[Task]: Re-qualify current NoKV HEAD on the shared-coordination integration path

[wchwawa]

Task ID or area

Shared Goal Authority / NoKV provider qualification

Intent

I am proposing a new task.

Summary

@huangruiteng, NoKV recently completed a broad recovery pass after its path-native architecture refactor. The consolidated context, restored contracts, and remaining limitations are documented in NoKV-Lab/NoKV#465.

The LoopX shared-coordination RFC and its prerequisite qualification gates have now made enough progress to justify a fresh integration review. Please verify whether the current NoKV HEAD is still a robust candidate for the integration path, and whether the architectural changes introduce any material compatibility, correctness, durability, or operational impact for LoopX.

This should extend the direction tracked in #3245; it should not assume that historical NoKV qualification evidence still applies to the current HEAD.

Proposed scope

In scope:

• Pin the exact LoopX and NoKV revisions used for the review.
• Map the current provider-neutral coordination contract and prerequisite gates to the current NoKV API and recovery model.
• Preserve the file-backed provider as the control, then exercise the same deterministic claim, conflict, retry, original-receipt replay, and stale-generation invariants against the NoKV candidate path.
• Check restart, interruption, ambiguous-response, provider-unavailable, and recovery behavior without weakening LoopX's authority or fail-closed boundaries.
• Classify each result as passed, failed, or unverified, and identify any required adaptation on the LoopX or NoKV side.
• Conclude explicitly whether the refactor has no material integration impact, requires a bounded compatibility change, or blocks promotion.

Out of scope:

• Promoting NoKV to the default provider.
• Moving run history, status, quota, scheduler state, host sessions, or evidence into the coordination provider.
• Weakening provider-neutral gates to accommodate NoKV.
• Starting another broad NoKV refactor or treating this review as production or HA qualification.

Relevant files or commands

• docs/architecture/rfcs/shared-goal-authority-state-provider-v0.md
• LoopX direction tracker #3245
• NoKV post-refactor recovery PR #465
• The current provider qualification and deterministic coordination fixtures selected by the owner for this bounded slice.

Validation plan

• Record the exact LoopX and NoKV SHAs and the selected deployment/recovery profile.
• Run the provider-neutral deterministic suite against the file-backed control and the NoKV candidate.
• Run a bounded live restart/retry qualification for the NoKV path, including durable original-receipt replay and stale-owner rejection.
• Confirm that failure remains fail-closed and does not create a second LoopX authority.
• Publish a compact result matrix with failures, skips, unverified claims, and any manual hold before recommending promotion or compatibility work.

Public/private boundary

• This issue does not include private benchmark traces, verifier output, credentials, internal document links, raw agent sessions, or local runtime state.
• I will not run or duplicate maintainer-owned benchmark cases unless a maintainer explicitly splits out a public task.

[huangruiteng]

I re-checked this against the current heads rather than carrying forward the historical NoKV qualification result.

Conclusion

Current NoKV main remains a credible bounded candidate, but the available evidence is not sufficient to promote it as a robust shared-coordination provider. The correct classification is:

bounded compatibility/evidence update required; do not block the experiment, but block provider promotion until the live qualification below is repeatable.

The three current LoopX PRs repair prerequisites and stale evidence, but they do not complete this issue.

Exact revisions and relevant NoKV change

• LoopX base used by fix(todos): close two side doors in the hard_lease handoff gate #3306/fix(examples): restore the nokv shadow-provider evidence against current NoKV and LoopX #3307/docs(rfc): sync shared-goal RFC with the shipped handoff-mode gate #3308: d8326023e8658cdcde1fa6e034f51697b4519ef2
• Current NoKV main: 3d75d9696580140660468d5f49a79486692cd639
• NoKV post-path-native recovery consolidation: NoKV#465, merge ea4ed94b75fcfa57ecade80d93c590f6068d7dd9
• Operational follow-up: NoKV#466, which changed recovery publication from shared by default to local-only by default

The last item is material. NoKV found that shared recovery publication had no checkpoint/compaction path, so the Control logical-shard record grew until it crossed the record-size limit and the serving shard lost its owner fence. Current main therefore treats one nokv serve process plus one exclusive durable Holt store as the safe default deployment shape. Shared publication is explicit opt-in and remains immature for long-lived use.

Also, 3d75d969... raises the source line to 0.11.0, but there is not yet a published v0.11.0 GitHub release; qualification should remain SHA-pinned rather than use an assumed release artifact.

