loopx 0.4.9__tar.gz → 0.5.1__tar.gz

{loopx-0.4.9/loopx.egg-info → loopx-0.5.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: loopx
-Version: 0.4.9
+Version: 0.5.1
 Summary: A lightweight Loop Engineering control plane for long-running agent goals.
 Author: LoopX contributors
 License-Expression: Apache-2.0
@@ -18,7 +18,7 @@ Provides-Extra: deepseek-harness
 Requires-Dist: deepseek-harness-sdk>=0.1.0rc5; extra == "deepseek-harness"
 Provides-Extra: test
 Requires-Dist: jsonschema<5,>=4.23; extra == "test"
-Requires-Dist: mcp==1.27.2; extra == "test"
+Requires-Dist: mcp==1.28.1; extra == "test"
 Requires-Dist: types-jsonschema<5,>=4.23; extra == "test"
 Requires-Dist: pytest<9,>=8; extra == "test"
 Requires-Dist: pytest-cov<7,>=5; extra == "test"
@@ -66,6 +66,51 @@ to hand off across turns, tools, and agents.
 - **Getting started** - install, connect a project, and run your first governed loop. [Guide](docs/guides/getting-started.md)
 - **Docs** - the full reference and operations site. [LoopX Docs](https://huangruiteng.github.io/loopx/docs/)
 
+## Meet the Personal Agent Workspace
+
+Keep long-horizon goals in one local-first workspace. Goals, attention,
+conversations, tasks, files, schedules, and recovery stay durable across days,
+restarts, and harnesses, so work that began last week resumes exactly where
+the last bounded turn stopped instead of living in chat memory.
+
+<a href="docs/assets/personal-workspace/loopx-dashboard-launch.mp4">
+  <img src="docs/assets/personal-workspace/loopx-dashboard-tour.webp" alt="Animated tour of the LoopX personal Agent workspace, from one-command launch to Manager overview, Goal task board, protected action preview, and Goal details" width="960">
+</a>
+
+The workspace gives you one place to:
+
+- see what needs you, what is running, what is being watched, and what is
+  scheduled or stopped;
+- continue across Codex, Claude Code, direct-model, and other registered Agent
+  sessions without losing Goal state or evidence;
+- review protected changes through typed preview, explicit confirmation, and
+  receipts while LoopX state—not the browser—remains authoritative.
+
+```bash
+loopx dashboard
+```
+
+`loopx dashboard` is the supported browser/PWA launch path. For a native
+window, the experimental source-built Tauri shell reuses the same loopback
+status and Chat services without becoming another state authority:
+
+```bash
+cd apps/desktop/loopx-control-plane
+npm install
+npm run dev
+```
+
+[Read the desktop shell guide](apps/desktop/loopx-control-plane/README.md).
+Closing the window stops only the service processes that the shell started;
+existing LoopX services and durable Goal state remain intact. Both entry
+points share the same loopback services and can be started in either order:
+`loopx dashboard` reuses an already-running LoopX Chat service instead of
+starting a second one.
+
+[Watch the full 32-second walkthrough](docs/assets/personal-workspace/loopx-dashboard-launch.mp4)
+· [Read the workspace guide](docs/guides/personal-workspace-user-guide.md)
+· [Try the five-minute tour](docs/guides/personal-workspace-trial-guide.md)
+
 <a id="how-it-works"></a>
 
