lossless-openclaw-orchestrator 1.2.0-beta.0 → 1.2.0-beta.2

package/README.md

@@ -3,9 +3,7 @@
 **LCO turns local Codex sessions into searchable, bounded, approval-aware
 work objects for OpenClaw.**
 
-Use it when an agent or user needs to answer: what sessions are active, what did
-they plan, what did they finish, what files did they touch, and what is the next
-safe action without rereading raw transcripts.
+![Enchanted open-claw conductor guiding bounded session cards and an abstract code beast in a dark technical workshop](assets/readme/hero.png)
 
 [![npm latest](https://img.shields.io/npm/v/lossless-openclaw-orchestrator/latest?label=npm%20latest)](https://www.npmjs.com/package/lossless-openclaw-orchestrator)
 [![npm beta](https://img.shields.io/npm/v/lossless-openclaw-orchestrator/beta?label=npm%20beta)](https://www.npmjs.com/package/lossless-openclaw-orchestrator)
@@ -14,6 +12,17 @@ safe action without rereading raw transcripts.
 [![License](https://img.shields.io/badge/license-PolyForm%20Noncommercial-blue)](LICENSE)
 [![PRs welcome](https://img.shields.io/badge/PRs-welcome-brightgreen)](CONTRIBUTING.md)
 
+Use it when an agent or user needs to answer: what sessions are active, what did
+they plan, what did they finish, what files did they touch, and what is the next
+safe action without rereading raw transcripts.
+
+| What LCO gives agents | Why it matters |
+| --- | --- |
+| Searchable local session memory | Find plans, finals, touched files, and refs without raw transcript rereads. |
+| Bounded evidence expansion | Read compact public-safe briefs before opening larger source material. |
+| Approval-gated control | Dry-run Codex actions and verify matching audit ids before live control. |
+| OpenClaw/MCP tools | Use the same local-first recall and control surfaces from agent workflows. |
+
 [Setup](docs/SETUP.md) · [Contributing](CONTRIBUTING.md) · [Agent Instructions](AGENTS.md) · [Agent Skill](skills/lossless-openclaw-orchestrator/SKILL.md) · [OpenClaw Plugin](docs/OPENCLAW_PLUGIN.md) · [Security](SECURITY.md) · [Code of Conduct](CODE_OF_CONDUCT.md) · [Vision](VISION.md) · [Privacy](docs/PRIVACY.md) · [Claude Boundary](docs/CLAUDE_ADAPTER_BOUNDARY.md) · [Claim Audit](docs/CLAIM_AUDIT.md) · [Release Notes](docs/RELEASE_NOTES_1.2.0-beta.0.md) · [1.1.4 Notes](docs/RELEASE_NOTES_1.1.4.md) · [1.0 Notes](docs/RELEASE_NOTES_1.0.0.md) · [License](LICENSE)
 
 ## Why It Matters
@@ -113,6 +122,10 @@ loo doctor
 loo onboard status --strict
 ```
 
+If agents will author PRs, issue comments, or closeouts in the repo, also copy
+the provenance snippets from [docs/SETUP.md](docs/SETUP.md#agent-provenance-setup)
+into the repo's `AGENTS.md` and `CLAUDE.md` files.
+
 ## First Workflow
 
 Search for a session:
@@ -139,16 +152,25 @@ Expand from a query when you do not know the ref yet:
 loo expand-query --profile brief --token-budget 1000 "billing bridge"
 ```
 
-For normal agent workflows, use the MCP/OpenClaw tools:
-
-- `loo_search_sessions`
-- `loo_describe_session`
-- `loo_expand_session`
-- `loo_codex_plans`
-- `loo_codex_final_messages`
-- `loo_codex_touched_files`
-- `loo_codex_control_dry_run`
-- `loo_codex_start_thread`
+For normal agent workflows, start with the compact public/operator facade
+instead of treating every `loo_*` tool as a peer:
+
+| Step | Tool | Purpose |
+| --- | --- | --- |
+| 1 | `loo_prepared_inbox` | Start from the compact prepared-state operating picture. |
+| 2 | `loo_describe_ref` | Look up a specific session or source ref from the inbox. |
+| 3 | `loo_expand_query` | Expand one bounded evidence brief when the ref is not known. |
+| 4 | `loo_recent_sessions` | Refresh recent or active cards after reads or approved actions. |
+| 5 | `loo_attention_inbox` | Review the compact attention queue before choosing a next action. |
+| 6 | `loo_project_digest` | Produce a bounded provenance and handoff digest. |
+| 7 | `loo_codex_control_dry_run` | Create the exact dry-run action packet and approval hashes. |
+| 8 | `loo_codex_resume_thread` | Run an approved resume only after the matching audit id. |
+
+Other declared tools remain available as `workflow_detail`, `proof_debug`, or
+`internal_low_level` surfaces for setup, diagnosis, proof, and recovery. Their
+existence is deliberate: normal agents should start from the facade, then drop
+to the lower tiers only when the compact path returns a specific next step or
+blocker.
 
