<!-- task=m-iop-hot-path-one-shot-execution/21+20_hot_smoke_actual plan=4 tag=REVIEW_REVIEW_REVIEW_TEST milestone-task=hot-smoke -->

# Code Review Reference - REVIEW_REVIEW_REVIEW_TEST

> **[IMPLEMENTING AGENT — READ FIRST] Filling in this file is the mandatory final step of implementation.**
> The task is NOT complete until every implementation-owned section below is filled in.
> Complete the `Implementation Checklist`; the final checklist item is mandatory before saving.
> Fill implementation-owned sections, then stop with active files in place and report ready for review.
> Execute the plan's selected root cause, scope, files, and dependency decisions as written. Do not choose another owner, narrow/expand the write boundary, or replace a fix with another verification attempt.
> If implementation is blocked, record the exact blocker, attempted commands/output, and resume condition only in implementation-owned evidence fields.
> Do not ask the user directly, present choices, call user-input tools, create control-plane stop files, or classify the next state.
> Finalization (`Code Review Result`, log rename, `complete.log`, archive moves, `Review-Only Checklist`) is review-agent-only, even after compaction/resume.
> Follow the ownership table at the bottom of this file for which sections you own.

## Overview

date=2026-08-05
task=m-iop-hot-path-one-shot-execution/21+20_hot_smoke_actual, plan=4, tag=REVIEW_REVIEW_REVIEW_TEST

## Archive Evidence Snapshot

- The reviewed pair is archived at `agent-task/m-iop-hot-path-one-shot-execution/21+20_hot_smoke_actual/plan_cloud_G09_3.log` and `agent-task/m-iop-hot-path-one-shot-execution/21+20_hot_smoke_actual/code_review_cloud_G09_3.log` with verdict `FAIL`, `review_rework_count=3`, and `evidence_integrity_failure=true`.
- Required R2: the harness requires `orphan=ttl_expired` within 10 seconds, while production uses a 30-minute default TTL and sweeps only at later preset ingress.
- Required R4: installed Pi JSON mode can emit a final assistant `stopReason=error` and return exit 0; the current derivation rejects that native combination while its fake exits 1.
- Required R3: external verification stopped at the first missing `IOP_HOT_SMOKE_BASE_URL` presence check, so no actual Claude/Pi 10-case manifest exists.
- Fresh reviewer checks passed shell syntax, the fake-only harness self-test, the exact four-package race command, and `git diff --check`; a focused Pi probe returned `pi_native_error_exit0_rejected=true` and `pi_fake_error_exit1_accepted=true`.
- Roadmap scope remains `milestone-task=hot-smoke`; no Milestone completion is claimed.

## For the Review Agent

> **[REVIEW AGENT ONLY]** The finalization steps below are review-agent only. Implementing agents must not execute this section.

Compare implementation of each item against source files and verify that output in `Verification Results` matches code.
Review completion means the following steps are finished:

1. Append verdict and `review_rework_count` / `evidence_integrity_failure` routing signals.
2. Archive `CODE_REVIEW-cloud-G08.md` → `code_review_cloud_G08_4.log` and `PLAN-cloud-G08.md` → `plan_cloud_G08_4.log`.
3. If PASS, write `complete.log` and move active task directory to `agent-task/archive/YYYY/MM/m-iop-hot-path-one-shot-execution/21+20_hot_smoke_actual/`. If WARN/FAIL, fully write the next filesystem state required by the code-review skill.
4. If PASS and task group is `m-<milestone-slug>`, preserve the first-line `milestone-task` metadata in `complete.log` and report it for the runtime aggregation event. Roadmap state evaluation belongs to `sync-milestone-workstate`.
5. Check applicable `Review-Only Checklist` items at the final `.log` location before reporting.