 ## Why LoopX
@@ -274,14 +319,16 @@ LoopX should reuse existing state rather than overwrite it. Keep `.loopx/`,
 | KunlunCode | Run `loopx-kunluncode connect --project . --goal-id <goal-id> --agent-id <registered-agent-id>`, add a bounded todo, then run `loopx-kunluncode run --project .`. | Native Goal Pro through app-server; LoopX writes completion and quota only after strict verification |
 | OpenCode | Install the static command facade; opt in to `--with-goal-bridge` for recurring goals. | OpenCode command facade and explicit goal bridge |
 | Pi | Install the opt-in goal extension with `loopx slash-commands --install --surface pi`, then use `/loopx <task>` from a trusted Pi session. | Visible Pi goal extension gated by LoopX quota (`loopx_goal_activate` + `agent_settled` continuation) |
+| DeepSeek Harness (dsh) | Install `loopx[deepseek-harness]`, prepare a dsh `cordis.yml`, then use the [dsh goal-mode adapter](loopx/dsh_goal_mode/README.md) with `loopx turn run-once`. | Headless dsh segments through LoopX Turn, each tick gated by `quota should-run` |
 | Cursor, shell, or custom runner | Use the installer and `loopx doctor`; connect manually or call LoopX from your runner. | Your shell, scheduler, or runner |
 
 The exact, copy-ready setup messages and host recovery paths live in
 [Getting Started](docs/guides/getting-started.md). Host integrations can inspect
 the [Codex App host command registry contract](docs/reference/protocols/codex-app-host-command-registry-v0.md),
 the [Codex CLI packaged install path](docs/product/runtimes/codex-cli/codex-cli-packaged-install.md),
-the [Claude Code adapter](loopx/claude_goal_mode/README.md), or the
-[KunlunCode native Goal adapter](loopx/kunluncode_goal_mode/README.md).
+the [Claude Code adapter](loopx/claude_goal_mode/README.md), the
+[KunlunCode native Goal adapter](loopx/kunluncode_goal_mode/README.md), or the
+[DeepSeek Harness turn adapter](loopx/dsh_goal_mode/README.md).
 
 For custom runners, start with the
 [minimal custom runtime example](docs/guides/minimal-custom-runtime-example.md)
@@ -370,6 +417,7 @@ evidence → recovery; continuation → governance.
 | Quota and interaction contract | Decides whether a turn should deliver, ask, wait, self-repair, or stay quiet. | `loopx quota should-run`, [quota allocation](docs/quota-allocation.md) |
 | Agent runtime bridges | Keeps Codex App, Codex CLI, Claude Code, and generic workers aligned with the same guard. | `loopx heartbeat-prompt`, `loopx codex-cli-bootstrap-message`, `loopx worker-bridge` |
 | Operator surfaces | Renders compact status without making the browser the state authority. | `loopx serve-status`, [dashboard](apps/presentation/dashboard/README.md) |
+| Session dash | Starts a live single-page panel that tracks fleet progress: sessions, their goals, and each goal's status/todo progress, with result statistics; auto-refreshes in place. | `loopx dash`, [session dash design](docs/product/surfaces/session-dash-panel-design.md) |
 | External projections | Projects todos and gates into collaboration surfaces while LoopX remains authoritative. | `loopx lark-kanban`, [Lark Kanban adapter](docs/integrations/lark-kanban-control-plane-adapter.md) |
 | Domain capabilities | Packages repeatable work lanes such as issue fixing, content operations, value connector planning, ML experiment advice, benchmark evidence, and Explore. | `loopx issue-fix`, `loopx content-ops`, `loopx value-connectors`, `loopx ml-experiment`, `loopx benchmark`, [Explore](loopx/capabilities/explore/README.md) |
 | Experimental context learning | Lets named registered agents trial provider-neutral Reward Memory through ignored, default-off project configuration. OpenViking is one provider option, not a global dependency. | `loopx reward-memory experiment-status`, [Reward Memory architecture](loopx/capabilities/reward_memory/README.md) |

{loopx-0.4.9 → loopx-0.5.1}/README.md

@@ -37,6 +37,51 @@ to hand off across turns, tools, and agents.
 - **Getting started** - install, connect a project, and run your first governed loop. [Guide](docs/guides/getting-started.md)
 - **Docs** - the full reference and operations site. [LoopX Docs](https://huangruiteng.github.io/loopx/docs/)
 