 `loo_codex_control_dry_run` returns the audit id and hashes an agent should show
 before any live start/resume/send/steer/interrupt call. Live control requires
@@ -163,6 +185,13 @@ before claiming the turn or thread completed, persisted, or is safe to build on.
 The packaged agent playbook is
 [skills/lossless-openclaw-orchestrator/SKILL.md](skills/lossless-openclaw-orchestrator/SKILL.md).
 
+Naming policy: `LCO` is the public product abbreviation and `lco_*` is the
+forward public alias target for new user-facing tool names. The currently
+callable OpenClaw/MCP tools still use the historical `loo_*` runtime prefix, so
+examples that must run today continue to show `loo_*` until #434 lands a tested
+alias layer. Do not delete or silently rename the `loo_*` tools; keep them as
+backward-compatible aliases when `lco_*` aliases are added.
+
 ## OpenClaw And MCP
 
 Run the MCP server directly:
@@ -214,6 +243,9 @@ Default behavior:
 - bounded expansion profiles
 - read-only OpenClaw LCM peer DB access
 - direct Codex protocol before desktop fallback
+- CUA Driver as the preferred/default desktop fallback backend when desktop
+  fallback is needed; CUA is externally installed, not bundled by LCO, and
+  Peekaboo remains a secondary visible fallback
 - dry-run plus matching `approval_audit_id` before live Codex control,
   including new-thread creation
 - explicit mutation classes: pure reads use empty `mutationClasses`, and
@@ -236,6 +268,13 @@ storage and control paths are proven. Desktop fallback surfaces report
 readiness, blockers, and proof states; they do not authorize prompt typing,
 clicking, refresh/restart automation, or arbitrary app control.
 
+Desktop fallback readiness is optional for normal read/search/describe
+workflows. Operators who need fallback control should install CUA Driver
+separately, verify the launch entrypoint with `cua-driver mcp --help`, then use
+`loo doctor --json` or `loo desktop see cua-driver` only for LCO readiness and
+blocker reporting. Treat missing CUA as a desktop-fallback readiness blocker
+rather than a package install failure.
+
 Claude adapter proof boundaries live in
 [docs/CLAUDE_ADAPTER_BOUNDARY.md](docs/CLAUDE_ADAPTER_BOUNDARY.md). Public
 claim details live in [docs/CLAIM_AUDIT.md](docs/CLAIM_AUDIT.md).
@@ -301,6 +340,10 @@ OpenClaw/Eva agent can start from compact prepared state rather than rereading
 huge Codex transcripts. Summary leaves are advisory
 routing/evidence cards over prepared ranges; they are not authority, hidden
 autonomy, GUI mutation, Claude parity, or true Codex compaction-summary capture.
+When a specific Codex thread id is requested, prepared-state status reports
+thread-level `targetCoverage` with opaque source refs, freshness, coverage, and
+reason codes such as `source_present_not_indexed` instead of hiding a miss
+behind healthy global cache counts.
 The hook sidecar CLI lives under `loo hook closeout-capture`,
 `loo hook state-prep`, and `loo hook compaction-capture --mode marker`; those
 commands write only LCO-owned derived cache and treat transcript paths as

