<!-- task=m-iop-agent-cli-runtime plan=4 tag=REVIEW_REVIEW_REVIEW_REVIEW_API -->

# Plan - Exact dispatcher validation exemption and final S10/S13 closure

## For the Implementing Agent

Filling the implementation-owned sections in `CODE_REVIEW-*-G??.md` is mandatory. Implement the checklist, run every verification command, paste actual notes and stdout/stderr into the active review file, leave the active Plan/Review files in place, and report ready for review. Final verdicts, log renames, `complete.log`, and archive moves belong only to the code-review skill. If blocked, record only the exact blocker, attempted commands/output, and resume condition in implementation-owned evidence fields; do not ask the user, call user-input tools, create control-plane stop files, classify the next state, archive logs, or write `complete.log`.

## Background

The fourth review confirmed that the exact compiled lifecycle transcript, ordered two-work status projection, contract wording, and safe fresh S10/S13 matrix are otherwise judgeable. The remaining cutover guard removes an allowed validation command as an unanchored substring, so extra arguments on that same command and some wrapped Python callers can evade the ownership scan. This follow-up closes only that exact-command oracle gap and preserves all prior task-owned changes.

## Archive Evidence Snapshot

- `agent-task/m-iop-agent-cli-runtime/plan_local_G07_0.log` and `agent-task/m-iop-agent-cli-runtime/code_review_cloud_G07_0.log`: first loop, FAIL with 2 Required findings.
- `agent-task/m-iop-agent-cli-runtime/plan_cloud_G06_1.log` and `agent-task/m-iop-agent-cli-runtime/code_review_cloud_G07_1.log`: second loop, FAIL with 2 Required findings.
- `agent-task/m-iop-agent-cli-runtime/plan_cloud_G07_2.log` and `agent-task/m-iop-agent-cli-runtime/code_review_cloud_G07_2.log`: third loop, FAIL with 2 Required findings; the additive compiled lifecycle and contract-alignment follow-up was created.
- `agent-task/m-iop-agent-cli-runtime/plan_cloud_G08_3.log` and `agent-task/m-iop-agent-cli-runtime/code_review_cloud_G08_3.log`: fourth loop, FAIL with 1 Required, 0 Suggested, and 0 Nit findings.
- Remaining Required finding: `declaredDispatcherValidationCommand` strips the documented prefix even when extra dispatcher arguments remain, and the caller regex can miss wrapped forms; the S13 exception therefore is not exact.
- Fresh reviewer evidence: the safe full `apps/agent/...` suite with only `TestBuiltBinaryHeadlessS10Transcript` skipped, the internal race matrix, vet, current-host build, Darwin arm64 cross-build, logged-smoke preflight, and `git diff --check` passed. The reviewer did not execute the product `iop-agent` binary or a real provider CLI.
- Roadmap carryover: `cli-surface` remains the only unchecked Milestone Task and requires SDD S10 headless evidence plus `Roadmap Completion` after the exact S13 ownership guard passes.

## Roadmap Targets

- Milestone: `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md`
- Milestone link: [Milestone document](agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md)
- Task ids:
  - `cli-surface`: headless binary, split config, Milestone discovery/selection/preview, lifecycle, and per-work overlay/integration/blocker observation
- Completion mode: check-on-pass

## Analysis

### Files Read

- Active loop and review evidence: `agent-task/m-iop-agent-cli-runtime/PLAN-cloud-G08.md`, `agent-task/m-iop-agent-cli-runtime/CODE_REVIEW-cloud-G08.md`, and `agent-task/m-iop-agent-cli-runtime/code_review_cloud_G07_2.log`.
- Changed oracle and related behavior: `apps/agent/internal/taskloop/cutover_test.go`, `apps/agent/cmd/agent/main_test.go`, `apps/agent/internal/taskloop/workflow.go`, and `apps/agent/internal/taskloop/workflow_test.go`.
- Contract and design: `agent-contract/index.md`, `agent-contract/inner/iop-agent-cli-runtime.md`, `agent-roadmap/phase/automation-runtime-bridge/PHASE.md`, `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md`, and `agent-roadmap/sdd/automation-runtime-bridge/iop-agent-cli-runtime/SDD.md`.
- Rules and workflow: `agent-ops/rules/project/rules.md`, `agent-ops/rules/project/domain/agent/rules.md`, `agent-ops/rules/project/domain/testing/rules.md`, `agent-test/local/rules.md`, `agent-test/local/testing-smoke.md`, `agent-ops/skills/common/code-review/SKILL.md`, `agent-ops/skills/common/plan/SKILL.md`, and `agent-ops/skills/common/finalize-task-routing/SKILL.md`.

