<!-- task=m-iop-agent-cli-runtime/13_agent_domain plan=2 tag=REVIEW_API -->

# Correct the Agent Application Ownership Boundary

## For the Implementing Agent

Filling implementation-owned sections in `CODE_REVIEW-cloud-G04.md` is mandatory. Run every verification command, paste actual notes and output, leave the active pair in place, and report ready for review. Finalization belongs only to the code-review skill. If blocked, record only the exact blocker evidence, attempted commands and output, and resume condition in implementation-owned evidence fields. Do not ask the user, call user-input tools, create control-plane stop files, classify the next state, archive logs, or write `complete.log`.

## Background

The project mapping exists, but the new domain rule assigns shared runtime algorithms and the Node protobuf bridge to speculative `apps/agent/internal/*` packages. The authoritative contracts require one shared implementation for provider execution, selection/failover, AgentTaskManager, guardrail, review/integration, and the Node bridge. This follow-up narrows the rule to standalone host composition and host-owned adapters and records.

## Archive Evidence Snapshot

- Prior task path: `agent-task/m-iop-agent-cli-runtime/13_agent_domain`
- Archived plan: `agent-task/m-iop-agent-cli-runtime/13_agent_domain/plan_local_G02_1.log`
- Archived review: `agent-task/m-iop-agent-cli-runtime/13_agent_domain/code_review_cloud_G02_1.log`
- Verdict: `FAIL`
- Findings: Required `2`, Suggested `0`, Nit `0`
- Affected file: `agent-ops/rules/project/domain/agent/rules.md`
- Verification evidence: the domain rule exists and `git diff --check` exits `0`, but the exact recorded mapping regex returns count `2` and exits `1`; a deterministic ownership search also finds speculative provider, selector, quota, task manager, guardrail, overlay, integration, and Node-bridge owners.
- Roadmap carryover: this remains a compatibility-preserving prerequisite and does not claim a Milestone Task on PASS.

## Analysis

### Files Read

- `agent-task/m-iop-agent-cli-runtime/13_agent_domain/plan_local_G02_1.log`
- `agent-task/m-iop-agent-cli-runtime/13_agent_domain/code_review_cloud_G02_1.log`
- `agent-task/m-iop-agent-cli-runtime/13_agent_domain/plan_cloud_G09_0.log`
- `agent-task/m-iop-agent-cli-runtime/13_agent_domain/code_review_cloud_G09_0.log`
- `agent-ops/rules/project/rules.md`
- `agent-ops/rules/project/domain/agent/rules.md`
- `agent-roadmap/current.md`
- `agent-roadmap/phase/automation-runtime-bridge/PHASE.md`
- `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md`
- `agent-roadmap/sdd/automation-runtime-bridge/iop-agent-cli-runtime/SDD.md`
- `agent-contract/index.md`
- `agent-contract/inner/agent-runtime.md`
- `agent-contract/inner/iop-agent-cli-runtime.md`
- `agent-spec/index.md`
- `agent-test/local/rules.md`

### SDD Criteria

The approved and unlocked SDD is `agent-roadmap/sdd/automation-runtime-bridge/iop-agent-cli-runtime/SDD.md`. This prerequisite preserves S04 (`node-consumer`) and the standalone application boundaries consumed by S10 (`cli-surface`), S11 (`local-control`), S12 (`project-logs`), and S15 (`client-process-manager`). Their Evidence Map rows require the Node bridge to remain compatible and future standalone packages to produce their own implementation evidence; this packet therefore documents ownership only and does not claim any Roadmap Task.

### Verification Context

No verification handoff was supplied. Repository-native evidence came from `agent-test/local/rules.md`, the active project/domain rules, both matching contracts, the approved SDD, and deterministic searches over the split plans. Local preflight resolved Go to `/config/.local/bin/go` (`go1.26.2 linux/arm64`, GOROOT `/config/opt/go`), although no Go command is needed because `apps/agent` source does not yet exist. Required checks are local, secret-free, and deterministic. Confidence is high; the only gap is semantic document validation, which the ownership assertions below close.

### Test Coverage Gaps

- No Go behavior changes, so no Go test is required.
- The previous existence and mapping checks did not cover ownership semantics. Add deterministic positive and negative contract assertions to the verification evidence.

### Symbol References

No Go symbol is renamed or removed. The documented pseudo-symbols `selector.Evaluator`, `quota.Parser`, `taskmanager.Manager`, and `nodebridge.Bridge` have no application source call sites and must be removed from the application-owned component list.

### Split Judgment

Keep one compact packet. One domain rule must express one indivisible application-versus-shared ownership boundary, and the task directory has no runtime predecessor.

### Scope Rationale

Modify only `agent-ops/rules/project/domain/agent/rules.md`. Keep the valid `apps/agent/**` mapping unchanged. Do not modify central `agent-ops/rules/common/**`, contracts, roadmap documents, shared Go packages, Node source, or add application source.