package/VISION.md

@@ -24,7 +24,7 @@ The current target is:
 - Keep prepared state as advisory cache: cards, inbox items, and summary leaves route an agent to source refs; they do not become authority for PR/CI/release/runtime/customer truth.
 - Classify mutations explicitly: pure reads use empty `mutationClasses`, LCO-owned indexing/audit/prepared-state writes use `mode: "local_cache_write"` with `derived_cache`, and source-store, external-system, live-control, GUI, release, and npm mutations stay non-default.
 - Add source ranges and summary leaves as an additive DB layer behind the existing search/describe/expand tools instead of rewriting the current session-level DB in one migration. Source ranges are the first 1.2 proof slice; summary leaves sit on top as metadata-only routing/evidence cards with bounded DAG expansion.
-- Treat Codex compaction hooks outside Codex as marker capture only. True compaction-summary capture waits for Codex-native sanitized summary support.
+- Treat Codex compaction hooks outside Codex as marker capture only. True compaction-summary capture waits for Codex-native sanitized summary support. The proposal is [docs/CODEX_NATIVE_COMPACTION_CAPTURE.md](docs/CODEX_NATIVE_COMPACTION_CAPTURE.md) and its dry-run claim-audit contract is `codex-native-compaction-capture-proposal-v1`.
 - Keep model compaction opt-in and behind a later spike. It must not receive raw transcripts or current `safe_text` by default.
 - Keep README, VISION, release notes, and scorecards current so completed release gates are recorded as completed proof, not active work.
 - Treat #307/#308 as completed proof for Desktop-visible classification and fallback readiness/status, not as proof of Codex GUI mutation, prompt typing, clicking, refresh/restart automation, or unattended visible collaboration.
@@ -50,6 +50,12 @@ What 1.2 should let a local OpenClaw agent do next:
 What a local OpenClaw agent can do today:
 
 - Discover the installed LCO plugin and declared `loo_*` tools.
+- Start from the compact public facade (`loo_prepared_inbox`,
+  `loo_describe_ref`, `loo_expand_query`, `loo_recent_sessions`,
+  `loo_attention_inbox`, `loo_project_digest`, `loo_codex_control_dry_run`,
+  and approval-gated `loo_codex_resume_thread`) instead of treating every
+  declared tool as an equal first step. Expert/debug tools remain explicit for
+  detail, proof, and recovery.
 - Index and search local Codex sessions without reading raw transcripts.
 - Describe a session using metadata, source refs, status fields, plans, finals, touched files, and safe summaries.
 - Expand a selected session or query with bounded metadata, brief, or evidence profiles.
@@ -100,7 +106,10 @@ The 1.2 prepared-state layer is the next leverage step for this mode. It should
 store local, deterministic, public-safe prepared cards and summary leaves so an
 agent can operate from compact source-ref-backed state rather than repeatedly
 searching and expanding the same large threads. Summary leaves route the agent
-to the right source range; they do not replace authoritative sources.
+to the right source range; they do not replace authoritative sources. Targeted
+prepared-state reads must distinguish global cache health from a requested
+thread's own coverage, including `source_present_not_indexed` style gaps when
+the indexed source exists but prepared rows need refresh.
 
 Features should be prioritized by the `orchestrator-leverage-prioritization.json` scorecard when they change roadmap order. High-priority work gives the agent more session-management leverage per token: thread metadata, closeout hooks, project/status/priority tagging, archive and fork workflows, cited bounded expansion, and hybrid search when it improves top-k retrieval quality. Lower-priority work can still matter, but should wait when it makes the product more visually complete without reducing the orchestrator's rereading burden.
 
@@ -173,6 +182,7 @@ Versioned scorecards live under `evals/scorecards/v1.0/`. Use them as the shared
 - `orchestrator-leverage-prioritization.json`
 - `packaging-install-review.json`
 - `public-claim-review.json`
+- `tool-facade-usability-review.json`
 - `local-agent-usability-review.json`
 - `local-mac-search-ui-review.json`
 - `working-app-runtime-proof-review.json`
@@ -208,6 +218,7 @@ For implementation issues, copy `evals/scorecards/v1.0/issue-scorecard-update-te
 | Public claims | README/docs/release notes stay inside allowed beta wording | claim audit result |
 | Privacy | Evidence contains no raw session files, SQLite DBs, screenshots, tokens, or secrets | artifact scan result |
 | Source authority | Operating-picture tools distinguish source availability from source ownership | `authorityCoverage`, degraded unavailable-source cards, source-authority profile |
+| Tool facade usability | Agent starts from the 8-tool public facade, then drops to workflow/proof/debug tiers only when the facade returns a reason | `tool-facade-usability-review.json` score movement |
 | Cockpit card presentation | Agent-facing cards separate clean presentation text from source evidence and downgrade unclean extraction | `presentation_cleaned`, `presentation_low_confidence`, public-safe canary tests |
 