+## Meet the Personal Agent Workspace
+
+Keep long-horizon goals in one local-first workspace. Goals, attention,
+conversations, tasks, files, schedules, and recovery stay durable across days,
+restarts, and harnesses, so work that began last week resumes exactly where
+the last bounded turn stopped instead of living in chat memory.
+
+<a href="docs/assets/personal-workspace/loopx-dashboard-launch.mp4">
+  <img src="docs/assets/personal-workspace/loopx-dashboard-tour.webp" alt="Animated tour of the LoopX personal Agent workspace, from one-command launch to Manager overview, Goal task board, protected action preview, and Goal details" width="960">
+</a>
+
+The workspace gives you one place to:
+
+- see what needs you, what is running, what is being watched, and what is
+  scheduled or stopped;
+- continue across Codex, Claude Code, direct-model, and other registered Agent
+  sessions without losing Goal state or evidence;
+- review protected changes through typed preview, explicit confirmation, and
+  receipts while LoopX state—not the browser—remains authoritative.
+
+```bash
+loopx dashboard
+```
+
+`loopx dashboard` is the supported browser/PWA launch path. For a native
+window, the experimental source-built Tauri shell reuses the same loopback
+status and Chat services without becoming another state authority:
+
+```bash
+cd apps/desktop/loopx-control-plane
+npm install
+npm run dev
+```
+
+[Read the desktop shell guide](apps/desktop/loopx-control-plane/README.md).
+Closing the window stops only the service processes that the shell started;
+existing LoopX services and durable Goal state remain intact. Both entry
+points share the same loopback services and can be started in either order:
+`loopx dashboard` reuses an already-running LoopX Chat service instead of
+starting a second one.
+
+[Watch the full 32-second walkthrough](docs/assets/personal-workspace/loopx-dashboard-launch.mp4)
+· [Read the workspace guide](docs/guides/personal-workspace-user-guide.md)
+· [Try the five-minute tour](docs/guides/personal-workspace-trial-guide.md)
+
 <a id="how-it-works"></a>
 
 ## Why LoopX
@@ -245,14 +290,16 @@ LoopX should reuse existing state rather than overwrite it. Keep `.loopx/`,
 | KunlunCode | Run `loopx-kunluncode connect --project . --goal-id <goal-id> --agent-id <registered-agent-id>`, add a bounded todo, then run `loopx-kunluncode run --project .`. | Native Goal Pro through app-server; LoopX writes completion and quota only after strict verification |
 | OpenCode | Install the static command facade; opt in to `--with-goal-bridge` for recurring goals. | OpenCode command facade and explicit goal bridge |
 | Pi | Install the opt-in goal extension with `loopx slash-commands --install --surface pi`, then use `/loopx <task>` from a trusted Pi session. | Visible Pi goal extension gated by LoopX quota (`loopx_goal_activate` + `agent_settled` continuation) |
+| DeepSeek Harness (dsh) | Install `loopx[deepseek-harness]`, prepare a dsh `cordis.yml`, then use the [dsh goal-mode adapter](loopx/dsh_goal_mode/README.md) with `loopx turn run-once`. | Headless dsh segments through LoopX Turn, each tick gated by `quota should-run` |
 | Cursor, shell, or custom runner | Use the installer and `loopx doctor`; connect manually or call LoopX from your runner. | Your shell, scheduler, or runner |
 
 The exact, copy-ready setup messages and host recovery paths live in
 [Getting Started](docs/guides/getting-started.md). Host integrations can inspect
 the [Codex App host command registry contract](docs/reference/protocols/codex-app-host-command-registry-v0.md),
 the [Codex CLI packaged install path](docs/product/runtimes/codex-cli/codex-cli-packaged-install.md),
-the [Claude Code adapter](loopx/claude_goal_mode/README.md), or the
-[KunlunCode native Goal adapter](loopx/kunluncode_goal_mode/README.md).
+the [Claude Code adapter](loopx/claude_goal_mode/README.md), the
+[KunlunCode native Goal adapter](loopx/kunluncode_goal_mode/README.md), or the
+[DeepSeek Harness turn adapter](loopx/dsh_goal_mode/README.md).
 
