive manual hold. This is not an automated failure; it disables self-merge and requires maintainer review.

Merge hold

This PR remains Draft and must not merge until the complete peer-runtime stage package receives maintainer review. The owner-approved README first-screen wording is included and now matches the real peer onboarding/migration behavior.

No local state, generated uv lock, registry backups, raw logs, credentials, private paths, or private evidence are included.