perf(goal-channel): defer repository audit on refresh writeback

[huangruiteng]

Problem and result

When an opted-in Goal Channel checks for a human gate after refresh-state, it rebuilt status with the default repository-wide public-boundary scan. On a large checkout this audit can dominate writeback even when no gate is selected. The notification read now uses the established operational-status mode; explicit loopx check and premerge still run the repository audit. The Lark opt-in, quota gate decision, message safety, and delivery readback remain in place.

A read-only long-history diagnostic measured this status read at about 120 seconds with the repository scan and 2.9 seconds without it. These are local diagnostic times for this stage, not an end-to-end latency claim. The roadmap now separates operational reads from publication audits and calls for stage-by-stage measurement of refresh-state and quota spend-slot before further optimization.

Validation and limits

• 20 focused Goal Channel lifecycle/CLI tests passed; Lark human-gate delivery smoke passed.
• Status/quota performance smoke passed, including explicit public-boundary scan and malformed-state checks. Ruff and diff hygiene passed.
• Change-quality receipt verified for the exact three-file diff. Premerge selected 12 checks: 11 passed; semantic-vocabulary-drift-smoke.py failed on the current main baseline (44 maintained Python/TypeScript twins, budget 43). refactor(quota): keep blocked retry validation in settlement owner #5030 addresses this baseline; rerun premerge after it lands.
• An exploratory mypy run is not passing evidence: the repository currently reports thousands of cross-module type errors. No typecheck pass is claimed.

This changes the post-refresh notification's handling of an unrelated repository publication violation: it no longer suppresses an otherwise valid human-gate notice. The notice still requires explicit Goal Channel authorization and uses its existing public-safe message projection. No general quota/status CLI scan policy changes here. The related refactor pass found the existing status flag sufficient; no new cache or authority path was added.

[huangruiteng]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

Exact head: 6d9800a. This review is not merge authorization.

动机

已启用的飞书 Goal 人工关卡在每次 refresh 写回后，为取得 Goal 和配额状态又执行一次全仓公开边界扫描。这个发布审计不是通知决策的必需输入，在长历史仓库中反复增加收尾耗时，影响后续持续工作。

改动思路

只在原有“自动通知启用且外部发送已授权”的分支，复用 collect_status 已有的 include_public_boundary_scan 参数，让运行时读状态跳过发布审计。Goal、配额、绑定、发送和读回仍由原路径判断；显式 loopx check 与 premerge 仍保留公开扫描。没有增加缓存、权威账本或发送权限。

具体改动

• sync_human_gate_after_refresh 在已授权分支传入 include_public_boundary_scan=False，随后仍由 build_quota_should_run 和 auto_notify_lark_goal_channel_gate 决定是否发送以及读回。关闭自动通知或未获外部发送授权时不会进入这次状态读取。
• 单测固定这一调用参数；我在 exact head 独立重跑 20 项聚焦测试、飞书关卡交付 smoke、状态/配额性能 smoke，全部通过。对三个变更文件执行 loopx check，公开边界扫描完成且零错误。
• 语义词汇预算 smoke 在不可变 merge base 和 exact head 上用同一命令均失败，签名同为“44 independently maintained py/ts twins; budget is 43”。改动没有触及该扫描器或计数契约，属于已有基线失败；它不构成本 PR 的 review 阻断，但合并门禁仍要单独判定，不能由这个批准结论替代。

正向路径是获授权 Goal 刷新后读取当前状态、判断关卡并执行原有发送读回；反向路径是绑定、扩展或发送授权不满足时仍不发送。较快的运行时读取不能冒充发布资格，发布审计须显式运行。

对主干的风险

主要权衡是这条热路径不再顺带发现仓库其他文件的公开边界违规；通知本身仍由既有目标绑定、授权和公开安全消息投影限定，显式检查仍承担发布边界。这里没有独立测量长历史下完整 refresh 的端到端耗时，也按本 Goal 配置未等待远端 CI。若以后通知直接引入原始仓库材料，需要重新验证定向净化边界。预算红测的修复与合并资格由维护者另外处理。

我的整体评价

一处可回退的重复扫描移除，改动局限在现有调用点，保留关卡决策与发送后条件；聚焦测试、真实交付 smoke 和明确的公开扫描覆盖了主要反例。未发现由本 PR 引入的阻断问题，给出批准结论。相邻重构已由复用现有状态参数实现，没有必要再加新的扫描策略层。

English verdict: APPROVE - 6d9800a; no PR-caused blocker found, while the identical base/head vocabulary-budget failure and merge readiness remain separate.