 For custom runners, start with the
 [minimal custom runtime example](docs/guides/minimal-custom-runtime-example.md)
@@ -341,6 +388,7 @@ evidence → recovery; continuation → governance.
 | Quota and interaction contract | Decides whether a turn should deliver, ask, wait, self-repair, or stay quiet. | `loopx quota should-run`, [quota allocation](docs/quota-allocation.md) |
 | Agent runtime bridges | Keeps Codex App, Codex CLI, Claude Code, and generic workers aligned with the same guard. | `loopx heartbeat-prompt`, `loopx codex-cli-bootstrap-message`, `loopx worker-bridge` |
 | Operator surfaces | Renders compact status without making the browser the state authority. | `loopx serve-status`, [dashboard](apps/presentation/dashboard/README.md) |
+| Session dash | Starts a live single-page panel that tracks fleet progress: sessions, their goals, and each goal's status/todo progress, with result statistics; auto-refreshes in place. | `loopx dash`, [session dash design](docs/product/surfaces/session-dash-panel-design.md) |
 | External projections | Projects todos and gates into collaboration surfaces while LoopX remains authoritative. | `loopx lark-kanban`, [Lark Kanban adapter](docs/integrations/lark-kanban-control-plane-adapter.md) |
 | Domain capabilities | Packages repeatable work lanes such as issue fixing, content operations, value connector planning, ML experiment advice, benchmark evidence, and Explore. | `loopx issue-fix`, `loopx content-ops`, `loopx value-connectors`, `loopx ml-experiment`, `loopx benchmark`, [Explore](loopx/capabilities/explore/README.md) |
 | Experimental context learning | Lets named registered agents trial provider-neutral Reward Memory through ignored, default-off project configuration. OpenViking is one provider option, not a global dependency. | `loopx reward-memory experiment-status`, [Reward Memory architecture](loopx/capabilities/reward_memory/README.md) |

{loopx-0.4.9 → loopx-0.5.1}/loopx/__init__.py

@@ -2,4 +2,4 @@
 
 __all__ = ["__version__"]
 
-__version__ = "0.4.9"
+__version__ = "0.5.1"

{loopx-0.4.9 → loopx-0.5.1}/loopx/agent_onboarding.py

@@ -314,7 +314,9 @@ def _start_instruction(agent_type: str) -> str:
     if agent_type == "deepseek-harness":
         return (
             "Install `loopx[deepseek-harness]`, prepare a dsh cordis.yml, and run "
-            "`loopx turn run-once` with `scripts/dsh_turn_host_adapter.py` as the "
+            "`loopx turn run-once` with the `loopx.dsh_goal_mode` adapter "
+            "(`python -m loopx.dsh_goal_mode`; the legacy "
+            "`scripts/dsh_turn_host_adapter.py` launcher still works) as the "
             "generic-cli host adapter; every tick starts from `quota should-run`."
         )
     if agent_type == "ark-managed-agent":