 ## Eval Scenarios
@@ -253,6 +264,7 @@ Core eval scenarios:
 - Prove the Milestone 7 working-app runtime path from `evals/scenarios/v1.1`: installed gateway, approved live Codex action, post-action refresh, and safe agent reasoning.
 - Prove `runtime-desktop-visibility-status-v1-1` when a release claim needs one compact lane-level Desktop visibility status report, while keeping actual GUI mutation and unattended collaboration out of scope.
 - Keep Claude Code behind the inventory in [docs/CLAUDE_ADAPTER_BOUNDARY.md](docs/CLAUDE_ADAPTER_BOUNDARY.md): the first adapter proof step is read-only session inventory, not control or parity.
+- Run `codex-native-compaction-capture-proposal-v1` when auditing the future Codex-native compaction packet: outside-Codex markers stay on `compaction observed`, while sanitized `CompactionCaptured` or enriched `PostCompact` packets may only create advisory summary leaves with refs and omissions.
 
 ## Adversarial Milestone Sweeps
 

package/dist/packages/adapters/src/index.js

@@ -272,15 +272,31 @@ function liveProofState(input) {
         threadId: proofThreadId,
         ...(turnId ? { turnId } : {}),
         ...(responseStatus ? { responseStatus } : {}),
-        ...(acceptedByTransport && !persisted && proofThreadId !== "new_thread" ? { nextProof: {
-                tool: "loo_codex_app_server_threads",
-                execute: false,
-                args: { read_thread_id: proofThreadId, limit: 20 },
-                reason: "Bounded read-only follow-up proof is required before treating transport acceptance as durable Codex execution or persistence.",
-                stopConditions: ["execute_false_only", "raw_transcript_not_read", "do_not_claim_completed_or_persisted_until_durable_read"]
-            } } : {}),
+        ...(acceptedByTransport && !persisted && proofThreadId !== "new_thread" ? {
+            nextProof: input.method === "thread/start"
+                ? {
+                    tool: "loo_codex_start_thread_post_create_proof",
+                    execute: false,
+                    args: {
+                        created_thread_id: proofThreadId,
+                        created_thread_ref: `codex_thread:${proofThreadId}`,
+                        limit: 20
+                    },
+                    reason: "Run the bounded read-only post-create proof before treating transport acceptance as durable Codex thread creation or persistence.",
+                    stopConditions: ["execute_false_only", "raw_transcript_not_read", "do_not_claim_created_or_persisted_until_post_create_proof"]
+                }
+                : {
+                    tool: "loo_codex_app_server_threads",
+                    execute: false,
+                    args: { read_thread_id: proofThreadId, limit: 20 },
+                    reason: "Bounded read-only follow-up proof is required before treating transport acceptance as durable Codex execution or persistence.",
+                    stopConditions: ["execute_false_only", "raw_transcript_not_read", "do_not_claim_completed_or_persisted_until_durable_read"]
+                }
+        } : {}),
         callerInstruction: acceptedByTransport
-            ? "Transport acceptance is not durable execution. Run the bounded follow-up proof before claiming the turn or thread completed, persisted, or is safe to build on."
+            ? input.method === "thread/start"
+                ? "Transport acceptance is not durable thread creation. Run the bounded post-create proof before claiming the new thread completed, persisted, or is safe to build on."
+                : "Transport acceptance is not durable execution. Run the bounded follow-up proof before claiming the turn or thread completed, persisted, or is safe to build on."
             : "Codex transport did not accept the control request. Do not retry live control without a fresh dry-run and approval.",
         proofBoundary: "This proof state is public-safe transport/output classification only. It does not read raw transcripts, prove durable local-session persistence, mutate the GUI, or claim completed orchestration without follow-up evidence."