### SDD Criteria

- SDD: `agent-roadmap/sdd/automation-runtime-bridge/iop-agent-cli-runtime/SDD.md`; status `[approved]`, lock released, and no unresolved user review.
- Primary target: Acceptance Scenario `S10`, Milestone Task `cli-surface`; its Evidence Map requires binary plus split-config command integration and a headless operation transcript.
- Supporting boundary: `S13` requires zero product Python fallback/callers while the temporary Agent-Ops dispatcher ownership is bounded until Milestone completion.
- The checklist retains the accepted S10 transcript evidence and requires the exact S13 validation-command exception plus a fresh safe suite before emitting `cli-surface` Roadmap Completion.

### Verification Context

- Supplied handoff: the fourth-review finding, current active pair, current diff, recorded implementation output, and predicted archive identities.
- Local environment: `/config/workspace/iop-s0`, branch `dev`, Go `/config/.local/bin/go`, `go version go1.26.2 linux/arm64`, and `GOROOT=/config/opt/go`.
- Fresh reviewer commands passed with temporary caches outside the repository: safe full `./apps/agent/...` tests with only the product-binary test skipped, internal race tests, vet, build, Darwin arm64 cross-build, logged-smoke preflight, ownership search, and `git diff --check`.
- Preconditions: preserve the already-restored compiled transcript, canonical slug behavior, exact adapter DTO, and aligned S13 contract. Use deterministic temporary fixtures and no real provider process.
- Constraints: do not edit Agent-Ops common/project rules or skills, production CLI/runtime behavior, roadmap, SDD, or agent-spec. Official worker/review/final-verification paths must not execute the product `iop-agent` binary; use the explicit safe test skip and retain the recorded compiled transcript evidence.
- External Verification Preflight: not applicable. Darwin is a local cross-build, and logged-in macOS/provider execution belongs to already-completed S14 evidence.
- Gap and confidence: the exact-command escape is directly visible at `cutover_test.go:16,226-243`; confidence is high.
- Agent spec: `agent-spec/index.md` has no matching standalone `iop-agent` CLI spec, so code, contract, SDD, and tests remain authoritative.

### Test Coverage Gaps

- Existing coverage rejects a second dispatcher caller on another line but does not reject extra arguments appended to the otherwise allowed command.
- The execution-shaped caller regex does not prove rejection of wrapped caller syntax when `python3` is not preceded by start-of-line or whitespace.
- The documented candidate-plan and written-plan forms already pass the repository guard; retain positive coverage for both while adding the two negative regressions.
- S10 compiled lifecycle/status evidence is restored and recorded. Do not re-execute the product binary in this active task path; the safe full suite explicitly skips only that test.

### Symbol References

- No production symbol is renamed or removed.
- Test-local symbols `declaredDispatcherValidationCommand` and `noDispatcherCallerViolation` are referenced only in `apps/agent/internal/taskloop/cutover_test.go`; update all local uses if the matcher representation changes.

### Split Judgment

Keep one compact plan. Exact recognition and rejection are one scanner invariant in one test file, and separating matcher logic from its regressions would not create an independently acceptable intermediate state.

### Scope Rationale

- Change only the S13 test-owned cutover oracle and regressions. The standalone contract already states the intended bounded exception and must not change.
- Retain the prior task-owned contract, compiled transcript, canonical slug, and workflow test changes in the write claim until final PASS, but do not edit them unless the focused regression exposes a direct contradiction.
- Exclude production runtime behavior, Agent-Ops rules/skills, roadmap, SDD, agent-spec, real provider execution, and product-binary execution.

### Final Routing

- `evaluation_mode=isolated-reassessment`; finalizer `finalize-task-policy.sh`, mode `pair`.
- Build closures: scope/context/verification/evidence/ownership/decision all `true`; grade scores scope `1`, state `0`, blast `1`, evidence `1`, verification `1` = `G04`; base `local-fit`, final `recovery-boundary`, lane `cloud`.
- Review closures: scope/context/verification/evidence/ownership/decision all `true`; grade scores `1/0/1/1/1` = `G04`; route `official-review`, lane `cloud`, adapter `codex`, model `gpt-5.6-sol`, reasoning `xhigh`.
- `large_indivisible_context=false`; positive loop risks: `boundary_contract`, `structured_interpretation` (`loop_risk_count=2`).
- Recovery signals: `review_rework_count=4`, `evidence_integrity_failure=false`; recovery boundary matched.
- Capability gap: none.
- Canonical files: `PLAN-cloud-G04.md`, `CODE_REVIEW-cloud-G04.md`.