{loopx-0.4.9 → loopx-0.5.1}/loopx/bootstrap.py

@@ -307,9 +307,14 @@ def onboarding_next_action(
     accept_onboarding_agent_todos: bool,
     begin_autonomous_advance: bool,
     codex_app_heartbeat: str,
+    include_connection_validation: bool = True,
 ) -> str:
     if not onboarding_scan:
-        validation_action = onboarding_connection_validation_action(adapter_kind)
+        validation_action = (
+            onboarding_connection_validation_action(adapter_kind)
+            if include_connection_validation
+            else None
+        )
         if validation_action:
             return validation_action["text"]
         return "Initial routing is owned by the connected domain adapter."
@@ -361,10 +366,15 @@ def apply_onboarding_todos_to_state(
     accept_onboarding_agent_todos: bool,
     begin_autonomous_advance: bool,
     codex_app_heartbeat: str,
+    include_connection_validation: bool = True,
 ) -> str:
     if not onboarding_scan:
         lines = text.splitlines()
-        action = onboarding_connection_validation_action(adapter_kind)
+        action = (
+            onboarding_connection_validation_action(adapter_kind)
+            if include_connection_validation
+            else None
+        )
         if action:
             add_todo_to_lines(
                 lines,
@@ -437,6 +447,7 @@ def render_state_markdown(
     accept_onboarding_agent_todos: bool = False,
     begin_autonomous_advance: bool = False,
     codex_app_heartbeat: str = "ask",
+    include_connection_validation: bool = True,
     handoff_mode: str = HANDOFF_MODE_LEGACY,
 ) -> str:
     safe_objective = objective.replace('"', '\\"')
@@ -454,6 +465,7 @@ def render_state_markdown(
         accept_onboarding_agent_todos=accept_onboarding_agent_todos,
         begin_autonomous_advance=begin_autonomous_advance,
         codex_app_heartbeat=codex_app_heartbeat,
+        include_connection_validation=include_connection_validation,
     )
     # ``handoff_mode`` travels in the state front matter (RFC shared-goal
     # authority, Appendix B). Legacy is the absent default and is never
@@ -524,6 +536,7 @@ adapter_id: {goal_id}
         accept_onboarding_agent_todos=accept_onboarding_agent_todos,
         begin_autonomous_advance=begin_autonomous_advance,
         codex_app_heartbeat=codex_app_heartbeat,
+        include_connection_validation=include_connection_validation,
     )
 
 
@@ -565,6 +578,7 @@ def build_goal_entry(
     allowed_domains: list[str],
     write_scope: list[str],
     execution_profile: dict[str, Any] | None,
+    display_name: str | None = None,
 ) -> dict[str, Any]:
     authority_sources = []
     if goal_doc:
@@ -577,6 +591,7 @@ def build_goal_entry(
         )
     return {
         "id": goal_id,
+        **({"display_name": display_name} if display_name else {}),
         "domain": domain,
         "status": "active",
         "role": role,
@@ -676,6 +691,8 @@ def bootstrap_project(
     onboarding_max_status_paths: int = 12,
     onboarding_max_top_level_files: int = 24,
     preserve_todos: bool = False,
+    display_name: str | None = None,
+    include_connection_validation: bool = True,
     force: bool,
     dry_run: bool,
     sync_global: bool,
@@ -738,6 +755,7 @@ def bootstrap_project(
         allowed_domains=allowed_domains or [],
         write_scope=write_scope or [],
         execution_profile=execution_profile,
+        display_name=display_name,
     )
     registry, registry_goal_action = merge_goal(registry, goal_entry, force=force)
 
@@ -914,6 +932,7 @@ def bootstrap_project(
                     accept_onboarding_agent_todos=accept_onboarding_agent_todos,
                     begin_autonomous_advance=begin_autonomous_advance,
                     codex_app_heartbeat=codex_app_heartbeat,
+                    include_connection_validation=include_connection_validation,
                     handoff_mode=declared_handoff_mode,
                 ),
                 encoding="utf-8",

{loopx-0.4.9 → loopx-0.5.1}/loopx/bootstrap_command_pack.py

@@ -323,7 +323,7 @@ def build_start_goal_host_surface_selection_packet(
         "pi": "Pi LoopX goal extension",
         "gemini-cli": "Gemini CLI driving its own loop through the LoopX skill facade",
         "cursor-agent": "cursor-agent driving its own loop through the LoopX skill facade and MCP server",
-        "deepseek-harness": "DeepSeek Harness automation loop through scripts/dsh_turn_host_adapter.py",
+        "deepseek-harness": "DeepSeek Harness automation loop through loopx.dsh_goal_mode (compat: scripts/dsh_turn_host_adapter.py)",
         "ark-managed-agent": "Ark Managed Agent with one-shot Goal submission",
         "shell": "manual shell or an explicitly configured external scheduler",
         "other-agent": "custom agent host using the returned activation contract",

{loopx-0.4.9 → loopx-0.5.1}/loopx/capabilities/benchmark_toolkit/README.md

@@ -5,6 +5,35 @@ artifact, integrity, and reusable agent-runtime boundaries around benchmark
 experiments. It does not own benchmark-family runners, result ledgers, or scoring
 adapters.
 