     };
@@ -401,8 +417,9 @@ export async function createCodexAppServerThreadsReport(options) {
     let readProbe;
     let readProbeOk;
     if (options.readThreadId) {
-        const threadId = capTextValue(options.readThreadId, 160);
-        const read = await codexReadRequest(options.client, "thread/read", { threadId, includeTurns: false });
+        const requestedThreadId = options.readThreadId;
+        const threadId = capTextValue(requestedThreadId, 160);
+        const read = await codexReadRequest(options.client, "thread/read", { threadId: requestedThreadId, includeTurns: false });
         readProbeOk = read.ok;
         if (!read.ok) {
             if (read.error)
@@ -1594,6 +1611,7 @@ const threadStatusLabels = [
     "Failed",
     "Error"
 ];
+const threadStatusLabelSet = new Set(threadStatusLabels.map((label) => label.toLowerCase()));
 const threadSectionLabels = new Set(["pinned", "projects", "chats", "recent", "show more"]);
 const threadControlLabels = new Set(["archive chat", "automation folders", "automations", "unarchive chat", "pin chat", "unpin chat", "continue", "copy", "copy message", "new chat", "new thread", "search", "settings", "send", "plugins"]);
 const threadControlPrefixLabels = ["archive chat", "automation folders", "automations", "pin chat", "unarchive chat", "unpin chat"];
@@ -1643,11 +1661,17 @@ function visibleWindowsFromSnapshot(snapshot) {
 function visibleThreadMapFromSnapshot(snapshot) {
     const threads = [];
     const seen = new Set();
+    const consumedChildElementIds = new Set();
+    const consumedChildFingerprints = new Set();
+    const acceptedElementFingerprints = new Set();
     let currentProject;
     let inProjects = false;
     for (const element of snapshot.elements) {
         if (threads.length >= snapshot.maxNodes)
             break;
+        const elementFingerprint = sidebarChildFingerprint(element);
+        if (consumedChildElementIds.has(element.elementId) || (elementFingerprint && consumedChildFingerprints.has(elementFingerprint)))
+            continue;
         const rawLabel = element.label?.trim();
         if (!rawLabel || !isThreadCandidateRole(element.role))
             continue;
@@ -1660,23 +1684,36 @@ function visibleThreadMapFromSnapshot(snapshot) {
             currentProject = capTextValue(rawLabel, 160);
             continue;
         }
-        if (isThreadControlLabel(lowered))
+        const childCandidate = isThreadControlLabel(lowered)
+            ? sidebarThreadCandidateFromChildText(snapshot.elements, element)
+            : null;
+        if (isThreadControlLabel(lowered) && !childCandidate)
+            continue;
+        if (childCandidate?.titleElementFingerprint && acceptedElementFingerprints.has(childCandidate.titleElementFingerprint))
             continue;
-        const split = splitThreadTitleStatus(rawLabel);
+        const split = childCandidate?.split ?? splitThreadTitleStatus(rawLabel);
         if (!split.title || isThreadControlLabel(split.title.toLowerCase()))
             continue;
+        if (!isVisibleSidebarCandidateTitle({ title: split.title, rawLabel, element, childCandidate: Boolean(childCandidate), split }))
+            continue;
         if (split.title.length < 3 || ["codex", "vantage"].includes(split.title.toLowerCase()))
             continue;
         const visibleId = visibleThreadId({ index: threads.length, title: split.title, sourceElementId: element.elementId });
         if (seen.has(visibleId))
             continue;
         seen.add(visibleId);
+        for (const childId of childCandidate?.consumedElementIds ?? [])
+            consumedChildElementIds.add(childId);
+        for (const childFingerprint of childCandidate?.consumedElementFingerprints ?? [])
+            consumedChildFingerprints.add(childFingerprint);
+        if (elementFingerprint)
+            acceptedElementFingerprints.add(elementFingerprint);
         const center = centerFromBounds(element.bounds);
         threads.push({