## Implementation Checklist

- [ ] [REVIEW_REVIEW_REVIEW_REVIEW_API-1] Enforce an exact declared dispatcher validation preflight and reject same-line suffix and wrapped callers with deterministic regressions.
- [ ] [REVIEW_REVIEW_REVIEW_REVIEW_API-2] Run the fresh no-product-binary S10/S13 closure matrix and record exact output.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

### [REVIEW_REVIEW_REVIEW_REVIEW_API-1] Exact validation-command exemption

**Problem**

`apps/agent/internal/taskloop/cutover_test.go:16,226-243` removes the allowed command with an unanchored `ReplaceAllString`. A line containing the documented command followed by `--dry-run` leaves only the suffix and no longer matches the dispatcher caller patterns; callers wrapped without whitespace before `python3` can also avoid the execution-shaped regex.

**Solution**

- Make the allowed-document exemption line/token aware: exempt only the exact candidate-plan or written-plan command with valid documentation boundaries and no extra dispatcher arguments or shell composition.
- Scan every remaining dispatcher occurrence after exact exemptions. Keep the dispatcher-owning project skill as the sole whole-document owner exception.
- Retain the declared command presence check for both plan and code-review documents.

Before (`apps/agent/internal/taskloop/cutover_test.go:16,237`):

```go
var declaredDispatcherValidationCommand = regexp.MustCompile(`python3 ... --validate-plan <(?:candidate-plan|written-plan)>`)

content = declaredDispatcherValidationCommand.ReplaceAllString(content, "")
```

After:

```go
remaining, err := removeExactDeclaredValidationCommand(content)
if err != nil {
    return exactCommandViolation(path, line, err)
}
if dispatcherCallerPattern.MatchString(remaining) {
    return callerViolation(path, line)
}
```

The helper shape is illustrative; keep all matching logic test-local and fail closed on extra tokens or composition.

**Modified Files and Checklist**

- [ ] `apps/agent/internal/taskloop/cutover_test.go`: replace substring stripping, preserve the exact documented positive forms, and add suffix/wrapper negative regressions.

**Test Strategy**

- Add `TestCutoverProductionOwnershipRejectsSuffixedValidationCommand` using the documented candidate command plus `--dry-run` in an allowed document; require path and line evidence.
- Add `TestCutoverProductionOwnershipRejectsWrappedPythonCaller` using a shell-wrapped dispatcher call in an allowed document; require path and line evidence.
- Retain `TestCutoverProductionOwnershipRejectsUnexpectedCallerInAllowedDocument` for a separate second caller and the live repository ownership test for both declared positive forms.

**Verification**

```bash
TMPDIR=/var/tmp/i GOTMPDIR=/var/tmp/i GOCACHE=/var/tmp/iop-cli-cutover/cache go test -count=1 ./apps/agent/internal/taskloop -run '^(TestCutoverProductionOwnershipHasNoReferenceCallerOrStaticRouteTable|TestCutoverProductionOwnershipRejectsInjectedPythonCaller|TestCutoverProductionOwnershipRejectsUnexpectedCallerInAllowedDocument|TestCutoverProductionOwnershipRejectsSuffixedValidationCommand|TestCutoverProductionOwnershipRejectsWrappedPythonCaller)$'
```

Expected: PASS; only the exact documented validation forms and the dispatcher-owning skill are exempt.

### [REVIEW_REVIEW_REVIEW_REVIEW_API-2] Fresh safe S10/S13 closure

**Problem**

The remaining guard defect controls whether the already-restored S10 evidence can be trusted for final Roadmap Completion. Final verification must cover the current checkout without violating the active-task prohibition on product-binary execution.

**Solution**

- Run the focused oracle tests, the safe full Agent suite with only `TestBuiltBinaryHeadlessS10Transcript` skipped, static analysis, builds, and logged-smoke preflight with fresh external caches.
- Preserve the prior compiled transcript output as archived evidence and do not execute a product binary or real provider CLI.
- Record every command's actual stdout/stderr and any deviation in the active review file.

**Modified Files and Checklist**

- [ ] `agent-task/m-iop-agent-cli-runtime/CODE_REVIEW-cloud-G04.md`: fill implementation evidence and exact command output.
- [ ] Retain `agent-contract/inner/iop-agent-cli-runtime.md`, `apps/agent/cmd/agent/main_test.go`, `apps/agent/internal/taskloop/workflow.go`, and `apps/agent/internal/taskloop/workflow_test.go` unchanged as task-owned carryover.

**Test Strategy**

- Item 1 owns the new regressions.
- Use `-count=1` and temporary caches. The full safe suite skips exactly the compiled product-binary test because active worker/review/final-verification paths may not execute it.
- Do not invoke a real provider CLI.