+## Source revision admission
+
+A long-running campaign can keep launching from an old installed checkout after
+the tracked branch advances. Pinning the source once at controller startup does
+not prevent that drift. Immediately before each new benchmark admission, obtain
+the current reference head through the runner's provider or network boundary,
+then compare it with the clean local checkout and intended pin:
+
+```bash
+loopx benchmark source-revision-fence \
+  --source-checkout /path/to/pinned-source \
+  --expected-revision "$PINNED_REVISION" \
+  --observed-reference-revision "$OBSERVED_REFERENCE_REVISION" \
+  --require-admitted \
+  --format json
+```
+
+The command succeeds only when all three identities match and the source root has
+no tracked or untracked changes. Its compact receipt records equality, cleanliness,
+and a stable reason code without recording the checkout path or any revision value.
+Invalid input is also reduced to a path-free fail-closed receipt.
+
+The fence is an admission boundary, not a live-run mutation mechanism. A run that
+already passed the fence keeps its immutable revision even if the reference moves
+later; the new head blocks only subsequent admissions until the runner installs and
+pins an updated source. The caller owns the freshness and authority of the observed
+reference value. This capability performs no fetch, provider API call, checkout,
+install, process launch, score write, or submission.
+
 ## Native Codex Goal runtime
 
 Benchmark adapters that use the Codex app-server Goal API should import
@@ -309,14 +338,18 @@ receipt.
 
 A countable experiment uses the toolkit in this order:
 
-1. Declare a `run_permission_policy_v0` and preflight the runner boundary.
-2. Launch one frozen case/arm; do not expose evaluator sources or official feedback.
-3. Capture ATIF tool evidence and a runner-owned runtime attestation.
-4. Run `integrity-qualification`; stop on any blocker.
-5. Run the independent verifier only after the agent phase.
-6. Reduce the official result through the benchmark-owned scoring path.
-7. Apply attempt-countability, treatment-fidelity, and matched-pair gates before any
-   comparison claim or ledger update.
+1. Read the project experiment board before selecting or launching another case.
+2. Declare a `run_permission_policy_v0` and preflight the runner boundary.
+3. Upsert the planned or running row, then launch one frozen case/arm; do not expose
+   evaluator sources or official feedback.
+4. Capture ATIF tool evidence and a runner-owned runtime attestation.
+5. Run `integrity-qualification`; stop on any blocker.
+6. Run the independent verifier only after the agent phase.
+7. Reduce the official result through the benchmark-owned scoring path.
+8. Upsert terminal score, countability, effort, treatment fidelity, and insight
+   status, then read the matched-comparison projection.
+9. Apply attempt-countability, treatment-fidelity, and matched-pair gates before any
+   comparison claim.
 
 Integrity qualification is necessary but not sufficient for a score claim. It does
 not establish task correctness, official score authority, experiment parity, or a
@@ -324,6 +357,55 @@ LoopX advantage. `score_claim_eligible=true` only permits the official score and
 matched-pair gates to run; `score_claim_countable` and `matched_pair_countable` stay
 false in this receipt. Those remain separate verifier and comparison contracts.
 