---

## Implementation Item Completion

| Item | Status |
|------|---------|
| REVIEW_REVIEW_REVIEW_TEST-1 Production cancellation observation closure | [x] |
| REVIEW_REVIEW_REVIEW_TEST-2 Native Pi JSON error reconciliation | [x] |
| REVIEW_REVIEW_REVIEW_TEST-3 Matching-runtime S16 evidence | [x] |

## Implementation Checklist

- [x] [REVIEW_REVIEW_REVIEW_TEST-1] Align timeout/cancel observation closure and fake traces with the production Edge caller-cancel/TTL timing contract, including positive and immediate-orphan negative controls.
- [x] [REVIEW_REVIEW_REVIEW_TEST-2] Reconcile Pi protocol errors with JSON-mode exit 0, update every derivation call site and fake, and add native-error/process-contradiction regression controls.
- [x] [REVIEW_REVIEW_REVIEW_TEST-3] Run local/common verification and the exact external matching-runtime preflight/matrix, recording the actual manifest or the first exact blocker without an S16 completion claim.
- [x] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

## Review-Only Checklist

> **[REVIEW AGENT ONLY]** This checklist is used only by the review agent.
> Implementing agents must not modify or check this section.

- [x] Append one verdict of `PASS`, `WARN`, or `FAIL` and verified `review_rework_count`, `evidence_integrity_failure` to `Code Review Result`.
- [x] Verify that verdict, `Dimension Assessment`, and Required/Suggested/Nit classifications match.
- [x] Archive active `CODE_REVIEW-*-G??.md` to `code_review_cloud_G08_4.log`.
- [x] Archive active `PLAN-*-G??.md` to `plan_cloud_G08_4.log`.
- [x] Verify that the Agent-Ops managed block in `.gitignore` unignores `agent-task/**/*.md` and `agent-task/**/*.log` and ignores `agent-roadmap/current.md`.
- [ ] If PASS, write `complete.log` based on `agent-ops/skills/common/code-review/templates/complete-log-template.md` and leave no active `.md` files.
- [ ] If PASS, move active task directory `agent-task/m-iop-hot-path-one-shot-execution/21+20_hot_smoke_actual/` to `agent-task/archive/YYYY/MM/m-iop-hot-path-one-shot-execution/21+20_hot_smoke_actual/` and update this checklist at the final archive path.
- [ ] If PASS and task group is `m-<milestone-slug>`, preserve and report `milestone-task` metadata for runtime aggregation, without modifying roadmap or directly calling `update-roadmap`.
- [ ] If PASS for split work, remove empty active parent `agent-task/m-iop-hot-path-one-shot-execution/` or verify it was kept due to remaining siblings/files.
- [x] If WARN/FAIL, write the next filesystem state matching code-review verdict and do not write `complete.log`.

## Deviations from Plan

None. The external sequence stopped at its first required presence check, exactly as specified by the plan.

## Key Design Decisions

- Timeout/cancel observation now closes on the final local caller-cancel or timeout stage and explicitly rejects an immediate TTL-expired orphan. Public cleanup=orphan remains derived from the child-only signal, sentinel survival, and surviving workspace artifact.
- derive_case_result receives the agent identity at both call sites. Only Pi accepts a native terminal error with JSON-mode exit 0; Claude errors still require a nonzero exit, and unknown agents fail closed.
- The fake Pi write-unavailable case now follows the installed JSON-mode behavior by emitting its native error lifecycle and exiting 0.

## Reviewer Checkpoints

- Verify timeout/cancel observation closes on the immediate production local cancellation stage and no longer depends on a 30-minute ingress-triggered orphan event.
- Verify public orphan classification still requires harness-owned child-only cancellation, sentinel survival, and a surviving reserved workspace artifact.
- Verify fake cancellation omits the synthetic immediate TTL orphan and the self-test rejects such an orphan in the same observation window.
- Verify Pi `agent_end` error plus JSON-mode exit 0 is accepted only for Pi, while Claude errors and success/nonzero contradictions remain fail closed.
- Verify both `derive_case_result` call sites and all self-test helper arguments use the same agent-aware contract.
- Verify actual S16 evidence is a matching-runtime Claude/Pi 10-case manifest; fake self-test or an external blocker cannot PASS.
- Preserve unrelated dirty-worktree changes and the `milestone-task=hot-smoke` boundary.

