fix(ci): complete RFC metadata and stop disposable profile runtime

[huangruiteng]

Pre-publication full-public CI found incomplete RFC metadata and an installed-profile smoke that could remove its temporary tree while its managed runtime was still writing. Complete the existing bilingual RFC lifecycle/mirror/index contract, preserving the design note’s deferred delivery boundary, and stop only the disposable installed profile’s runtime through the existing doctor command before directory teardown.

Validation: documentation governance, actual formal profile installation and Codex app-server readback, nine runtime-restart tests, Ruff, whitespace and public-boundary checks pass. The cleanup runs on success and failure via ExitStack and rejects incomplete shutdown; it neither suppresses assertions nor changes runtime, benchmark scoring or model execution. Final merged-source release qualification follows separately.

[huangruiteng]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

Reviewed exact head 5224@84641418ba393ec6dc2d90ef3bd65cdc090aea3c.

动机

1.2.2 的全量公开 CI 发现两项实际失败：保留的 Goal 连续性设计记录没有 canonical RFC 状态、替代声明及完整语言镜像标记，目录也未收录；正式安装 profile 验证结束后，TypeScript runtime 仍可能写入临时 profile，目录清理因此失败。维护者已授权本次发行所需修复。

改动思路

复用已有 RFC 生命周期合同：合入的设计记录按既有规则为 Accepted，同时用 Delivery maturity 明确它仍是延后的非规范性记录，不新增运行时验收或权限；README 只记录交付边界，STATUS 继续由原生成器产生。测试复用既有 doctor 的停止 owner，用 ExitStack 在临时目录删除前收尾自己的正式安装 profile，避免增加后台进程管理器或按 PID 批量杀进程。

具体改动

完整差异为六个文件、46 行增加和 9 行删除：双语记录补齐 canonical 状态、替代声明与语义镜像，README 增加对应入口，两个 STATUS 文件重新生成；既有安装 smoke 增加私有 teardown helper 和 ExitStack callback。callback 在 profile 初始化后注册，在成功及异常退出时均先执行，用该 profile 的 HOME、安装源与 CLI 调用 installation-only doctor --restart-runtime，只接受 stopped 或 not_running。安装验收、provider 环境边界、技能目录和 Goal 读回的原断言全部保留；实际 Codex app-server 验证通过，没有启动 model turn。现有完整 docs governance、9 个 runtime restart 正负向测试、Ruff、公开边界、精确差异质量通过，全部 19 项风险预合入检查通过。路径分类器保留一个 benchmark-sensitive 人工评审门禁；本篇精确 head 评审已核对只改临时 fixture 收尾，没有 benchmark adapter、scoring、runner 或证据语义变更，维护者已有本次发行修复与合并授权。

对主干的风险

最大的 teardown 风险是错停共享 runtime 或把未完成停止伪装为成功；当前 callback 通过私有安装 profile 的 canonical fingerprint 和 HOME 绑定同一个 fixture owner，pending 等结果仍拒绝，ExitStack 不吞掉错误。元数据 Accepted 只表示已入库可认领的设计记录，正文及 Delivery maturity 保留尚未实现的组合链路、既有 owner 和无新 runtime contract 的边界。没有更改测试预算、模型执行、benchmark scoring、生产 runtime 或首屏内容。原始 CI 失败和修复结果分开保留，最终合入源码仍需重新资格验证。

我的整体评价

当前精确 head 可以批准，修复覆盖了阻塞发行的两个真实缺口。相邻边界检查采用已有文档生成器与 runtime restart，不新增机制；这个 smoke 持续保护实际正式安装、host 技能读回及后台资源收尾，属于可保留的公共行为验证。剩余完整 CI、真实模型与公开下载验收由当前发行继续执行，不因局部验证而宣称 release 完成。

English verdict: APPROVE

[huangruiteng]

Parallel-profile qualification addendum to the review above: the serial formal-profile readback did not establish exclusive runtime ownership. Subsequent full-public parallel CI demonstrated that equal-source profiles could share the system-temp content-addressed runtime locator, despite private HOME/CODEX_HOME. #5226 corrects this in both existing profile environment builders by using each private HOME as the temporary scope, and adds an actual two-installed-profile test: stopping one leaves the other running. The existing callback and stopped/not_running checks remain necessary; no teardown error or CI budget is suppressed. Final merged-source release qualification remains required.