+## Experiment board
+
+The project-local experiment board keeps baseline, standard control or treatment,
+and diagnostic explore runs in one compact projection. It is not a second score
+authority and never stores raw task text, trajectories, logs, hidden evaluation,
+verifier output, credentials, or local paths.
+
+An agent using this capability should start or resume a study by reading the board:
+
+```bash
+loopx benchmark experiment-board-show \
+  --goal-id <goal-id> \
+  --format json
+```
+
+Preview and then execute an idempotent row update when a run starts or reaches a
+terminal state:
+
+```bash
+loopx benchmark experiment-board-upsert \
+  --goal-id <goal-id> \
+  --row-json <compact-row.json> \
+  --format json
+
+loopx benchmark experiment-board-upsert \
+  --goal-id <goal-id> \
+  --row-json <compact-row.json> \
+  --execute \
+  --format json
+```
+
+The default ledger is locked, atomically updated, and keyed by benchmark, study,
+case, and run identity. A compact row carries arm role, exact and comparison
+protocol ids, model, score metrics, countability, treatment fidelity, bounded
+effort, and an optional insight status or public-safe handle. Unknown fields and
+path-like references fail closed.
+
+Every non-baseline row names an exact `comparison_anchor_run_id`. Standard control
+or treatment rows anchor to a baseline. Explore rows use `diagnostic_only` claim
+scope and may anchor to the baseline or fixed standard arm they are examining.
+Matched comparisons require compatible benchmark, study, case, model, primary
+metric, comparison protocol, score countability, and treatment fidelity. Exact
+protocol revisions remain visible as a warning even when a declared comparison
+protocol says an older credible score remains semantically comparable.
+
+Full post-run analysis stays in private `benchmark_case_insight_v0` storage. The
+board records only its compact status or handle, so reading the board cannot widen
+the solving agent's evidence boundary.
+
 ## Post-run case insight monitor
 
 Benchmark startup should create one `continuous_monitor` todo. Whenever a case

{loopx-0.4.9 → loopx-0.5.1}/loopx/capabilities/benchmark_toolkit/__init__.py

@@ -15,6 +15,19 @@ from .container_binding import (
     compact_docker_container_binding_receipt,
     select_exact_docker_container,
 )
+from .experiment_board import (
+    BENCHMARK_EXPERIMENT_BOARD_LEDGER_FILENAME,
+    BENCHMARK_EXPERIMENT_BOARD_ROW_SCHEMA_VERSION,
+    BENCHMARK_EXPERIMENT_BOARD_SCHEMA_VERSION,
+    benchmark_experiment_board_row_key,
+    build_benchmark_experiment_board,
+    default_benchmark_experiment_board_path,
+    normalize_benchmark_experiment_board_row,
+    preview_benchmark_experiment_board_upsert,
+    read_benchmark_experiment_board_rows,
+    render_benchmark_experiment_board_markdown,
+    upsert_benchmark_experiment_board_row,
+)
 from .integrity import (
     BENCHMARK_INTEGRITY_POLICY_SCHEMA_VERSION,
     BENCHMARK_INTEGRITY_QUALIFICATION_SCHEMA_VERSION,
@@ -82,23 +95,37 @@ from .run_permissions import (
     compact_run_permission_policy_for_quota,
     validate_run_permission_policy,
 )
+from .source_revision_fence import (
+    BENCHMARK_SOURCE_REVISION_FENCE_SCHEMA_VERSION,
+    BenchmarkSourceRevisionFence,
+    BenchmarkSourceRevisionFenceError,
+    compact_benchmark_source_revision_fence_receipt,
+    inspect_benchmark_source_revision_fence,
+)
 