### Final Routing

- evaluation_mode: `isolated-reassessment`
- finalizer: `finalize-task-policy.sh pair`
- build closures: all `true`; grade scores `1/0/1/1/1`; base route basis `local-fit`; final route basis `recovery-boundary`; route `cloud-G04`; filename `PLAN-cloud-G04.md`
- review closures: all `true`; grade scores `1/0/1/1/1`; route basis `official-review`; route `cloud-G04`; filename `CODE_REVIEW-cloud-G04.md`
- large_indivisible_context: `false`
- positive loop risks: `boundary_contract` (count `1`)
- recovery signals: `review_rework_count=1`, `evidence_integrity_failure=true`
- capability-gap evidence: none

## Implementation Checklist

- [ ] Rewrite the agent domain rule around standalone host adapters and records, preserve every shared-runtime and Node owner, and run the deterministic ownership verification.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

### [REVIEW_API-1] Correct the Standalone Host Ownership Rule

#### Problem

`agent-ops/rules/project/domain/agent/rules.md:15-32`, `agent-ops/rules/project/domain/agent/rules.md:47-72`, and `agent-ops/rules/project/domain/agent/rules.md:95-103` declare speculative application packages for shared algorithms and place the Node protobuf bridge under `apps/agent`. This conflicts with the sole shared owners in `agent-contract/inner/agent-runtime.md:37,52,113,119` and `agent-contract/inner/iop-agent-cli-runtime.md:26-28`.

#### Solution

Replace speculative algorithm owners with the concrete standalone host packages established by the split work, and name the shared owners explicitly.

```text
Before (agent-ops/rules/project/domain/agent/rules.md:15-32)
apps/agent/internal/provider, selector, quota, taskmanager, guardrail,
overlay, changeset, integration, claim, workflow, state, logevents,
socket, clientproc, and nodebridge own runtime behavior.

After
apps/agent owns cmd/agent, command, host, bootstrap, taskloop adapters,
projectlog, localcontrol, and clientprocess.
packages/go/agentconfig, agentprovider, agentpolicy, agenttask,
agentguard, agentworkspace, and agentstate retain shared ownership.
The Node protobuf bridge remains apps/node/internal/node/runtime_bridge.go.
```

`taskloop` may compose shared ports and project-owned artifacts, but it must not claim the shared selector, continuation, manager, guardrail, review, or integration algorithms. Use `clientprocess` and `localcontrol`, matching the split implementation paths. Keep host-owned presentation and durable-record responsibilities distinct from shared lifecycle decisions.

#### Modified Files and Checklist

- [ ] `agent-ops/rules/project/domain/agent/rules.md` — rewrite included paths, components, preserved patterns, cross-domain boundaries, and prohibitions to match the authoritative ownership contracts.

#### Test Strategy

Skip Go tests because this packet changes no source behavior and `apps/agent` does not yet exist. Use deterministic shell assertions to prove the valid mapping, concrete application paths, explicit shared owners, Node bridge location, absence of speculative duplicate owners, and clean diff.

#### Verification

```bash
agent_rule='agent-ops/rules/project/domain/agent/rules.md'
set -e
test -f "$agent_rule"
test "$(rg -n --fixed-strings '| `apps/agent/**` | agent | `agent-ops/rules/project/domain/agent/rules.md` |' agent-ops/rules/project/rules.md | wc -l | tr -d ' ')" = 1
for rel in cmd/agent internal/command internal/host internal/bootstrap internal/taskloop internal/projectlog internal/localcontrol internal/clientprocess; do
  rg -q --fixed-strings "\`apps/agent/${rel}/\`" "$agent_rule"
done
for shared in agentconfig agentprovider agentpolicy agenttask agentguard agentworkspace agentstate; do
  rg -q --fixed-strings "\`packages/go/${shared}/\`" "$agent_rule"
done
rg -q --fixed-strings '`apps/node/internal/node/runtime_bridge.go`' "$agent_rule"
test -z "$(rg -n --sort path 'apps/agent/internal/(config|provider|selector|quota|taskmanager|guardrail|overlay|changeset|integration|claim|workflow|state|logevents|socket|clientproc|nodebridge)/|selector\.Evaluator|quota\.Parser|taskmanager\.Manager|nodebridge\.Bridge' "$agent_rule")"
```

Expected: every command exits `0`; the final search produces no output.

## Modified Files Summary

| File | Item |
|------|------|
| `agent-ops/rules/project/domain/agent/rules.md` | REVIEW_API-1 |

## Final Verification

```bash
agent_rule='agent-ops/rules/project/domain/agent/rules.md'
set -e
test -f "$agent_rule"
test "$(rg -n --fixed-strings '| `apps/agent/**` | agent | `agent-ops/rules/project/domain/agent/rules.md` |' agent-ops/rules/project/rules.md | wc -l | tr -d ' ')" = 1
for rel in cmd/agent internal/command internal/host internal/bootstrap internal/taskloop internal/projectlog internal/localcontrol internal/clientprocess; do
  rg -q --fixed-strings "\`apps/agent/${rel}/\`" "$agent_rule"
done
for shared in agentconfig agentprovider agentpolicy agenttask agentguard agentworkspace agentstate; do
  rg -q --fixed-strings "\`packages/go/${shared}/\`" "$agent_rule"
done
rg -q --fixed-strings '`apps/node/internal/node/runtime_bridge.go`' "$agent_rule"
test -z "$(rg -n --sort path 'apps/agent/internal/(config|provider|selector|quota|taskmanager|guardrail|overlay|changeset|integration|claim|workflow|state|logevents|socket|clientproc|nodebridge)/|selector\.Evaluator|quota\.Parser|taskmanager\.Manager|nodebridge\.Bridge' "$agent_rule")"
test -z "$(git diff --name-only -- agent-ops/rules/common agent-ops/skills/common)"
git diff --check
```

Expected: all commands exit `0`; the ownership and central-common searches produce no output. Cached Go test output is not applicable.

After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.