What the three LoopX PRs actually establish

#3306 — authority prerequisite

PR #3306 closes two local authority side doors in hard_lease mode:

• todo supersede now passes through the same terminal lease fence as completion;
• bootstrap --force preserves the declared handoff mode instead of silently reverting it to legacy behavior.

This is a necessary prerequisite: a correct external provider cannot establish single authority if local terminal transitions can bypass the lease contract. I re-ran the focused handoff-mode suite at the exact PR head: 74 passed.

It does not add or qualify a NoKV provider.

#3307 — current API seam and deterministic shadow evidence

PR #3307 pins the current NoKV head and repairs two real compatibility drifts:

• LoopX durable completion now requires an explicit typed completion_continuation;
• current NoKV Python bindings map missing paths and create-only conflicts to FileNotFoundError / FileExistsError, while the old shadow adapter only handled RuntimeError.

At the exact PR head, the documented deterministic contract probe passes 9/9, and its focused pytest wrapper passes 1/1. The probe covers claim/conflict, retry, operation identity, original-result replay, ambiguous publish handling, stale generation, and fail-closed completion projection. Source inspection of current NoKV confirms the exception mapping used by the adapter.

This is useful and should replace the stale shadow evidence, but it is still an offline/reference-provider qualification plus fake-client exception coverage. The README correctly states that it is not restart, recovery, HA, or performance qualification. There is still no production NoKVCoordinationProvider in LoopX core.

#3308 — documentation truth

PR #3308 synchronizes the shared-goal RFC with shipped legacy / hard_lease behavior, explicit completion continuation, and the terminal transition gate. It is documentation-only and explicitly records that provider work has not reached production integration.

It should describe the landed state after the runtime/evidence PRs, not be treated as additional qualification evidence.

Current evidence matrix

Surface	Result	Evidence / limitation
NoKV path/generation CAS API mapping	Passed (source + offline adapter)	Current bindings expose typed not-found/conflict exceptions; #3307 updates the adapter accordingly.
Provider-neutral deterministic invariants in the shadow probe	Passed	9/9 exact-head contract cases; focused wrapper 1/1.
LoopX local hard_lease authority fence	Passed at focused-test level	#3306 focused suite: 74 passed.
Same deterministic harness against a real file-backed control and live NoKV	Unverified	#3307 is not a live two-provider parity run.
Same-host restart with the same durable Holt store	Unverified	This is the first live profile we should qualify.
Lost response / ambiguous publish followed by durable original-receipt replay	Unverified live	Modeled by the shadow probe, not yet demonstrated against live NoKV.
Provider unavailable / interrupted process / recovery	Unverified	Needs a repeatable live harness and public-safe receipts.
Cross-host/shared recovery	Blocked for promotion	Current NoKV defaults to local-only specifically because shared recovery lacks bounded checkpoint/compaction.
HA and performance	Out of scope / unverified	Must not be inferred from this compatibility pass.

Recommended bounded qualification slice

1. Land/refine in dependency order: fix(todos): close two side doors in the hard_lease handoff gate #3306 first, fix(examples): restore the nokv shadow-provider evidence against current NoKV and LoopX #3307 next, then rebase docs(rfc): sync shared-goal RFC with the shipped handoff-mode gate #3308 so the RFC reports the actual landed state. fix(examples): restore the nokv shadow-provider evidence against current NoKV and LoopX #3307 and docs(rfc): sync shared-goal RFC with the shipped handoff-mode gate #3308 both touch the RFC and should be reconciled rather than independently becoming competing status edits.
2. Keep a real file-backed provider as the control and run the same provider-neutral invariant harness against the file provider and the live NoKV candidate. Do not derive expected outcomes from the NoKV adapter.
3. Pin NoKV 3d75d969... and qualify the default local-only deployment first:
   • claim/conflict/retry/stale generation;
   • process restart using the same durable Holt store;
   • lost-response/ambiguous publish followed by exact original-receipt replay;
   • provider unavailable and recovery without creating a second LoopX authority.
4. If shared recovery is exercised, make it a separate explicit experimental profile with bounded mutation/publication counts and a manual hold. Record publication count and Control-record size; do not use it as promotion evidence until NoKV ships checkpoint/compaction.
5. Publish a compact public-safe pass/fail/unverified receipt matrix. Exclude credentials, raw service logs, private trajectories, and local paths.

Promotion should require deterministic file/NoKV parity plus a repeatable live local-only restart/replay pass. Shared recovery, cross-host failover, and HA should remain explicitly unqualified. I recommend keeping #3281 open after #3306/#3307/#3308 land and using it to track that bounded live slice.