 __all__ = [
     "BENCHMARK_CANDIDATE_SOURCE_BOUNDARY_SCHEMA_VERSION",
     "BENCHMARK_EXACT_CONTAINER_BINDING_SCHEMA_VERSION",
+    "BENCHMARK_EXPERIMENT_BOARD_LEDGER_FILENAME",
+    "BENCHMARK_EXPERIMENT_BOARD_ROW_SCHEMA_VERSION",
+    "BENCHMARK_EXPERIMENT_BOARD_SCHEMA_VERSION",
     "BENCHMARK_INTEGRITY_POLICY_SCHEMA_VERSION",
     "BENCHMARK_INTEGRITY_QUALIFICATION_SCHEMA_VERSION",
     "BENCHMARK_RUNTIME_INTEGRITY_ATTESTATION_SCHEMA_VERSION",
+    "BENCHMARK_SOURCE_REVISION_FENCE_SCHEMA_VERSION",
     "DEFAULT_RUN_PERMISSION_ALLOWED_ACTIONS",
     "DEFAULT_RUN_PERMISSION_FORBIDDEN_ACTIONS",
     "INTEGRITY_EVIDENCE_CATEGORIES",
     "NATIVE_CODEX_GOAL_PROMPT_SCHEMA_VERSION",
-    "NATIVE_GOAL_LIFECYCLE_SCHEMA_VERSION",
     "NATIVE_CODEX_PROFILE_REQUIRED_SKILL_IDS",
     "NATIVE_CODEX_PROFILE_SCHEMA_VERSION",
+    "NATIVE_GOAL_LIFECYCLE_SCHEMA_VERSION",
+    "PUBLIC_TRAJECTORY_SUMMARY_SCHEMA_VERSION",
     "REQUIRED_RUNTIME_ATTESTATIONS",
     "RUN_PERMISSION_POLICY_SCHEMA_VERSION",
     "RUN_PERMISSION_QUOTA_PROJECTION_SCHEMA_VERSION",
+    "BenchmarkSourceRevisionFence",
+    "BenchmarkSourceRevisionFenceError",
     "DockerContainerBinding",
     "DockerContainerBindingError",
     "NativeCodexGoalPrompt",
@@ -108,39 +135,47 @@ __all__ = [
     "NativeCodexProfile",
     "NativeCodexProfileError",
     "NativeGoalConfig",
-    "NativeGoalLifecycleFacts",
     "NativeGoalEventTransport",
+    "NativeGoalLifecycleFacts",
     "NativeGoalProtocolError",
     "NativeGoalTransport",
     "NativeGoalTurn",
-    "RunPermissionAction",
-    "PUBLIC_TRAJECTORY_SUMMARY_SCHEMA_VERSION",
     "PublicTrajectoryLifecycleState",
     "PublicTrajectorySummaryError",
+    "RunPermissionAction",
     "StdioNativeGoalTransport",
     "attach_native_goal",
+    "benchmark_experiment_board_row_key",
     "build_benchmark_candidate_source_boundary",
+    "build_benchmark_experiment_board",
     "build_benchmark_integrity_qualification",
     "build_native_codex_isolation_envelope",
     "build_native_goal_public_trajectory_summary",
     "build_run_permission_policy",
     "classify_benchmark_artifact_path",
     "classify_benchmark_candidate_source_path",
+    "compact_benchmark_source_revision_fence_receipt",
     "compact_docker_container_binding_receipt",
     "compact_native_codex_goal_prompt_receipt",
     "compact_native_codex_profile_receipt",
     "compact_native_goal_receipt",
     "compact_run_permission_policy_for_quota",
+    "default_benchmark_experiment_board_path",
     "filter_public_benchmark_artifact_paths",
+    "inspect_benchmark_source_revision_fence",
     "inspect_native_codex_profile",
     "install_native_codex_profile",
     "materialize_public_benchmark_artifacts",
     "native_codex_app_server_environment",
     "native_codex_profile_environment",
+    "normalize_benchmark_experiment_board_row",
     "observe_native_goal_event",
+    "preview_benchmark_experiment_board_upsert",
     "probe_native_goal_process",
+    "read_benchmark_experiment_board_rows",
     "rebase_native_codex_loopx_workspace_state",
     "refresh_native_goal_status",
+    "render_benchmark_experiment_board_markdown",
     "render_native_codex_goal_prompt",
     "run_native_goal_process",
     "run_native_goal_process_until_terminal",
@@ -148,6 +183,7 @@ __all__ = [
     "run_native_goal_until_terminal",
     "select_exact_docker_container",
     "start_native_goal_turn",
+    "upsert_benchmark_experiment_board_row",
     "validate_run_permission_policy",
     "wait_native_goal_turn",
 ]