             visibleId,
             index: threads.length,
             title: split.title,
-            rawTitle: capTextValue(rawLabel, 200),
+            rawTitle: capTextValue(childCandidate?.rawLabel ?? rawLabel, 200),
             project: currentProject,
             status: split.status,
             updatedLabel: split.updatedLabel,
@@ -1698,6 +1735,62 @@ function visibleThreadMapFromSnapshot(snapshot) {
         warnings: snapshot.truncated ? ["Snapshot was truncated before thread-map extraction; rerun with a larger bounded max_nodes value if more visible rows are needed."] : []
     };
 }
+function sidebarThreadCandidateFromChildText(elements, row) {
+    if (!row.bounds)
+        return null;
+    const children = elements
+        .filter((element) => element.elementId !== row.elementId && element.label && isStaticThreadRole(element.role) && rectContains(row.bounds, element.bounds))
+        .sort((left, right) => (left.bounds?.y ?? 0) - (right.bounds?.y ?? 0) || (left.bounds?.x ?? 0) - (right.bounds?.x ?? 0));
+    if (!children.length)
+        return null;
+    const updatedLabel = children.map((child) => child.label?.trim()).find((label) => Boolean(label && threadTimePattern.test(label)))
+        ?? splitThreadTitleStatus(row.label ?? "").updatedLabel;
+    const titleChild = children.find((child) => looksLikeSidebarThreadTitle(child.label ?? ""));
+    const title = titleChild?.label?.trim();
+    if (!title)
+        return null;
+    const rawLabel = [title, updatedLabel].filter(Boolean).join(" ");
+    return {
+        split: splitThreadTitleStatus(rawLabel),
+        rawLabel,
+        consumedElementIds: children.map((child) => stableElementId(child)).filter((id) => Boolean(id)),
+        consumedElementFingerprints: children.map(sidebarChildFingerprint).filter((fingerprint) => Boolean(fingerprint)),
+        titleElementFingerprint: sidebarChildFingerprint(titleChild)
+    };
+}
+function looksLikeSidebarThreadTitle(label) {
+    const trimmed = label.trim();
+    if (!trimmed || trimmed.length < 3)
+        return false;
+    const lowered = trimmed.toLowerCase();
+    if (threadSectionLabels.has(lowered) || isThreadControlLabel(lowered) || threadTimePattern.test(lowered) || threadStatusLabelSet.has(lowered))
+        return false;
+    return !/[\\/]/.test(trimmed) && !trimmed.includes("<redacted-");
+}
+function isVisibleSidebarCandidateTitle({ title, rawLabel, element, childCandidate, split }) {
+    if (looksLikeSidebarThreadTitle(title))
+        return true;
+    if (childCandidate || isStaticThreadRole(element.role))
+        return false;
+    if (!title.includes("<redacted-"))
+        return false;
+    const rawSplit = splitThreadTitleStatus(rawLabel);
+    return Boolean(split.status || split.updatedLabel || rawSplit.status || rawSplit.updatedLabel);
+}
+function stableElementId(element) {
+    const id = element.elementId.trim();
+    return id && id !== "unknown" ? id : undefined;
+}
+function sidebarChildFingerprint(element) {
+    if (!element?.bounds || !element.label)
+        return undefined;
+    const label = element.label.trim();
+    if (!label)
+        return undefined;
+    const role = (element.role || "").trim().toLowerCase();
+    const { x, y, width, height } = element.bounds;
+    return `${role}:${label}:${x}:${y}:${width}:${height}`;
+}
 function isCodexSnapshot(snapshot) {
     const app = (snapshot.frontmostApp || "").trim().toLowerCase();
     return app === "codex" || app === "codex desktop";
@@ -1756,6 +1849,14 @@ function centerFromBounds(bounds) {
         return undefined;
     return { x: Math.trunc(bounds.x + bounds.width / 2), y: Math.trunc(bounds.y + bounds.height / 2) };
 }
+function rectContains(parent, child) {
+    if (!parent || !child)
+        return false;
+    return child.x >= parent.x
+        && child.y >= parent.y
+        && child.x + child.width <= parent.x + parent.width
+        && child.y + child.height <= parent.y + parent.height;
+}
 function threadConfidence(input) {
     let score = 0;
     if (input.center)