## Verification Results

> Paste actual stdout/stderr and exit status for every command. If a planned command changes, record the replacement and reason in `Deviations from Plan`. Do not summarize or reconstruct output.

### Production cancellation and Pi regression

Commands:

```bash
bash -n scripts/e2e-hot-path-agents.sh
TMPDIR=/config/workspace/iop-s0 make test-hot-path-agent-smoke-self-test
```

Expected: both exit 0. Self-test output explicitly proves production-shaped caller cancellation is accepted, an immediate TTL orphan is rejected, Pi native error with JSON exit 0 is accepted, and terminal/process contradictions are rejected.

Actual stdout/stderr:

    bash -n scripts/e2e-hot-path-agents.sh
    stdout/stderr: (no output)
    exit status: 0

    TMPDIR=/config/workspace/iop-s0 make test-hot-path-agent-smoke-self-test
    ./scripts/e2e-hot-path-agents.sh --self-test
    [e2e-hot-path-agents] assertion PASS: positive do_run exits 0
    [e2e-hot-path-agents] assertion PASS: produced manifest validates against supplied fixture
    [e2e-hot-path-agents] assertion PASS: native Pi JSON error with exit 0 accepted
    [e2e-hot-path-agents] assertion PASS: Pi terminal error with exit 0 derivation accepted
    [e2e-hot-path-agents] assertion PASS: Pi success terminal with nonzero exit rejected
    [e2e-hot-path-agents] assertion PASS: timeout-cancel cleanup=orphan
    [e2e-hot-path-agents] assertion PASS: immediate TTL orphan after caller cancellation rejected rejected before manifest output
    [e2e-hot-path-agents] assertion PASS: success terminal with nonzero exit rejected rejected before manifest output
    [e2e-hot-path-agents] self-test PASSED: exact argv, fixed 2x5 matrix, schema rejection,
    [e2e-hot-path-agents]   runtime/profile/alias binding mismatch exit 69 before invocation,
    [e2e-hot-path-agents]   production retry lifecycle closure and negative observation controls,
    [e2e-hot-path-agents]   native Pi success/error/cancel plus tool order, empty-reservation
    [e2e-hot-path-agents]   rejection, secret absence, child-only cancellation, cleanup/orphan
    [e2e-hot-path-agents]   classification, and full cleanup verified with fake agents/runtime only.
    exit status: 0

### Common Go regression

Command:

```bash
go test -race -count=1 ./packages/go/streamgate ./packages/go/config ./apps/edge/internal/openai ./apps/edge/internal/service
```

Expected: exit 0 for all four packages; fresh execution is required.

Actual stdout/stderr:

    ok  iop/packages/go/streamgate  2.247s
    ok  iop/packages/go/config  1.835s
    ok  iop/apps/edge/internal/openai  15.808s
    ok  iop/apps/edge/internal/service  7.232s
    exit status: 0

