[Task][RFC]: Complete external-evidence research through real providers and user readback

[huangruiteng]

Outcome / 目标

完成外部证据研究的真实 provider 与用户回读。One task tracks this RFC's delivery; keep implementation PRs and milestone evidence here instead of creating a parallel task tree.

Canonical design: RFC. Roadmap: S6/S8, under #4574. Design acceptance is distinct from implementation, live qualification and promotion.

Current boundary

Source audit: main at ce3862e33 (2026-09-28). This is source/PR inspection, not a new test or live-qualification claim.

#4813 shipped discover/plan/receipt/admit/retire through a typed TS owner and CLI. The RFC explicitly distinguishes observing a caller-presented receipt from proving provider execution, and names frontend/Lark as companion work.

Work remaining

• Reuse the exact-plan lifecycle with one existing research method and one supported connector where needed; retain their own execution/permission owners.
• Expose the same plan, source provenance, parent admission, downstream use and retirement facts in the affected product entrypoints.

Ownership and ongoing work

Coordinate with capability Portfolio and current App research delivery. This issue completes this RFC’s evidence lifecycle; it does not create a browser, connector registry, new scheduler or another evidence authority.

Contribution route: available for a bounded proposal/PR within this RFC. Name the intended milestone and exact files in a claim comment so simultaneous contributors do not duplicate work.

Acceptance

• Inventory-only or stale providers cannot be selected as ready; plan/receipt/admission mutation is rejected.
• Partial, empty and failed evidence preserve the caller’s original-source fallback; admission and downstream coverage are independently shown.
• Demonstrate a real authorized provider path and actual CLI/UI readback without automatic evidence acceptance or raw-content leakage.
• Reconcile the RFC's current delivery checkpoint and this issue with the integrated revision, commands, passed/failed/untested evidence and remaining gates. Close the accepted scope only; no claim that a merged PR alone completes the RFC.

Starting points and delivery boundary

• loopx/control_plane/capabilities/external_evidence.ts
• loopx/cli_commands
• apps/presentation/dashboard

Base: latest main. Reuse the existing typed owner and provider boundaries. Include affected CLI/frontend/Lark companions; verify real entrypoints and backend where changed. Preserve existing first-screen review and maintainer merge gates. Public artifacts contain only synthetic/public-safe evidence, no private operational state. This task does not authorize provider promotion, benchmark launches, release/deployment or unrelated protected effects.