How LoopX Derives Domain Lane Projections from Kernel State Without Duplicating Authority

LoopX prevents authority duplication by forcing all domain lanes—such as Issue Fix—to operate as read-only projections of the Kernel’s durable state, while the Kernel retains exclusive rights to accept and commit typed transition proposals.

LoopX is an open-source control-plane framework designed around strict separation of concerns. In the huangruiteng/loopx repository, domain lane projections like Issue Fix are not standalone state containers but derived observations from the Kernel’s authoritative layers. This architectural pattern ensures that while capabilities can visualize and propose changes to work items, only the Kernel can mutate the underlying registry, goal-state, and todo lifecycle.

The Kernel as Exclusive Authority

The LoopX architecture defines four distinct runtime responsibilities that enforce single-authority governance. According to docs/architecture.md, the LoopX Kernel is the sole component that owns durable state-change authority, including goals, todos, claims, gates, monitors, quotas, and final write-back operations.

• Agent: Owns planning, analysis, tool use, and one bounded execution. Must not own durable goal lifecycle or unscoped effect authority.
• Provider: Owns external calls, bounded observations, and effect results. Must not own domain transition policy or LoopX todo state.
• Capability: Owns caller-facing outcome contract, domain policy, validation, and typed transition proposals. Must not own durable scheduling, claims, gates, or direct lifecycle writes.
• LoopX Kernel: Owns goal, todo, claim, gate, monitor, quota, accepted write-back, recovery, and scheduling. Must not own domain-specific reasoning or provider implementation details.

This responsibility model guarantees that Agents, Providers, and Capabilities never hold unscoped effect authority. When a capability needs to display an Issue Fix lane, it does not create a parallel state tree; instead, it consumes a projection—a read-only view derived from the Kernel’s durable layers including the registry, run-log, run-history, and status queues.

Projections vs. Authority in LoopX

A projection in LoopX is explicitly defined as an observation (F[B]) of the current state, not a copy of it. As documented in docs/architecture.md, "The read model is the current state … The projection is the observation." Domain lanes are therefore derived views constructed without adding labels to the Kernel lifecycle itself.

The Kernel exposes these projections through its durable state layers:

• Registry and goal-state
• Run-log and run-history
• Status/attention queues
• Compute quotas

When the Issue Fix capability renders a Kanban board, it reads from these layers via a status projection—a read-only dictionary passed through the intake surface. The capability cannot write directly to these layers; it can only validate the projection and prepare a typed transition proposal for Kernel review.

Constructing the Issue Fix Lane

The derivation of an Issue Fix lane follows a strict four-phase pipeline that preserves the Kernel’s exclusive commit rights.

Capability Definition

First, the capability declares its view requirements in loopx/extensions/lark/presentation/issue_fix_surface.py. This module defines the schemas and view names (grid, kanban, metrics) that the Kernel will populate.

# loopx/extensions/lark/presentation/issue_fix_surface.py

def issue_fix_views() -> list[dict[str, str]]:
    return [
        {"name": DEFAULT_ISSUE_FIX_GRID_VIEW, "type": "grid"},
        {"name": DEFAULT_ISSUE_FIX_KANBAN_VIEW, "type": "kanban"},
        {"name": DEFAULT_ISSUE_FIX_METRICS_VIEW, "type": "grid"},
    ]

Projection Assembly

During execution, the Kernel generates a status projection containing current todos, claims, and quota data. The Issue Fix capability consumes this via loopx/capabilities/issue_fix/intake_surface.py, where the render_content_ops_issue_fix_intake_markdown function validates the payload and renders markdown cards without mutating source data.

# loopx/capabilities/issue_fix/intake_surface.py

def render_content_ops_issue_fix_intake_markdown(payload: dict[str, Any]) -> str:
    # payload is a read-only projection from the Kernel

    # ... render markdown for the Issue Fix lane ...

    return "\n".join(lines) + "\n"

Typed Transition Proposals

After validation, the capability constructs a governed transition proposal in loopx/capabilities/issue_fix/feasibility.py. This proposal specifies the desired state change—such as transitioning from fix_in_progress to ci_pending—but explicitly carries a kernel_context flag to indicate that the Kernel must execute the commit.

# loopx/capabilities/issue_fix/feasibility.py

def propose_fix_transition(state: dict) -> dict:
    # Build a typed proposal; the Kernel will own the commit

    return {
        "kind": "governed_transition_proposal",
        "kernel_context": True,
        "transition": {"stage": "fix_in_progress"},
    }

Kernel Commit

Finally, loopx/control_plane/work_items/governed_transition_proposal.py enforces that only the Kernel can accept and apply proposals. The apply_proposal function validates the kernel_context flag, checks quotas and gates, and performs the authoritative write-back.

# loopx/control_plane/work_items/governed_transition_proposal.py

def apply_proposal(proposal: dict) -> None:
    if not proposal.get("kernel_context"):
        raise ValueError("governed transition proposals require Kernel context")
    # perform quota, gate, write-back…

Why Authority Is Never Duplicated

Three architectural mechanisms prevent authority duplication across domain lanes:

Single Source of Truth: The Kernel’s durable layers (registry, goal-state, run-history) are the only mutable stores. Projections are generated on-the-fly from these sources and are immutable by design.

Explicit Responsibility Boundaries: The architecture enforced in docs/architecture.md states that "Domain state, evidence, and receipts are artifacts exchanged between responsibilities, not additional runtime owners." This means capabilities possess zero durable scheduling or lifecycle write authority.

Typed Contract Enforcement: Capabilities declare the data shapes they consume and the transition types they propose, but the Kernel validates these contracts against current quotas and gates before committing. The proposal pattern ensures the capability asks for change rather than effecting it.

Consequently, the Issue Fix lane remains a pure projection—a function of Kernel state—while the Kernel retains exclusive gatekeeper status over all state transitions.

Summary

• Domain lane projections in LoopX are read-only views derived from the Kernel’s durable state layers, not independent state containers.
• The Kernel is the sole authority capable of mutating goals, todos, claims, and gates; all other components operate on projections.
• Capabilities consume projections via intake surfaces like intake_surface.py to render views such as Issue Fix Kanban boards.
• State changes occur only through typed transition proposals submitted to governed_transition_proposal.py, where the Kernel validates and commits changes.
• This architecture eliminates authority duplication by enforcing strict runtime responsibilities and single-source-of-truth governance.

Frequently Asked Questions

What defines a domain lane projection in LoopX?

A domain lane projection is a read-only observation of the Kernel’s current state, constructed from durable layers such as the registry, goal-state, and run-history. It functions as a view model for capabilities like Issue Fix without holding any mutable authority, ensuring that domain logic never duplicates the Kernel’s state ownership.

Why can't capabilities write state directly in LoopX?

Capabilities are explicitly restricted from durable lifecycle writes according to the runtime responsibility model defined in docs/architecture.md. They own caller-facing contracts and validation logic but must route all state changes through the Kernel via governed transition proposals. This restriction prevents distributed state conflicts and ensures centralized quota, gate, and recovery management.

How does the LoopX Kernel validate transition proposals?

The Kernel validates proposals through governed_transition_proposal.py, which checks for the required kernel_context flag, verifies current compute quotas, and evaluates gate conditions before executing write-back operations. Only proposals passing these checks are committed to the durable state layers.

What happens if a capability uses a stale projection?

Since projections are point-in-time observations generated per-turn, capabilities always receive the latest committed state from the Kernel. If a proposal is built against a stale view, the Kernel’s validation layer will reject it due to quota or state mismatches during the commit phase, forcing the capability to retry with a fresh projection.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}