package/dist/packages/adapters/src/policy.js

@@ -128,6 +128,7 @@ export const LOO_COMMAND_POLICY = {
     loo_resume_request_packet: readOnly("structured_operating_inputs"),
     loo_codex_app_server_status: readOnly("codex_direct"),
     loo_codex_app_server_threads: readOnly("codex_direct"),
+    loo_codex_start_thread_post_create_proof: readOnly("codex_direct"),
     loo_visible_codex_map: readOnly("structured_operating_inputs"),
     loo_codex_desktop_coherence: readOnly("structured_operating_inputs"),
     loo_codex_desktop_fallback_status: readOnly("desktop_fallback"),

package/dist/packages/cli/src/openclaw-tool-smoke.js

@@ -118,7 +118,7 @@ export function runOpenClawToolSmoke(options = {}) {
                 confirm: false,
                 idempotencyKey: `loo-tool-smoke-${runId}-${toolName}`
             }, gatewayCallOptions);
-            const summary = summarizeInvocation(toolName, call);
+            const summary = summarizeInvocation(toolName, call, args ?? {});
             annotateRequestedExpansionProfile(summary, args);
             invocations.push(summary);
             blockers.push(...summary.blockers);
@@ -176,10 +176,18 @@ function buildAgentReasoning(invocations, blockers) {
     const byTool = new Map(invocations.map((invocation) => [invocation.toolName, invocation]));
     const search = byTool.get("loo_search_sessions");
     const describe = byTool.get("loo_describe_session");
-    const expand = byTool.get("loo_expand_query") ?? byTool.get("loo_expand_session");
+    const preparedCards = byTool.get("loo_prepared_cards");
+    const preparedInbox = byTool.get("loo_prepared_inbox");
+    const summaryExpand = byTool.get("loo_summary_expand");
+    const expand = summaryExpand ?? byTool.get("loo_expand_query") ?? byTool.get("loo_expand_session");
     const dryRun = byTool.get("loo_codex_control_dry_run");
-    const sourceRefs = [...new Set(invocations.flatMap((invocation) => invocation.summary.sourceRefs ?? []))].slice(0, 5);
-    const selectedThreadId = describe?.summary.threadId || search?.summary.threadId || dryRun?.summary.threadId;
+    const sourceRefs = prioritizedReasoningSourceRefs(invocations, byTool).slice(0, 5);
+    const selectedThreadId = preparedInbox?.summary.threadId
+        || preparedCards?.summary.threadId
+        || summaryExpand?.summary.threadId
+        || describe?.summary.threadId
+        || search?.summary.threadId
+        || dryRun?.summary.threadId;
     const workflowEvidence = [
         ...(byTool.get("loo_doctor")?.ok ? ["doctor_ready"] : []),
         ...(sourceRefs.length ? ["search_source_ref"] : []),
@@ -188,6 +196,11 @@ function buildAgentReasoning(invocations, blockers) {
         ...(byTool.get("loo_codex_plans")?.ok ? ["plan_lookup"] : []),
         ...(byTool.get("loo_codex_final_messages")?.ok ? ["final_message_lookup"] : []),
         ...(byTool.get("loo_codex_touched_files")?.ok ? ["touched_files_lookup"] : []),
+        ...(byTool.get("loo_prepared_state_status")?.ok ? ["prepared_state_status"] : []),
+        ...(byTool.get("loo_prepared_cards")?.ok ? ["prepared_cards"] : []),
+        ...(byTool.get("loo_prepared_inbox")?.ok ? ["prepared_inbox"] : []),
+        ...(byTool.get("loo_summary_leaves")?.ok ? ["summary_leaf_lookup"] : []),
+        ...(byTool.get("loo_summary_expand")?.ok ? ["summary_expand"] : []),
         ...(dryRun?.summary.approvalAuditId && dryRun.summary.live === false ? ["dry_run_audit"] : [])
     ];
     if (!selectedThreadId || sourceRefs.length === 0 || !workflowEvidence.includes("bounded_expand"))
@@ -206,6 +219,24 @@ function buildAgentReasoning(invocations, blockers) {
         rawTranscriptRead: false
     };
 }
+function prioritizedReasoningSourceRefs(invocations, byTool) {
+    const refs = [];
+    const seen = new Set();
+    const addRefs = (invocation) => {
+        for (const ref of invocation?.summary.sourceRefs ?? []) {
+            if (seen.has(ref))
+                continue;
+            seen.add(ref);
+            refs.push(ref);
+        }
+    };
+    for (const toolName of ["loo_prepared_inbox", "loo_prepared_cards", "loo_summary_expand", "loo_summary_leaves"]) {
+        addRefs(byTool.get(toolName));
+    }
+    for (const invocation of invocations)
+        addRefs(invocation);
+    return refs;
+}
 function annotateRequestedExpansionProfile(summary, args) {
     if (summary.toolName !== "loo_expand_query" && summary.toolName !== "loo_expand_session")
         return;
@@ -509,8 +540,11 @@ function buildToolArgs(params) {
             token_budget: Math.min(params.tokenBudget, 1000)
         };
     }
-    if (params.toolName === "loo_prepared_state_status")
-        return {};
+    if (params.toolName === "loo_prepared_state_status") {
+        return {
+            ...(params.threadId ? { thread_id: params.threadId } : {})
+        };
+    }
     if (params.toolName === "loo_prepared_cards" || params.toolName === "loo_prepared_inbox") {
         return {
             ...(params.threadId ? { thread_id: params.threadId } : {}),