**Verification**

```bash
TMPDIR=/var/tmp/i GOTMPDIR=/var/tmp/i GOCACHE=/var/tmp/iop-cli-cutover/cache go test -count=1 -skip '^TestBuiltBinaryHeadlessS10Transcript$' ./apps/agent/...
```

Expected: PASS across every Agent package without product-binary or real-provider execution.

## Modified Files Summary

| File | Item |
|------|------|
| `apps/agent/internal/taskloop/cutover_test.go` | REVIEW_REVIEW_REVIEW_REVIEW_API-1 |
| `agent-contract/inner/iop-agent-cli-runtime.md` | REVIEW_REVIEW_REVIEW_REVIEW_API-2 ownership carryover; no planned edit |
| `apps/agent/cmd/agent/main_test.go` | REVIEW_REVIEW_REVIEW_REVIEW_API-2 ownership carryover; no planned edit |
| `apps/agent/internal/taskloop/workflow.go` | REVIEW_REVIEW_REVIEW_REVIEW_API-2 ownership carryover; no planned edit |
| `apps/agent/internal/taskloop/workflow_test.go` | REVIEW_REVIEW_REVIEW_REVIEW_API-2 ownership carryover; no planned edit |
| `agent-task/m-iop-agent-cli-runtime/CODE_REVIEW-cloud-G04.md` | REVIEW_REVIEW_REVIEW_REVIEW_API-2 |

## Final Verification

Fresh execution is required; cached Go test output is not acceptable. Do not execute the product `iop-agent` binary or a real provider CLI.

```bash
install -d -m 700 /var/tmp/i /var/tmp/iop-cli-cutover/cache /var/tmp/iop-cli-cutover/darwin-cache
```

Expected: temporary directories are ready outside the repository.

```bash
gofmt -w apps/agent/internal/taskloop/cutover_test.go
```

Expected: formatting completes without error.

```bash
TMPDIR=/var/tmp/i GOTMPDIR=/var/tmp/i GOCACHE=/var/tmp/iop-cli-cutover/cache go test -count=1 ./apps/agent/internal/taskloop -run '^(TestCutoverProductionOwnershipHasNoReferenceCallerOrStaticRouteTable|TestCutoverProductionOwnershipRejectsInjectedPythonCaller|TestCutoverProductionOwnershipRejectsUnexpectedCallerInAllowedDocument|TestCutoverProductionOwnershipRejectsSuffixedValidationCommand|TestCutoverProductionOwnershipRejectsWrappedPythonCaller)$'
```

Expected: focused exact-command and caller-rejection matrix PASS.

```bash
TMPDIR=/var/tmp/i GOTMPDIR=/var/tmp/i GOCACHE=/var/tmp/iop-cli-cutover/cache go test -count=1 -skip '^TestBuiltBinaryHeadlessS10Transcript$' ./apps/agent/...
```

Expected: every Agent package PASS while the prohibited product-binary test alone is skipped.

```bash
TMPDIR=/var/tmp/i GOTMPDIR=/var/tmp/i GOCACHE=/var/tmp/iop-cli-cutover/cache go vet ./apps/agent/internal/taskloop ./apps/agent/cmd/agent ./apps/agent/internal/bootstrap ./packages/go/...
TMPDIR=/var/tmp/i GOTMPDIR=/var/tmp/i GOCACHE=/var/tmp/iop-cli-cutover/cache make build-agent
TMPDIR=/var/tmp/i GOTMPDIR=/var/tmp/i GOCACHE=/var/tmp/iop-cli-cutover/darwin-cache GOOS=darwin GOARCH=arm64 go build -trimpath -o /var/tmp/iop-cli-cutover/iop-agent-darwin-arm64 ./apps/agent/cmd/agent
TMPDIR=/var/tmp/i GOTMPDIR=/var/tmp/i GOCACHE=/var/tmp/iop-cli-cutover/cache make test-iop-agent-logged-smoke-preflight
```

Expected: vet, current-host build, Darwin arm64 cross-build, and non-provider logged-smoke preflight PASS.

```bash
rg --sort path -n '\b(TestCutoverProductionOwnership|declaredDispatcherValidationCommand|removeExactDeclaredValidationCommand|dispatch\.py)\b' apps/agent/internal/taskloop/cutover_test.go agent-contract/inner/iop-agent-cli-runtime.md agent-ops/skills/common/plan/SKILL.md agent-ops/skills/common/code-review/SKILL.md agent-ops/skills/project/orchestrate-agent-task-loop/SKILL.md
git diff --check
git status --short
```

Expected: exact ownership references are intentional, no whitespace errors exist, and only task-owned changes plus unrelated pre-existing worktree changes remain.

After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.