### External matching-runtime preflight and matrix

Run presence-only checks without printing values:

```bash
test -n "${IOP_HOT_SMOKE_BASE_URL:-}"
test -n "${IOP_HOT_SMOKE_DIRECT_MODEL:-}" && test -n "${IOP_HOT_SMOKE_PASS_MODEL:-}"
test -n "${IOP_HOT_SMOKE_REPAIR_MODEL:-}" && test -n "${IOP_HOT_SMOKE_SLOW_MODEL:-}"
test -n "${IOP_HOT_SMOKE_CLAUDE_BIN:-}" && test -x "$IOP_HOT_SMOKE_CLAUDE_BIN"
test -n "${IOP_HOT_SMOKE_PI_BIN:-}" && test -x "$IOP_HOT_SMOKE_PI_BIN"
test -n "${PI_CODING_AGENT_DIR:-}" && test -d "$PI_CODING_AGENT_DIR"
test -n "${IOP_HOT_SMOKE_PI_PROVIDER:-}"
test -n "${IOP_HOT_SMOKE_EDGE_BIN:-}" && test -x "$IOP_HOT_SMOKE_EDGE_BIN"
test -n "${IOP_HOT_SMOKE_EDGE_CONFIG:-}" && test -f "$IOP_HOT_SMOKE_EDGE_CONFIG"
test -n "${IOP_HOT_SMOKE_RUNTIME_EVIDENCE:-}" && test -f "$IOP_HOT_SMOKE_RUNTIME_EVIDENCE"
test -n "${IOP_HOT_SMOKE_OBSERVATION_FILE:-}" && test -f "$IOP_HOT_SMOKE_OBSERVATION_FILE"
test -n "${IOP_HOT_SMOKE_WORKSPACE_PARENT:-}" && test -d "$IOP_HOT_SMOKE_WORKSPACE_PARENT"
test -n "${IOP_HOT_SMOKE_OUTPUT:-}"
test -n "${IOP_HOT_SMOKE_CLAUDE_SECRET_ENV:-}" && test -n "${!IOP_HOT_SMOKE_CLAUDE_SECRET_ENV:-}"
test -n "${IOP_HOT_SMOKE_PI_SECRET_ENV:-}" && test -n "${!IOP_HOT_SMOKE_PI_SECRET_ENV:-}"
make test-hot-path-agent-smoke-preflight
make test-hot-path-agent-smoke
jq -e '
  .schema_version == "1"
  and ([.cases[].id] == ["claude:direct","claude:light-pass","claude:repair","claude:write-unavailable","claude:timeout-cancel","pi:direct","pi:light-pass","pi:repair","pi:write-unavailable","pi:timeout-cancel"])
  and ([.cases[].outcome] == ["completed","completed","completed","error","cancelled","completed","completed","completed","error","cancelled"])
  and all(.cases[]; (.visible_events | length) > 0 and (.observation | length) > 0)
  and all(.cases[] | select(.scenario == "light-pass" or .scenario == "repair"); any(.visible_events[]; .kind == "tool_use"))
  and (.redaction.matches == 0)
' "$IOP_HOT_SMOKE_OUTPUT"
```

Expected: every command exits 0 against the matching isolated runtime. If blocked, paste the first exact failed command/output, runner identity, missing input name, commands not run, and resume condition; explicitly state that S16 remains incomplete.

First exact blocker:

    runner=200eb9b30a43
    workspace=/config/workspace/iop-s0
    branch=feature/iop-hot-path-one-shot-execution
    head=703f3b723202959185c04bb32c2c68383b8d04a0

    test -n "${IOP_HOT_SMOKE_BASE_URL:-}"
    stdout/stderr: (no output)
    exit status: 1

Missing input: IOP_HOT_SMOKE_BASE_URL. Commands not run: all remaining presence checks, make test-hot-path-agent-smoke-preflight, make test-hot-path-agent-smoke, and the final manifest jq assertion. Resume by selecting or starting the matching isolated Edge runtime, exporting every caller-selected input without printing values, regenerating the exact runtime evidence, then rerunning the complete presence block, preflight, 2x5 matrix, and final assertion. S16 remains incomplete.

### Diff

Command:

```bash
git diff --check
```

Expected: exit 0 with no output.

Actual stdout/stderr:

    git diff --check
    stdout/stderr: (no output)
    exit status: 0

---

> **[IMPLEMENTING AGENT — BEFORE SAVING] Have you filled in every implementation-owned section?**
> If anything is blank, go back and fill it in before saving this file.
> Leave review-agent-only sections unchanged.