@@ -725,7 +759,7 @@ function smokeCodexDesktopCollaborationProofReport(threadId) {
         }
     };
 }
-function summarizeInvocation(toolName, call) {
+function summarizeInvocation(toolName, call, requestArgs = {}) {
     const payload = call.parsed ? unwrapGatewayPayload(call.parsed) : undefined;
     const blockers = [
         ...gatewayFailureBlockers(call, `openclaw_tool_invoke_failed:${toolName}`, toolName),
@@ -1108,6 +1142,57 @@ function summarizeInvocation(toolName, call) {
         }
         if (!isRecord(statusOutput) || !isRecord(statusOutput.sourceCoverage))
             blockers.push("prepared_state_status_coverage_missing");
+        const targetedThreadId = stringPath(requestArgs, ["thread_id"]);
+        if (targetedThreadId && (!isRecord(statusOutput) || statusOutput.targetCoverage === undefined)) {
+            blockers.push("prepared_state_status_target_coverage_missing");
+        }
+        if (isRecord(statusOutput) && statusOutput.targetCoverage !== undefined) {
+            const targetCoverage = statusOutput.targetCoverage;
+            if (!isRecord(targetCoverage))
+                blockers.push("prepared_state_status_target_coverage_invalid");
+            else {
+                if (stringPath(targetCoverage, ["schema"]) !== "lco.prepared.targetCoverage.v1")
+                    blockers.push("prepared_state_status_target_coverage_schema_invalid");
+                const targetSourceCoverage = isRecord(targetCoverage.sourceCoverage) ? targetCoverage.sourceCoverage : null;
+                const targetCounts = isRecord(targetCoverage.counts) ? targetCoverage.counts : null;
+                const targetFreshness = isRecord(targetCoverage.freshness) ? targetCoverage.freshness : null;
+                const reasonCodes = arrayPath(targetCoverage, ["reasonCodes"]);
+                const validLayerStatuses = new Set(["ok", "partial", "not_configured", "unknown"]);
+                const requiredCoverageKeys = ["indexedSession", "sourceFile", "preparedSourceEvents", "preparedSourceRanges", "summaryLeaves", "preparedCards", "preparedInboxItems", "watcherObservations"];
+                const requiredCountKeys = ["preparedSourceEvents", "preparedSourceRanges", "summaryLeaves", "preparedCards", "preparedInboxItems"];
+                if (!targetSourceCoverage)
+                    blockers.push("prepared_state_status_target_source_coverage_missing");
+                else if (requiredCoverageKeys.some((key) => !validLayerStatuses.has(String(targetSourceCoverage[key] ?? "")))) {
+                    blockers.push("prepared_state_status_target_source_coverage_invalid");
+                }
+                if (!targetCounts || requiredCountKeys.some((key) => {
+                    const value = targetCounts[key];
+                    return typeof value !== "number" || !Number.isFinite(value) || value < 0;
+                }))
+                    blockers.push("prepared_state_status_target_coverage_details_missing");
+                if (!targetFreshness || booleanPath(targetCoverage, ["freshness", "stale"]) === undefined) {
+                    blockers.push("prepared_state_status_target_coverage_details_missing");
+                }
+                if (!reasonCodes.length || reasonCodes.some((code) => typeof code !== "string" || !code)) {
+                    blockers.push("prepared_state_status_target_coverage_details_missing");
+                }
+                if (!stringPath(targetCoverage, ["nextAction"]))
+                    blockers.push("prepared_state_status_target_coverage_details_missing");
+                if (!arrayPath(targetCoverage, ["sourceRefs"]).length)
+                    blockers.push("prepared_state_status_target_coverage_details_missing");
+                if (targetedThreadId) {
+                    const targetThreadId = stringPath(targetCoverage, ["threadId"]) || stringPath(targetCoverage, ["thread_id"]);
+                    const targetRef = stringPath(targetCoverage, ["targetRef"]) || stringPath(targetCoverage, ["target_ref"]);
+                    if (targetThreadId !== targetedThreadId || targetRef !== `codex_thread:${targetedThreadId}`) {
+                        blockers.push("prepared_state_status_target_coverage_mismatch");
+                    }
+                }
+                const targetStatus = stringPath(targetCoverage, ["status"]);
+                if (!["ready", "source_present_not_indexed", "not_found", "partial", "unknown"].includes(targetStatus ?? "")) {
+                    blockers.push("prepared_state_status_target_status_invalid");
+                }
+            }
+        }
         if (!hasPreparedReadOnlyActionMarkers(statusOutput))
             blockers.push("prepared_state_status_action_markers_invalid");
     }

package/dist/packages/cli/src/scorecard-sweep.js

@@ -13,6 +13,7 @@ const REQUIRED_SCORECARD_NAMES = [
     "public-claim-review",
     "retrieval-quality-review",
     "safety-bypass-review",
+    "tool-facade-usability-review",
     "working-app-runtime-proof-review"
 ];
 const REQUIRED_SCORECARD_FIELDS = [