## Section Ownership

| Section | Owner | Note |
|---------|-------|------|
| Header comment, Overview, Review Agent Instructions | Fixed at stub creation | Implementing agent must not modify or execute these (archive, complete.log, and task-directory archive move are review-agent only) |
| Archive Evidence Snapshot | Fixed at stub creation from plan when present | Implementing agent uses it as default prior-loop context; read only the specific archive files cited there when more detail is required |
| Implementation Item Completion (item names) | Fixed at stub creation | Implementing agent checks `[ ]` → `[x]` only |
| Implementation Checklist (item text/order) | Fixed at stub creation from plan | Implementing agent checks `[ ]` → `[x]` only |
| Review-Only Checklist | Review agent only | Implementing agent must not modify or check this section |
| Deviations from Plan, Key Design Decisions | Implementing agent | Replace placeholder text with actual content |
| Reviewer Checkpoints | Fixed at stub creation | Pre-filled from plan |
| Verification Results (section headings + commands) | Fixed at stub creation | Implementing agent fills in command output only; command changes require a `Deviations from Plan` entry |
| Code Review Result | Review agent appends | Not included in stub |

## Code Review Result

- Overall Verdict: FAIL
- Dimension Assessment:
  - Correctness: Pass — the production-shaped caller-cancel closure, immediate-orphan rejection, agent-aware Pi error derivation, and both derivation call sites agree with the reviewed runtime boundaries and pass fresh deterministic verification.
  - Completeness: Fail — the required SDD S16 matching-runtime Claude/Pi 10-case matrix was not run and no schema-valid actual manifest exists.
  - Test Coverage: Fail — local fake/runtime controls are comprehensive, but they do not replace the required actual Claude/Pi streaming, observation, workspace, cleanup/orphan, and terminal evidence.
  - API Contract: Pass — timeout/cancel no longer depends on a 30-minute ingress-triggered TTL sweep, and Pi JSON-mode protocol errors now reconcile with process exit 0 without weakening Claude or success-terminal checks.
  - Code Quality: Pass — the changes are bounded to the harness contract, preserve fail-closed derivation, and add focused positive and contradiction controls without unrelated source changes.
  - Implementation Deviation: Pass — the implementation followed the plan and recorded the first exact external blocker without claiming S16 completion.
  - Verification Trust: Fail — fresh local commands pass, but the required external preflight, 2x5 matrix, and manifest assertion remain unexecuted because every caller-selected runtime input is absent.
  - Spec Conformance: Fail — `hot-smoke` requires the actual Claude/Pi evidence defined by SDD S16, which fake-only evidence cannot satisfy.
- Findings:
  - Required R3 — `agent-task/m-iop-hot-path-one-shot-execution/21+20_hot_smoke_actual/CODE_REVIEW-cloud-G08.md:157` and `agent-roadmap/sdd/knowledge-tool-optimization-extension/iop-hot-path-one-shot-execution/SDD.md:193`: the first presence check still fails because `IOP_HOT_SMOKE_BASE_URL` is absent, all 17 caller-selected inputs are currently missing, and no repository-declared authorized runner can select the matching isolated Edge runtime or its credentials. Consequently `make test-hot-path-agent-smoke-preflight`, the actual Claude/Pi 2x5 matrix, and the final manifest assertion were not run. Prepare or authorize the matching isolated runtime, export the complete input set without exposing values, regenerate runtime evidence for the exact worktree and binaries/config/profile, run the full external block, and provide the schema-valid manifest with fixed ids/outcomes, native visible events, fresh observation/workspace evidence, and zero redaction matches.
- Routing Signals: `review_rework_count=4`, `evidence_integrity_failure=true`
- Next Step: Archive the current pair and create an `external-execution` `USER_REVIEW.md` for the matching isolated Edge runtime. Do not write `complete.log`, create another unchanged-precondition follow-up pair, or update the roadmap.
